Generative Deep Learning to Detect Cyberattacks for the IoT-23 Dataset

Abstract

The rapid growth of Internet of Things (IoT) is expected to add billions of IoT devices connected to the Internet. These devices represent a vast attack surface for cyberattacks. For example, these IoT devices can be infected with botnets to enable Distributed Denial of Service (DDoS) attacks. Signaturebased intrusion detection systems are traditional countermeasures for such attacks. However, these methods rely on human experts and are time-consuming in terms of updates and may not exhaust all attack types especially zero-day attacks. Deep learning has shown some promise in intrusion detection. This paper shows that it is possible to use generative deep learning methods like Adversarial Autoencoders (AAE) and Bidirectional Generative Adversarial Networks (BiGAN) to detect intruders based on an analysis of the network data. The recently posted full IoT-23 dataset based on Somfy door lock, Philips Hue and Amazon Echo devices was used to train generative deep learning models to detect a variety of attacks like DDoS, and various botnets like Mirai, Okiruk and Torii. Over 1.8 million network flows were used to train the various models. The resulting generative models outperform traditional machine learning techniques like Random Forests. Both AAE and BiGAN-based models were able to achieve an F1-Score of 0.99. A BiGAN to detect unknown attacks was also trained to detect novel zero-day attacks with an F1-Score from 0.85 to 1.

Detecting Zero-Day Intrusion Attacks Using Semi-Supervised Machine Learning Approaches

“…Finally, by benchmarking our approach against existing approaches for detecting zero-day attacks (see Table 1), we observed that OCSVM achieved the best MCC of 74%, precision of 84%, recall of 95%, and F 1 score of 85% using the semi-supervised approach. A comparison of our results with those obtained by [27] in approach can also be compared to DL approaches, such as those adopted in [30], which achieved an F 1 score of 85%.…”

“…Abdalgawad et al [30] demonstrated that DL methods including adversarial autoencoders (AAE) and bidirectional adversarial networks (BiGAN) are effective for detecting zero-day network attacks. These methods were evaluated on the IoT-23 dataset, which comprises of 15 network attacks and 19 network traffic features.…”

Prediction Models to Effectively Detect Malware Patterns in the IoT Systems

“…The authors in [12] used Bidirectional Generative Adversarial Networks (BiGAN) and Adversarial Autoencoders (AAE) to detect malware in network traffic based on the full IoT-23 dataset version. The proposed models outperformed traditional ML such as RF, by getting an f1-score of 99.…”

“…However, these studies are not analyzed all existed labels of the IoT-23 dataset. For example, the authors in [8] involved detection for four malware types, while in [9] and [10] papers only five malware types were classified, and eight and nine malware types were analyzed in [11] and [12], respectively. Finally, in ML context RF and boosting algorithms are the best candidates for the proposed security system.…”

Análise de Tráfego de Rede com Machine Learning para Identificação de Ameaças a Dispositivos IoT

“…Abdalgawad et al [9] empregaram os modelos AAE (Adversarial Autoencoders) e BiGAN (Bidirectional Generative Adversarial Networks) de aprendizagem profunda generativa para classificar os ataques do conjunto IoT-23. Foram obtidas alta acurácia de classificação de ataques conhecidos (escore F 1 na ordem de 99%) e capacidade de detectar ataques zeroday (ou seja, ameaças recém descobertas, para as quais ainda não há solução) com escore F 1 variando de 85% a 100%.…”