Hybrid Anomaly Detection Model on Trusted IoT Devices

Abstract

Most machine learning proposals in the Internet of Things (IoT) are designed and evaluated on pre-processed datasets, where data acquisition and cleaning steps are often considered a black box. In addition, IoT environments have numerous challenges related to acquiring data from sensors, where sensitive data can be threatened by malicious users who seek to interfere with the communication channel or storage. Additionally, sensor data can also be affected by noise. Therefore, differentiating the type of threat/anomaly requires additional energy and computational resources. We propose to carry out data cleaning/anomaly techniques on the IoT device itself, not in the cloud servers but closer to the data source. Therefore, the IoT device sends trusted data to the Cloud. Among the benefits of this is the considerable reduction in the cost of implementation due to less movement of data between IoT devices and the Cloud. Consequently, we define three anomaly detection steps using smoothing filters, unsupervised learning, and deep learning techniques (i.e., hybrid model) to detect different variations of anomalies and threats while focusing on a small computational/memory footprint. The deployment of the hybrid model on AVR, Tensilica, and ARM microcontrollers showed that the last ones are an adequate target to implement the model because they best satisfy the necessary hardware requirements. The proposed model consumes 50KB of Flash and 12KB of RAM and processes data locally, achieving a bandwidth reduction of 60%. Finally, the hybrid model was tested in external datasets.

Hybrid Deep Learning Techniques for Securing Bioluminescent Interfaces in Internet of Bio Nano Things

“…Increasing levels of data (traffic) intricacy and a requirement for greater classification accuracy have led researchers to investigate applications of deep learning neural networks in the mainstream IoT domain. DL network structures have been shown to aid dynamic feature selection and significantly reduce false positives during traffic classification in heterogeneous IoT settings [26,27]. Abusitta et al [26] highlighted a preference for DL-based classification to recognize abnormal behavior in IoT traffic, prone to external noise over common ML algorithms.…”

“…Using de-noising autoencoders during the data pre-processing stage, the DL classifier was able to discriminate malicious traffic patterns by dynamically extracting useful features despite an unstable operational environment. Similarly, Rosero-Montalvo et al [27] used a hybrid DL ensemble to detect anomalies with minimal memory and computational footprint in high-noise IoT environments. Real estate and workload economy enabled DL classifier realization on off-shelf IoT sensory hardware as well as ensured high bandwidth efficiency.…”

“…To avoid model skewing inherent relative variability in BBI parameters requires redressal using statistical methods to achieve high throughput during classification. Complementary techniques such as local-neighbor density deviation (LOCAL), isolation using modeling (ISO), and elliptic envelope (ELLI) can cause decision edge confusion, data scattering, and computationally intensive [27,28,37]. Statistical outlier detection using robust scaling is used in the present study to maintain data characteristics while reducing data scattering with minimal overhead.…”

“…Although the overall difference in recorded metrics for the CNN, and CNN + LSTM model was minimal, the LSTM layer in the latter provides the additional benefit of extracting temporal correlations present in the in vivo traffic diffusion parameters such as the cumulative concentration rate released molecules (Ψ 0 ), the diffusion rate of molecules (m 0 ), and the drug delivery release rate (λ). Compared to ML, and DL models for generic and IoBNT-interface-specific anomaly detection classifiers in [23][24][25][26][27][28][29][30]33], the optimal hybrid model can classify anomalous parameter traffic by dynamically reducing feature dimensionality which would be manually intensive if using traditional ML. Summarization of key differences and advantages of the proposed hybrid model over complimentary schemes are detailed in 7.…”

“…These early non-ML reliant schemes allowed limited toleration for noisy signals affecting in-vivo TDD, while also being computationally intensive due to inherent multi-stage encryptions. Among ML/DL classification use-cases in IoT, and IoBNT domain, the primary constraint has been manual or multi-stage feature engineering as is the case in [25][26][27][28][29][30][31], as well as limited dataset diversity as in [33]. In the IoT domain, utilize semi-hybrid classification strategies to detect network anomalies.…”