IMPACT: Impersonation Attack Detection via Edge Computing Using Deep Autoencoder and Feature Abstraction

Abstract

An ever-increasing number of computing devices interconnected through wireless networks encapsulated in the cyber-physical-social systems and a significant amount of sensitive network data transmitted among them have raised security and privacy concerns. Intrusion detection system (IDS) is known as an effective defence mechanism and most recently machine learning (ML) methods are used for its development. However, Internet of Things (IoT) devices often have limited computational resources such as limited energy source, computational power and memory, thus, traditional ML-based IDS that require extensive computational resources are not suitable for running on such devices. This study thus is to design and develop a lightweight ML-based IDS tailored for the resource-constrained devices. Specifically, the study proposes a lightweight ML-based IDS model namely IMPACT (IMPersonation Attack deteCTion using deep auto-encoder and feature abstraction). This is based on deep feature learning with gradient-based linear Support Vector Machine (SVM) to deploy and run on resource-constrained devices by reducing the number of features through feature extraction and selection using a stacked autoencoder (SAE), mutual information (MI) and C4.8 wrapper. The IMPACT is trained on Aegean Wi-Fi Intrusion Dataset (AWID) to detect impersonation attack. Numerical results show that the proposed IMPACT achieved 98.22% accuracy with 97.64% detection rate and 1.20% false alarm rate and outperformed existing state-of-the-art benchmark models. Another key contribution of this study is the investigation of the features in AWID dataset for its usability for further development of IDS.

Deep Semisupervised Learning-Based Network Anomaly Detection in Heterogeneous Information Systems

“…However, supervised learning alone is not feasible for modern IDSs because there are many possible attacks with different features, which renders the training process computationally expensive and time consuming. Therefore, most recent research works have applied autoencoders in IDSs and obtained promising outputs [48,49]. An autoencoder is an unsupervised learning technique that uses neural networks for the so-called task of representation learning [50].…”

AI for Cybersecurity: ML-Based Techniques for Intrusion Detection Systems

“…In the second work, several shallow algorithms such as random forest are also used to detect anomalies using the output of VAE. In a similar manner, the work introduced in [20] employs VAE with gradientbased linear SVM to detect some particular attacks on the AWID2019 dataset, where SVM first reduces feature dimension then VAE selects the most relevant features. It is reported that the detection rate is higher than state-of-art models.…”

“…It is reported that the detection rate is higher than state-of-art models. In addition to models in [18][19][20], the model introduced in [21] combines VAE with GAN and DNN. Basically, it uses VAE to obtain new input representations formed in a statistical and nonlinear way then GAN to make less-represented intrusions augmented.…”

A Machine Learning Based Two-Stage Wi-Fi Network Intrusion Detection System

“…They built the classifier for normal and impersonation attack samples. A quite similar approach was followed by Lee et al that emphasized three phases in the proposed IDS, feature extraction using SAE, feature selection using Mutual Information and C4.8, and SVM based classification with gradient descent optimization [14]. The goal was to reduce the number of features as much as possible for classification.…”