Citation

Alaghbari, Khaled Ab. Aziz and Lim, Heng Siong and Md Saad, Mohamad Hanif and Yong, Yik Seng (2023) Deep Autoencoder-Based Integrated Model for Anomaly Detection and Efficient Feature Extraction in IoT Networks. IoT, 4 (3). pp. 345-365. ISSN 2624-831X

Text 23.pdf - Published Version Restricted to Repository staff only Download (3MB)

Abstract

The intrusion detection system (IDS) is a promising technology for ensuring security against cyber-attacks in internet-of-things networks. In conventional IDS, anomaly detection and feature extraction are performed by two different models. In this paper, we propose a new integrated model based on deep autoencoder (AE) for anomaly detection and feature extraction. Firstly, AE is trained based on normal network traffic and used later to detect anomalies. Then, the trained AE model is employed again to extract useful low-dimensional features for anomalous data without the need for a feature extraction training stage, which is required by other methods such as principal components analysis (PCA) and linear discriminant analysis (LDA). After that, the extracted features are used by a machine learning (ML) or deep learning (DL) classifier to determine the type of attack (multi-classification). The performance of the proposed unified approach was evaluated on real IoT datasets called N-BaIoT and MQTTset, which contain normal and malicious network traffics. The proposed AE was compared with other popular anomaly detection techniques such as one-class support vector machine (OC-SVM) and isolation forest (iForest), in terms of performance metrics (accuracy, precision, recall, and F1-score), and execution time. AE was found to identify attacks better than OC-SVM and iForest with fast detection time. The proposed feature extraction method aims to reduce the computation complexity while maintaining the performance metrics of the multi-classifier models as much as possible compared to their counterparts. We tested the model with different ML/DL classifiers such as decision tree, random forest, deep neural network (DNN), conventional neural network (CNN), and hybrid CNN with long short-term memory (LSTM). The experiment results showed the capability of the proposed model to simultaneously detect anomalous events and reduce the dimensionality of the data.

Item Type:	Article
Uncontrolled Keywords:	autoencoder; anomaly detection; feature extraction; cyber security; IoT; machine learning; deep learning; CNN; LSTM; PCA
Subjects:	T Technology > TK Electrical engineering. Electronics Nuclear engineering > TK5101-6720 Telecommunication. Including telegraphy, telephone, radio, radar, television
Divisions:	Faculty of Engineering and Technology (FET)
Depositing User:	Ms Nurul Iqtiani Ahmad
Date Deposited:	31 Oct 2023 06:46
Last Modified:	31 Oct 2023 06:46
URII:	http://shdl.mmu.edu.my/id/eprint/11780

Downloads

Edit (login required)