In the Internet of Things, sensor devices often generate massive sensory data across multiple domains and applications. Identifying IoT malware from a huge amount of such IoT data is often a challenging task. In our previous studies, analytic techniques were applied to reduce dimensionality and discover valuable information from the original data. Particularly, the Self-organizing Maps (SOM)-based classifier with an AutoEncoder is used to create an end-to-end IoT malware detection model. However, the SOM-based classifier has a constraint that new instances may be incorrectly classified if they are mapped into unlabelled neurons in the SOM map. To address this issue, in this study, a novel hybrid between SOM-based classifier and well-known classification algorithms like K-Nearest Neighbors, Support Vector Machine, Softmax, Random Forest. In this hybrid, classification methods will help to correctly assign labels for instances mapped into the unlabeled neurons. In addition, this article investigates hyperparameter optimization methods for optimizing SOM hyperparameters. Our proposed methods were tested on the NBaIoT dataset with various experimental settings. Experimental results illustrate that SOMKNN often performs better than stand-alone techniques, including the SOM classifier.

Anomaly detection for IoT networks is a challenging issue due to the huge number of devices that connect to each other and generate huge amounts of data. In this study, we propose a model combining Autoencoder with classification algorithms to build an end-to-end architecture for processing, feature extraction and data classification. Autoencoder is used to extract valuable hidden features of the original data, while supervised learning algorithms such as Softmax, Random Forest, Decision Trees, XGBoost, etc. are used for training and testing on AE’s encoder output data. We then test our recommended models on nine recent devices in the NBaIoT dataset and evaluate their performance. According to the experimental results, the proposed model greatly improves the performance of IoT anomaly detection methods.

The Internet of Things with a billion connected devices can generate a huge amount of data daily. This poses challenges to security tasks (i.e. identifying IoT malware). Our previous studies used analytic techniques to reduce the data size and extract valuable information. Currently, clustering is a key technique for many data-driven applications, and it has been widely studied with different distance functions and algorithms. One research direction is to use representation learning for clustering. This research proposes a combination of Deep Clustering AutoEncoder (DCAE) with anomaly detection algorithms for an end-to-end anomaly detection framework. The DCAE maps the data from the original space to a lower-dimensional latent space, where it iteratively minimizes the clustering loss. Then, the output of DCAE is fed to algorithms such as Isolation Forest (IF), $K -$nearest Neighbors (KNN), Local Outlier Factor (LOF), and One-class Support Vector Machine (OCSVM) for identifying anomalies. The proposed model is evaluated on nine recent devices in the N-BaIoT dataset and measure their performance. The experimental results show that the new latent representation improves the IoT outlier detection methods significantly. The model’s time efficiency is also recorded to assess its suitability for practical applications.

Abstract— Malware detection is a critical challenge in the current era, especially for IoT devices. Previous studies have applied analytic techniques to reduce data size and extract valuable information. However, most of these studies count on a considerable quantity of outliers to perform anomaly detection. In this paper, we propose an enhanced method (named FeaWAD*) that improves the data encoding strategy based on the FeaWAD network [1]. These models require only a small fraction of anomalies for training. We evaluate the FeaWAD* method on the N-BaIoT dataset with various test scenarios for detecting known attacks as well as unknown future attacks. The experimental results demonstrate that the FeaWAD* method outperforms the original model FeaWAD and other popular anomaly detection methods such as Isolation Forest, Local Outlier Factor, and One-class Support Vector Machine. We also measure the time-based effectiveness of the model to assess its practical applicability.

The autoencoder-based latent representations have been widely developed for unsupervised learning in cyber-security domain, and has shown remarkable performance. Our previous work has introduced a hybrid autoencoders (AEs) and self-organizing maps (SOMs) for unsupervised IoT malware detection. However, the paper has only examined the characteristics of the latent representation of ordinary AEs in comparison to that of principle component analysis (PCA) on various IoT malware scenarios. This paper extends the work by employing denoising AEs (DAEs) to enhance the generalization ability of latent representations as well as optimizing hyper-parameters of SOMs to improve the hybrid performance. Particularly, this aims to further examine the characteristics of AE-based structure models (i.e., DAE) for identifying unknown/new IoT attacks and transfer learning. Our model is evaluated and analyzed extensively in comparison with PCA and AEs by a number of experiments on the NBaIoT dataset. The experimental results demonstrate that the latent representation of DAEs is often superior to that of AEs and PCAs in the task of identifying IoT malware.

A network intrusion detection model based on a neural network achieves accurate classification performance but suffers from high complexity, which is unsuitable for constrained-resource edge devices. In this work, we adopt classification parallelism and magnitude pruning to construct a lightweight detection model for programmable networking devices. Specifically, the multi-label classification model is decoupled into multiple binary class-specific sub-models, that allows a chain of programmable switches to participate in intrusion detection. Moreover, magnitude pruning is applied to remove weak connections for lowering the model size. Experimental results illustrate that the collaborative detection architecture obtains much lower model complexity than the traditional multi-label classifier without sacrificing in classification performance.

The feature representation of AutoEncoders (AEs) has been widely used for unsupervised learning, particularly in cybersecurity domain, and demonstrated promising performance. However, deeply investigations of the feature learner for the task of IoT attack detection in unsupervised learning have not been carried out yet. In this paper, we study the feature representation of AEs in combination with a subsequent clustering-based technique like Self-Organizing Maps (SOM) for unsupervised learning IoT attack detection. This aims to get insight into the characteristics of the AE learners in the tasks of unsupervised IoT detection such as identifying unknown/new IoT attacks and transfer learning. To highlight the behavior of AE-based learners, a feature reduction like Principle Component Analysis (PCA) is used to construct a feature space for facilitating SOM. The proposed models are investigated and assessed extensively by a number of experiments and analyses on the NBaIoT dataset. The experimental results highly suggest that AEs should be used for transferring models as training data is highly un-balanced and includes IoT attacks being similar to Benign. If the training data seems to be balanced, and contains IoT attacks being significantly deviated from Benign, the feature reduction like PCA is more preferable.

Malicious software, known as malware, has become urgently serious threat for computer security, so automatic mal-ware classification techniques have received increasing attention. In recent years, deep learning (DL) techniques for computer vision have been successfully applied for malware classification by visualizing malware files and then using DL to classify visualized images. Although DL-based classification systems have been proven to be much more accurate than conventional ones, these systems have been shown to be vulnerable to adversarial attacks. However, there has been little research to consider the danger of adversarial attacks to visualized image-based malware classification systems. This paper proposes an adversarial attack method based on the gradient to attack image-based malware classification systems by introducing perturbations on resource section of PE files. The experimental results on the Malimg dataset show that by a small interference, the proposed method can achieve success attack rate when challenging convolutional neural network malware classifiers.