Abstract:

As the volume and complexity of Internet of Things (IoT) implementations proliferate, new cybersecurity challenges emerge that make anomaly detection harder, particularly in the case of limited data and real time requirements. In the past, Intrusion Detection Systems (IDS) are usually trained on balanced datasets, having access to clean normal traffic, which is rarely the case in working IoT environments. This paper presents a framework for supervised anomaly detection based on inverting the usual way of applying information to data labelling; in this case using only the attack traffic rather than normal traffic to train a deep autoencoder in order to generate realistic pseudo-normal samples based on low reconstruction error, and then using this data to produce normal balanced traffic made up of pseudo-normal samples, which statistically represents a true behavior without the introduction of any synthetic noise as in the case of SMOTE or GANs. Then, a high recall and good performance XGBoost classifier can be trained to robustly differentiate between pseudo-normal and attack traffic. This method not only resolves the data imbalance problem, but also eliminates the need for clean normal traffic, a great benefit in realistic deployments where clean normal traffic is often lacking and often unreliable if it does exist. Test results using the BoT-IoT 5% data set indicate the framework presented produced a recall of 91% and better than 91% accuracy rates, showing a great capability over the baseline Isolation Forest models. This framework is computationally lightweight, runs on edge deployments, and provides exploitability outputs to support operational trust. Finally, this work presents a new learning task for reverse autoencoders, optimized for recall-first detections, and represents a paradigm shift for how anomaly detection systems can resiliently function under adversarial, constrained, and imbalanced data volume cases in IoT networks.

Key words: IoT, anomaly detection, security framework, autoencoders, machine learning, DDoS attacks