In this paper, we present a survey of deep learning approaches for cybersecurity intrusion detection, the datasets used, and a comparative study. Specifically, we provide a review of intrusion detection systems based on deep learning approaches. The dataset plays an important role in intrusion detection, therefore we describe 35 well-known cyber datasets and provide a classification of these datasets into seven categories; namely, network traffic-based dataset, electrical network-based dataset, internet traffic-based dataset, virtual private network-based dataset, android apps-based dataset, IoT traffic-based dataset, and internet-connected devices-based dataset. We analyze seven deep learning models including recurrent neural networks, deep neural networks, restricted Boltzmann machines, deep belief networks, convolutional neural networks, deep Boltzmann machines, and deep autoencoders. For each model, we study the performance in two categories of classification (binary and multiclass) under two new real traffic datasets, namely, the CSE-CIC-IDS2018 dataset and the Bot-IoT dataset. In addition, we use the most important performance indicators, namely, accuracy, false alarm rate, and detection rate for evaluating the efficiency of several methods.

/pdf/deep-learning-for-cyber-security-intrusion-detection-gwyxxf1kkj.pdf

Deep learning for cyber security intrusion detection: Approaches, datasets, and comparative study

Cyber-attacks on the Internet of Things (IoT) are growing at an alarming rate as devices, applications, and communication networks are becoming increasingly connected and integrated. When attacks on IoT networks go undetected for longer periods, it affects availability of critical systems for end users, increases the number of data breaches and identity theft, drives up the costs and impacts the revenue. It is imperative to detect attacks on IoT systems in near real time to provide effective security and defense. In this paper, we develop an intelligent intrusion-detection system tailored to the IoT environment. Specifically, we use a deep-learning algorithm to detect malicious traffic in IoT networks. The detection solution provides security as a service and facilitates interoperability between various network communication protocols used in IoT. We evaluate our proposed detection framework using both real-network traces for providing a proof of concept, and using simulation for providing evidence of its scalability. Our experimental results confirm that the proposed intrusion-detection system can detect real-world intrusions effectively.

https://www.mdpi.com/1424-8220/19/9/1977/pdf

Towards Deep-Learning-Driven Intrusion Detection for the Internet of Things

With the ever increasing number of cyber-attacks, internet of Things (ioT) devices are being exposed to serious malware, attacks, and malicious activities alongside their development. While past research has been focused on centralized intrusion detection assuming the existence of a central entity to store and perform analysis on data from all participant devices, these approaches cannot scale well with the fast growth of ioT connected devices and introduce a single-point failure risk that may compromise data privacy. Moreover, with data being widely spread across large networks of connected devices, decentralized computations are very much in need. in this context, we propose in this article a Federated Learning based scheme for ioT intrusion detection that maintains data privacy by performing local training and inference of detection models. in this scheme, not only privacy can be assured, but also devices can benefit from their peers' knowledge by communicating only their updates with a remote server that aggregates the latter and shares an improved detection model with participating devices. We perform thorough experiments on an NSL-KDD dataset to evaluate the efficiency of the proposed approach. Experimental results and empirical analysis explore the robustness and advantages of the proposed Federated Learning detection model by reaching an accuracy close to that of the centralized approach and outperforming the distributed unaggregated on-device trained models.

Internet of Things intrusion Detection: Centralized, On-Device, or Federated Learning?

The growing development of IoT (Internet of Things) devices creates a large attack surface for cybercriminals to conduct potentially more destructive cyberattacks; as a result, the security industry has seen an exponential increase in cyber-attacks. Many of these attacks have effectively accomplished their malicious goals because intruders conduct cyber-attacks using novel and innovative techniques. An anomaly-based IDS (Intrusion Detection System) uses machine learning techniques to detect and classify attacks in IoT networks. In the presence of unpredictable network technologies and various intrusion methods, traditional machine learning techniques appear inefficient. In many research areas, deep learning methods have shown their ability to identify anomalies accurately. Convolutional neural networks are an excellent alternative for anomaly detection and classification due to their ability to automatically categorize main characteristics in input data and their effectiveness in performing faster computations. In this paper, we design and develop a novel anomaly-based intrusion detection model for IoT networks. First, a convolutional neural network model is used to create a multiclass classification model. The proposed model is then implemented using convolutional neural networks in 1D, 2D, and 3D. The proposed convolutional neural network model is validated using the BoT-IoT, IoT Network Intrusion, MQTT-IoT-IDS2020, and IoT-23 intrusion detection datasets. Transfer learning is used to implement binary and multiclass classification using a convolutional neural network multiclass pre-trained model. Our proposed binary and multiclass classification models have achieved high accuracy, precision, recall, and F1 score compared to existing deep learning implementations.

/pdf/design-and-development-of-a-deep-learning-based-model-for-44p77bxb8o.pdf

Design and Development of a Deep Learning-Based Model for Anomaly Detection in IoT Networks

Recent advances in the Internet of Things (IoT) are giving rise to a proliferation of interconnected devices, allowing the use of various smart applications The enormous number of IoT devices generates a large volume of data that requires further intelligent data analysis and processing methods such as deep learning (DL) Notably, DL algorithms, when applied to the Industrial IoT (IIoT), can provide various new applications, such as smart assembling, smart manufacturing, efficient networking, and accident detection and prevention Motivated by these numerous applications, in this article, we present the key potentials of DL in IIoT First, we review various DL techniques, including convolutional neural networks, autoencoders, and recurrent neural networks, as well as their use in different industries We then outline a variety of DL use cases for IIoT systems, including smart manufacturing, smart metering, and smart agriculture We delineate several research challenges with the effective design and appropriate implementation of DL-IIoT Finally, we present several future research directions to inspire and motivate further research in this area

Deep Learning in the Industrial Internet of Things: Potentials, Challenges, and Emerging Applications

With the increase in number of Internet connected devices, security and privacy concerns are the major obstacles impeding the widespread adoption of Internet of Things (IoT). Securing IoT has become a huge area of concern for all, including the consumers, organizations as well as the government. While attacks on any system cannot be fully prevented forever, real-time detection of the attacks are critical to defend the systems in an effective manner. In this paper, we propose a novel intrusion detection system that uses machine learning algorithms to detect security anomalies in IoT networks. This detection platform provides security as a service and facilitates interoperability between various network communication protocols used in IoT. In this paper, we provide a framework of the proposed system and discuss the intrusion detection process in detail.

https://dl.acm.org/doi/pdf/10.1145/3212687.3212872

Shiven Chawla

Papers

Towards Deep-Learning-Driven Intrusion Detection for the Internet of Things

Security as a service: real-time intrusion detection in internet of things