Internet of Things (IoT) has emerged as a cutting-edge technology that is changing human life. The rapid and widespread applications of IoT, however, make cyberspace more vulnerable, especially to IoT-based attacks in which IoT devices are used to launch attack on cyber-physical systems. Given a massive number of IoT devices (in order of billions), detecting and preventing these IoT-based attacks are critical. However, this task is very challenging due to the limited energy and computing capabilities of IoT devices and the continuous and fast evolution of attackers. Among IoT-based attacks, unknown ones are far more devastating as these attacks could surpass most of the current security systems and it takes time to detect them and “cure” the systems. To effectively detect new/unknown attacks, in this article, we propose a novel representation learning method to better predictively “describe” unknown attacks, facilitating supervised learning-based anomaly detection methods. Specifically, we develop three regularized versions of autoencoders (AEs) to learn a latent representation from the input data. The bottleneck layers of these regularized AEs trained in a supervised manner using normal data and known IoT attacks will then be used as the new input features for classification algorithms. We carry out extensive experiments on nine recent IoT datasets to evaluate the performance of the proposed models. The experimental results demonstrate that the new latent representation can significantly enhance the performance of supervised learning methods in detecting unknown IoT attacks. We also conduct experiments to investigate the characteristics of the proposed models and the influence of hyperparameters on their performance. The running time of these models is about 1.3 ms that is pragmatic for most applications.

中文翻译：

---

学习物联网异常检测的潜在表示


物联网（IoT）已成为正在改变人类生活的尖端技术。然而，物联网的快速和广泛应用使得网络空间变得更加脆弱，特别是容易受到基于物联网的攻击，即利用物联网设备对网络物理系统发起攻击。鉴于物联网设备数量巨大（数十亿），检测和防止这些基于物联网的攻击至关重要。然而，由于物联网设备的能量和计算能力有限以及攻击者的持续快速演变，这项任务非常具有挑战性。在基于物联网的攻击中，未知的攻击更具破坏性，因为这些攻击可能超越当前的大多数安全系统，并且需要时间来检测它们并“治愈”系统。为了有效检测新的/未知的攻击，在本文中，我们提出了一种新颖的表示学习方法，以更好地预测“描述”未知攻击，促进基于监督学习的异常检测方法。具体来说，我们开发了三个正则化版本的自动编码器（AE）来从输入数据中学习潜在表示。这些正则化 AE 的瓶颈层将使用正常数据和已知的物联网攻击以监督方式进行训练，然后将用作分类算法的新输入特征。我们对最近的九个物联网数据集进行了广泛的实验，以评估所提出模型的性能。实验结果表明，新的潜在表示可以显着增强监督学习方法在检测未知物联网攻击方面的性能。我们还进行了实验来研究所提出模型的特征以及超参数对其性能的影响。这些模型的运行时间约为1。3 毫秒对于大多数应用来说是实用的。