IoT devices have been widely used in many fields, bringing many conveniences to people’s life. With the massive deployment and application of IoT devices, how to maintain the IoT from cyber-attacks has become one of the major concerns of researchers. Due to IoT devices’ limited computational capabilities and storage resources, IoT usually does not have sufficient security defense mechanisms, making it vulnerable to malware or device attacks. However, existing IoT-oriented intrusion detection systems usually only support the detection of specific malicious attacks or require complex models and massive computational resources to obtain high detection accuracy. We propose a lightweight and efficient intrusion detection method based on feature grouping to address the above challenges. We first design a fast protocol parsing method on the raw Packet Capture files to generate semantic-level parsing features. Then, we propose session merging and feature grouping methods. Finally, we verify the proposed features’ effectiveness and analyze the malicious attacks’ working process. The proposed method achieves more than 99.5% classification accuracy on three public IoT datasets. The proposed method requires significantly fewer computational resources than baseline methods in the protocol parsing and model training process. Experimental results show that the proposed method is lightweight, efficient, and extensible. Therefore, the proposed method is suitable for IoT intrusion detection.

We propose an attention-weighted model for parallel extraction of spatial-temporal features to enhance the detection capabilities in the message queuing telemetry transport protocol, widely used in the Internet of Things. Our approach involves constructing perception node collection graphs based on packet header information, which capture transmission-dependent and context-sequence-dependent relationships in the data streams. We leverage a message-passing mechanism to aggregate adjacent nodes and update the weight matrix accordingly. Additionally, we employ a bidirectional long short-term memory model to capture long-distance dependencies in the sequence. The updated graph and the output of the time-series model are fused and processed by a self-attention mechanism, generating weights for classification. The classification results are obtained using a fully connected network. We evaluate our approach on four datasets (ToN-IoT, BoT-IoT, UNSW-NB15, and DoHBrw2020) and compare it against nine different algorithms. Experimental results demonstrate the effectiveness of our method, achieving high accuracy levels, such as 0.8874 on ToN-IoT, 0.9386 on BoT-IoT, 0.9390 on DoHBrw2020, and the best accuracy of 0.8659 on the unbalanced UNSW-NB15 dataset.

With the increase of Internet visits and connections, it is becoming essential and arduous to protect the networks and different devices of the Internet of Things (IoT) from malicious attacks. The intrusion detection systems (IDSs) based on supervised machine learning (ML) methods require a large number of labeled samples. However, the number of abnormal behaviors is far less than that of normal behaviors, let alone that the shots of malicious behavior samples which can be intercepted as training dataset are actually limited. Consequently, it is a key research topic to conduct the anomaly detection for the small number of abnormal behavior samples. This paper proposes an anomaly detection model with a few abnormal samples to solve the problem in few-shot detection based on convolutional neural networks (CNN) and autoencoder (AE). This model mainly consists of the CNN-based supervised pretraining module and the AE-based data reconstruction module. Only a few abnormal samples are utilized to the pretrain module to build the structure of extracting deep features. The data reconstruction module simply chooses the deep features of normal samples as training data. There also exist some effective attention mechanisms in the pretraining module. Through the pretraining of small samples, the accuracy of abnormal detection is improved compared with merely training normal samples with AE. The simulation results prove that this solution can solve the above problems occurring in network behavior anomaly detection. In comparison to the original AE model and other clustering methods, the proposed model advances the detection results in a visible way.

Deep learning has been applied in the field of network intrusion detection and has yielded good results. In malicious network traffic classification tasks, many studies have achieved good performance with respect to the accuracy and recall rate of classification through self-designed models. In deep learning, the design of the model architecture greatly influences the results. However, the design of the network model architecture usually requires substantial professional knowledge. At present, the focus of research in the field of traffic monitoring is often directed elsewhere. Therefore, in the classification task of the network intrusion detection field, there is much room for improvement in the design and optimization of the model architecture. A neural architecture search (NAS) can automatically search the architecture of the model under the premise of a given optimization goal. For this reason, we propose a model that can perform NAS in the field of network traffic classification and search for the optimal architecture suitable for traffic detection based on the network traffic dataset. Each layer of our depth model is constructed according to the principle of maximum coding rate attenuation, which has strong consistency and symmetry in structure. Compared with some manually designed network architectures, classification indicators, such as Top-1 accuracy and F1 score, are also greatly improved while ensuring the lightweight nature of the model. In addition, we introduce a surrogate model in the search task. Compared to using the traditional NAS model to search the network traffic classification model, our NAS model greatly improves the search efficiency under the premise of ensuring that the results are not substantially different. We also manually adjust some operations in the search space of the architecture search to find a set of model operations that are more suitable for traffic classification. Finally, we apply the searched model to other traffic datasets to verify the universality of the model. Compared with several common network models in the traffic field, the searched model (NAS-Net) performs better, and the classification effect is more accurate.

Human activity recognition (HAR) based on wearable sensors is a promising research direction. The resources of handheld terminals and wearable devices limit the performance of recognition and require lightweight architectures. With the development of deep learning, the neural architecture search (NAS) has emerged in an attempt to minimize human intervention. We propose an approach for using NAS to search for models suitable for HAR tasks, namely, HARNAS. The multi-objective search algorithm NSGA-II is used as the search strategy of HARNAS. To make a trade-off between the performance and computation speed of a model, the F1 score and the number of floating-point operations (FLOPs) are selected, resulting in a bi-objective problem. However, the computation speed of a model not only depends on the complexity, but is also related to the memory access cost (MAC). Therefore, we expand the bi-objective search to a tri-objective strategy. We use the Opportunity dataset as the basis for most experiments and also evaluate the portability of the model on the UniMiB-SHAR dataset. The experimental results show that HARNAS designed without manual adjustments can achieve better performance than the best model tweaked by humans. HARNAS obtained an F1 score of 92.16% and parameters of 0.32 MB on the Opportunity dataset.

Network traffic classification technology plays an important role in network security management. However, the inherent limitations of traditional methods have become increasingly obvious, and they cannot address existing traffic classification tasks. Very recently, neural architecture search (NAS) has aroused widespread interest as a tool to automate the manual architecture construction process. To this end, this paper proposes NAS based on multiobjective evolutionary algorithms (MOEAs) to classify malicious network traffic. The main purpose is to simplify the search space by reducing the spatial ratio and number of channels of the model. In addition, the search strategy is changed in the effective search space, and the utilized strategies include EAs with the nondominated sorting genetic algorithm with the elite retention strategy (NSGA-II), strength Pareto evolutionary algorithm (SPEA-II) and multiobjective particle swarm optimization (MOPSO) to solve the formulated multiobjective NAS. Through comprehensive comparison of the population convergence times, model accuracies, Pareto optimality sets, model complexities and running speeds of the strategies, it is concluded that the model based on NSGA-II search has the best performance. The experimental results of the current machine learning algorithms and artificial learning methods based on the network are compared, showing that our method achieved better classification performance on two public datasets with a lower computational complexity, as mainly measured by FLOPs. Our approach is able to achieve 99.806% and 99.369% F1-score with 11.501 MB and 4.718 MB FLOPs on both IDS2012 and ISCX VPN dataset respectively.