A smart home network will support various smart devices and applications, e.g., home automation devices, E-health devices, regular computing devices, and so on. Most devices in a smart home access the Internet through a home gateway (HGW). In this paper, we propose a software-defined-network (SDN)-HGW framework to better manage distributed smart home networks and support the SDN controller of the core network. The SDN controller enables efficient network quality-of-service management based on real-time traffic monitoring and resource allocation of the core network. However, it cannot provide network management in distributed smart homes. Our proposed SDN-HGW extends the control to the access network, i.e., a smart home network, for better end-to-end network management. Specifically, the proposed SDN-HGW can achieve distributed application awareness by classifying data traffic in a smart home network. Most existing traffic classification solutions, e.g., deep packet inspection, cannot provide real-time application awareness for encrypted data traffic. To tackle those issues, we develop encrypted data classifiers (denoted as DataNets) based on three deep learning schemes, i.e., multilayer perceptron, stacked autoencoder, and convolutional neural networks, using an open data set that has over 200 000 encrypted data samples from 15 applications. A data preprocessing scheme is proposed to process raw data packets and the tested data set so that DataNet can be created. The experimental results show that the developed DataNets can be applied to enable distributed application-aware SDN-HGW in future smart home networks.

The rapid adoption of mobile devices has dramatically changed the access to various networking services and led to explosion of mobile service traffic. Mobile service traffic classification has been a crucial task that attracts strong interest in mobile network management and security as well as machine learning communities for past decades. However, with more and more adoptions of encryption over mobile services, it brings a lot of challenges about mobile traffic classification. Although classical machine learning approaches can solve many issues that port and payload based methods cannot solve, it still has some limitations, such as time-consuming and costly handcrafted features, frequent features update. With the excellent ability of automatic feature learning, Deep Learning (DL) undoubtedly becomes a highly desirable approach for mobile services traffic classification, especially encrypted traffic. This survey paper looks at emerging research into the application of DL methods to encrypted traffic classification of mobile services and presents a general framework of Deep Learning based mobile encrypted traffic classification. Moreover, we review most of the recent existing work according to dataset selection, model input design and model architecture, etc. Furthermore, we propose some noteworthy issues and challenges about DL based mobile services traffic classification.

The traditional vehicular ad hoc network (VANET) gradually evolved into the internet of vehicles (IoV), which has also become a potential target for attacks and faces security challenges in an open network environment. Intrusion detection systems (IDS) based on machine learning (ML) and deep learning (DL) are introduced to mitigate security threats. However, existing ML/DL-based IDS suffer from challenges in IoV environments. First, due to the limitations of ML/DLbased methods, classification performance is unsatisfactory when they extract only unidirectional contextual features or spatial characteristics. Second, existing research on in-vehicle network IDS often limits validation and testing to a static dataset of a single vehicle model. This approach may not adequately address diverse potential attacks in a dynamic environment. Third, few studies of hybrid IDS can simultaneously implement in-vehicle and extra-vehicle network intrusion detection. Large language models (LLM) have shown outstanding applications in fields such as natural language processing (NLP) and computer vision (CV). In particular, bidirectional encoder representations from transformers (BERT) obtain new state-of-the-art results on eleven famous NLP tasks. Consequently, this paper introduces a hybrid network IDS in IoV utilising LLM, denoted as IoV-BERT-IDS. This framework encompasses four modules: semantic extractor (SE), input embedding, IoV-BERT-IDS pre-training, and IoVBERT- IDS fine-tuning. To conform to the BERT model, the semantic extractor is introduced to transform traffic data devoid of apparent semantics into contextual semantics, comprising bidirectional and unidirectional SE. Through SE, controller area network (CAN) data is transformed into a CAN byte sentence (CBS), while extra-vehicle network traffic data is transformed into a traffic byte sentence (TBS). Additionally, two pre-training tasks, the masked byte word model (MBWM) and next byte sentence prediction (NBSP) are proposed to acquire bidirectional contextual features from contextual semantics. These features can be adapted to downstream tasks in both in-vehicle and extravehicle networks through fine-tuning. Experiments demonstrate that IoV-BERT-IDS outperforms in CICIDS, BoT-IoT, Car-Hacking, and In-vehicle network intrusion detection challenge (IVN-IDS) datasets and shows good generalisation capabilities to in-vehicle networks of different vehicles.

In recent years, low recall rates and high dependencies on data labelling have become the biggest obstacle to developing deep anomaly detection (DAD) techniques. Inspired by the success of generative adversarial networks (GANs) in detecting anomalies in computer vision and imaging, we propose an anomaly detection model called FlowGANAnomaly for detecting anomalous traffic in network intrusion detection systems (NIDS). Unlike traditional GAN-based approaches, which are composed of a flow encoder, a convolutional encoder-decoder-encoder, a flow decoder and a convolutional encoder, the architecture of this model consists of a generator (G) and a discriminator (D). FlowGANAnomaly maps the different types of traffic feature data from separate datasets to a uniform feature space, thus can capture the normality of network traffic data more accurately in an adversarial manner to mitigate the problem of the high dependence on data labeling. Moreover, instead of simply detecting the anomalies by the output of D, we proposed a new anomaly scoring method that integrates the deviation between the output of two Gs' convolutional encoders with the output of D as weighted scores to improve the low recall rate of anomaly detection. We conducted several experiments comparing existing machine learning algorithms and existing deep learning methods (AutoEncoder and VAE) on four public datasets (NSL-KDD, CIC-IDS2017, CIC-DDoS2019, and UNSW-NB15). The evaluation results show that FlowGANAnomaly can significantly improve the performance of anomaly-based NIDS.

Consumer Electronics (CEs) are smart devices using IoT for connectivity. They’re susceptible to attacks like DoS, DDoS, and web attacks, impairing functions and enabling remote hijacking. Attackers can exploit CEs to target other systems, like vehicles. Malicious code can propagate through networks or CEs, causing vehicle failures. Existing ML/DL based IDS have high classification accuracy and robustness in traditional internet environments, but they are overly complex for performance improvement, which hinders their deployment in edge small computing environments. Furthermore, the comparison experiments of these intrusion detection algorithms with other algorithms are not sufficiently comprehensive to evaluate their performance in small computing environments. Therefore, balancing “detection performance and resource consumption” is a key issue in CE network detection. To address this issue, this paper proposes a hybrid feature selection model based on chi-square test and information gain combined Ig-Chi, which effectively reduces the feature dimensionality and improves the classification accuracy of classifiers for high-dimensional data sets. Additionally, layered intrusion detection is employed to perform intrusion detection on the data after feature selection. The experiments on four public data sets demonstrate that this method surpasses six ML/DL algorithms in terms of accuracy and resource indicators.