A lightweight intrusion detection framework using focal loss variational autoencoder for internet of things / Shapla Khanam

Shapla , Khanam (2022) A lightweight intrusion detection framework using focal loss variational autoencoder for internet of things / Shapla Khanam. PhD thesis, Universiti Malaya.

	PDF (The Candidate's Agreement) Restricted to Repository staff only Download (211Kb)
	PDF (Thesis PhD) Download (2344Kb)

Abstract

Internet of Things (IoT) generates imbalanced network traffic; thus, the connected objects in the IoT face security issues, including different and unknown attack types. Even though traditional learning-based techniques have been used for intrusion detection in IoT, the detection of low-frequency attacks is lacking due to the imbalanced nature of network traffic. For example, conventional learning-based techniques suffer from lower detection accuracy, higher False Positive Rate (FPR), and lower minority-class attacks detection rates. Moreover, due to the constrained nature of IoT, the conventional heavyweight intrusion detection models are not suitable for IoT. To overcome these issues, this research aims to establish and evaluate a lightweight intrusion-detection framework using Class-wise Focal Loss Variational Autoencoder (CFLVAE) for IoT. In establishing the proposed framework, a data generation model was developed using CFLVAE. Precisely, the CFLVAE model utilizes an efficient and cost-sensitive objective function called Class-wise Focal Loss (CFL) to train Variational AutoEncoder (VAE) to solve the data imbalance problem. Additionally, a highly imbalanced NSL-KDD intrusion dataset is employed to conduct extensive experimentation of the proposed model. Furthermore, a Lightweight Deep Neural Network (LDNN) model is established for intrusion detection in the IoT and trained using the balanced intrusion dataset created from the CFLVAE model to improve the intrusion detection performance. To maintain lightweight criteria, feature reduction using Mutual Information (MI) method and network compression using the Quantization technique are applied. The results demonstrate that the proposed CFLVAE with LDNN (CFLVAE-LDNN) framework obtains promising performance in generating realistic new intrusion data samples and achieves superior intrusion detection performance. Specifically, the CFLVAE-LDNN achieves 88.08% overall intrusion detection accuracy and 3.77% false positive rate. It also achieved 79.25%, and 67.5% for Root to Local (R2L) and User to Root (U2R) low-frequency attacks detection rates, respectively. More significantly, low memory and CPU time consumption confirm that the proposed model is suitable for resource-constrained IoT. Overall, the proposed model benefits researchers and practitioners with intrusion detection in IoT.

Actions (For repository staff only : Login required)