Balanced Twin Auto-Encoder for IoT Intrusion Detection

Intrusion detection systems (IDSs) provide an ef-fective solution for protecting loT systems. However, due to the massive number of loT devices (in billions) and their heterogeneity, IDSs face challenges posed by the complexity of loT data such as correlation-based features, high dimensions, and imbalance. To address these problems, this paper proposes a novel neural network architecture, called Balanced Twin Auto-Encoder (BTAE) which consists of three components, i.e., an encoder, a hermaphrodite, and a decoder. The encoder of BTAE first aims to transfer the input data into the latent space before data samples (pre-images) are translated into this space by different translation vectors. In addition, the data of the skewed labels are also generated in the latent space to address the problem of imbalanced data in which the number of attack samples is often significantly lower than those of the benign samples. Second, the hermaphrodite component serves as a bridge to move the data from the encoder to the decoder. Third, the decoder tries to copy the distribution of the samples in the latent space. BTAE is trained by a supervised learning technique, and its data representation extracted from the decoder can well distinguish the attack from the normal data. The experiments on five loT botnet datasets show that BTAE outperforms three existing groups of methods, e.g., the typical supervised learning, the well-known sampling, and the state-of-the-art representation learning. In addition, the false alarm rate (FAR) of BTAE applied for loT intrusion detection is less than equal to 1.2%.