An unsupervised generative adversarial network based-host intrusion detection system for internet of things devices

Abstract

Machine learning (ML) and deep learning (DL) have achieved amazing progress in diverse disciplines. One of the most efficient approaches is unsupervised learning (UL), a sort of algorithms for analyzing and clustering unlabeled data; it allows identifying hidden patterns or performing data clustering over provided data without the need for human involvement. There is no prior knowledge of actual abnormalities when using UL methods in anomaly detection (AD); hence, a DL-intrusion detection system (IDS)- based on AD depends intensely on their assumption about the distribution of anomalies. In this paper, we propose a novel unsupervised AD Host-IDS for internet of things (IoT) based on adversarial training architecture using the generative adversarial network (GAN). Our proposed IDS, called “EdgeIDS”, targets mostly IoT devices because of their limited functionality; IoT devices send and receive only specific data, not like traditional devices, such as servers or computers that exchange a wide range of data. We benchmarked our proposed “EdgeIDS” on the message queuing telemetry transport (MQTTset) dataset with five attack types, and our obtained results are promising, up to 0.99 in the ROC-AUC metric, and to just 0.035 in the ROC-EER metric. Our proposed technique could be a solution for detecting cyber abnormalities in the IoT.