Threat Intelligence System for Internet of Things based Smart Environments using Unsupervised Learning

Abstract

With the advent of the Internet of Things (IoT), our environments have become pervasive. Studies indicate that most of the existing IoT devices have inherent security flaws and are vulnerable to both internal and external attacks. Threat identification is generally done by either identification of the specific type of attack in the network or by distinguishing benign traffic from anomalous traffic. Most of the recent works for threat identification rely on supervised machine learning techniques which involve training a model using datasets containing labeled samples of prior attacks. A supervised network can thus only understand the categories on which it has been trained. Due to the enormous volume and variety of data collected by the IoT devices, and the attacks to which the networks are prone, the supervised techniques are of limited use in practical applications. We propose a novel threat identification strategy using the Clustering based Variational Autoencoder (CVA) for detecting threats (anomalous behaviors) in IoT networks. The proposed strategy uses an unsupervised technique and hence the model needs to be trained only on traffic under benign scenarios for the identification of threats. Also, the proposed technique is scalable to accommodate a large number of devices.