IoT Botnet Attack Detection Using Deep Autoencoders

Detection of IoT botnet traffic with one deep autoencoder per device, trained only on that device's benign traffic statistics, on the public N-BaIoT records (UCI 442, CC BY 4.0). The study uses 9 devices of the published N-BaIoT data set, all 555,932 benign rows and 1,600,000 of 6,506,674 attack rows from 80 attack files (10 contiguous blocks of 2000 rows per attack file (up to 20000)). Split: time-ordered benign 60 / 20 / 20 with a 1 % embargo. Thresholds come from benign validation scores only and the decision rules were written before training. At the spec threshold (mean + 1 sd of the benign validation scores) the autoencoder, averaged over 3 seeds, satisfies detection at least 99 % and false alarms at most 1 % on 1 of 9 devices: mean detection 82.94 %, mean false alarms 2.33 % (largest device 14.07 %). The rule fixed in advance asks for at least 5 devices, so the verdict is NOT MET. At the 99.9th percentile of the same benign validation scores, reported beside it and not allowed to replace the verdict, 0 of 9 devices satisfy the same limits: mean detection 77.66 % (smallest 59.97 %), mean false alarms 0.20 % (largest 1.27 %); on the rule of at least 5 devices that row reads NOT MET. Mean AUC is 0.9939, while mean detection at a threshold set on benign rows is 82.94 % at the spec rule and 77.66 % at the 99.9th percentile. The misses are not spread evenly: gafgyt tcp (11.18 %), gafgyt udp (11.13 %) and mirai scan (98.77 %) stay below 99 % on average at the 99.9th percentile, and the other 7 attack types do not. The two measures can differ like this because AUC counts a row as a success when it ranks above most benign rows, while a threshold from the far tail of the benign scores needs it above nearly all of them. Verdict: yes, on ranking the task is easy. Every trivial check (untrained net, mean z^2 and max |z|) comes within 0.002 of the trained network's mean AUC or above it, so a near-perfect AUC here does not show that a deep network is needed. At the 99.9th percentile the limits are met on: autoencoder 0, untrained net 1, mean z^2 1, max |z| 1 of 9 devices. No other finished project in this series shares this task or data. Detection only: nothing here creates or sends traffic, and no capture was made.

Category: Electronics and Communication Engineering

Electronics & Communication Engineering Project E15 from ProTechSC Academy, with graphical abstract, video demonstration and project guidance.