Transfer Learning Auto-Encoder Neural Networks for Anomaly Detection of DDoS Generating IoT Devices

Machine Learning based anomaly detection ap- proaches have long training and validation cycles. With IoT devices rapidly proliferating, models on a per device basis is impractical. This work explores the “transfer- ability” of pre-trained autoencoder model across similar different nature. We hypothesized that nature would high level feature character- istics represented by initial layers autoencoder, while more distinct features are captured innermost layer neural network. In our experiments, centre-most were re-trained with limited new data belonging to device. Datasets seven Mirai infected nine Bashlite used; each dataset also included benign records representing un-infected behaviour. observed model’s accuracy improved an average 9.52% for 44.59% Bashlite. The highest performance improvement 26.68% 73.00% was when Ecobee thermostat tested other before after transfer learning respectively. Additionally, took 47.31% 58.27% less time further trialed efficacy flow network traffic using CIC- IDS2017 dataset. It performed best outliers in present, whereas failed perform decently cases where malicious activity did not cause significant deviation traffic’s footprint.