A behavioural network traffic novelty detection for the Internet of Things infrastructures

The Internet of Things (IoT) applied solutions are changing the way the world perceives technology. IoT devices are now being used in a wide range of applications to transfer or share relevant information, hence reducing human interventions. With such widespread IoT solutions, security becomes a significant concern. Many of the IoT devices are vulnerable due to several reasons, including in-secure implementations, poor life cycle management, and inappropriate configurations, leading to an increase in the risk of these devices getting exposed and attacked. However, the current security approaches for detecting compromised IoT devices are inefficient, especially for zero-day attacks. Since no one knows how a new attack would look like, it will be useful to monitor and detect anomalies using accurate detection techniques. This work probes the possibility of detecting IoT network traffic anomalies using novelty detection techniques; thus, it can detect compromised IoT devices. One of this work’s main contributions is developing an IoT anomaly detection system named Behavioural Novelty Detection for IoT Infrastructure (BND-IoT). BND-IoT trains a neural network with novel selected behavioural features extracted from benign traffic only and then uses the novelty techniques to detect any unusual traffic patterns. We show that the presented approach effectively detects anomalies within IoT devices’ network traffic with a robust average F1-score of 96.7% and a low false rejection rate of 7%.