A novel intrusion detection method based on lightweight neural network for Internet of Things

Zhao, Ruijie ORCID: https://orcid.org/0000-0001-6168-8687, Gui, Guan ORCID: https://orcid.org/0000-0003-3888-2881, Xue, Zhi, Yin, Jie, Ohtsuki, Tomoaki ORCID: https://orcid.org/0000-0003-3961-1426, Adebisi, Bamidele ORCID: https://orcid.org/0000-0001-9071-9120 and Gacanin, Haris ORCID: https://orcid.org/0000-0003-3168-8883 (2022) A novel intrusion detection method based on lightweight neural network for Internet of Things. IEEE Internet of Things Journal, 9 (12). pp. 9960-9972. ISSN 2327-4662

Preview

Accepted Version Available under License In Copyright. Download (11MB) | Preview

Abstract

The purpose of a network intrusion detection (NID) is to detect intrusions in the network, which plays a critical role in ensuring the security of the Internet of Things (IoT). Recently, deep learning (DL) has achieved a great success in the field of intrusion detection. However, the limited computing capabilities and storage of IoT devices hinder the actual deployment of DL-based high-complexity models. In this article, we propose a novel NID method for IoT based on the lightweight deep neural network (LNN). In the data preprocessing stage, to avoid high-dimensional raw traffic features leading to high model complexity, we use the principal component analysis (PCA) algorithm to achieve feature dimensionality reduction. Besides, our classifier uses the expansion and compression structure, the inverse residual structure, and the channel shuffle operation to achieve effective feature extraction with low computational cost. For the multiclassification task, we adopt the NID loss that acts as a better loss function to replace the standard cross-entropy loss for dealing with the problem of uneven distribution of samples. The results of experiments on two real-world NID data sets demonstrate that our method has excellent classification performance with low model complexity and small model size, and it is suitable for classifying the IoT traffic of normal and attack scenarios.