IoT-IE: An Information-Entropy-Based Approach to Traffic Anomaly Detection in Internet of Things

Security issues related to the Internet of Things (IoTs) have attracted much attention in many fields in recent years. One important problem in IoT security is to recognize the type of IoT devices, according to which different strategies can be designed to enhance the security of IoT applications. However, existing IoT device recognition approaches rarely consider traffic attacks, which might change the pattern of traffic and consequently decrease the recognition accuracy of different IoT devices. In this work, we first validate by experiments that traffic attacks indeed decrease the recognition accuracy of existing IoT device recognition approaches; then, we propose an approach called IoT-IE that combines information entropy of different traffic features to detect traffic anomaly. We then enhance the robustness of IoT device recognition by detecting and ignoring the abnormal traffic detected by our approach. Experimental evaluations show that IoT-IE can effectively detect abnormal behaviors of IoT devices in the traffic under eight different types of attacks, achieving a high accuracy value of 0.977 and a low false positive rate of 0.011. It also achieves an accuracy of 0.969 in a multiclassification experiment with 7 different types of attacks.

Spatiotemporal Road Traffic Anomaly Detection: A Tensor-Based Approach

The increased development of urban areas results in a larger number of vehicles on the road network, leading to traffic congestion, which often leads to potentially dangerous situations that can be described as anomalies. The tensor-based methods emerged only recently in applications related to traffic anomaly detection. They outperform other models regarding simultaneously capturing spatial and temporal components, which are of immense importance in traffic dataset analysis. This paper presents a tensor-based method for extracting the spatiotemporal road traffic patterns represented with the speed transition matrices, with the goal of anomaly detection. A novel anomaly detection approach is presented, which relies on computing the center of mass of the observed traffic patterns. The method was evaluated on a large road traffic dataset and was able to detect the most anomalous parts of the urban road network. By analyzing spatial and temporal components of the most anomalous traffic patterns, sources of anomalies can be identified. Results were validated using the extracted domain knowledge from the Highway Capacity Manual. The anomaly detection model achieved a precision score of 92.88%. Therefore, this method finds its usages for safety experts in detecting potentially dangerous road segments, urban traffic planners, and routing applications.

Optimizing Network Anomaly Detection Based on Network Traffic

Cyber-attack is a very hot topic today. Nowadays, systems must always be connected to the internet, and network infrastructure keeps growing in both scale and complexity. Therefore, the problem of detecting and warning cyber-attacks is now very urgent. To improve the effectiveness of detecting cyber-attacks, many methods and techniques were applied. In this paper, we propose to apply two methods of optimizing cyber-attack detection based on the IDS 2018 dataset using Principal Component Analysis (PCA) and machine learning algorithms. In the experimental section, we compare and evaluate the efficiency of the algorithm through 2 parameters: detection and processing time, and the accuracy of the algorithm. The experimental results show that the model using optimized features has brought an apparent and better effect than models that have not reduced the feature dimension. Keywords— PCA; Network traffic; Anomaly; Cyberattack detection.