CMTSNN: A Deep Learning Model for Multiclassification of Abnormal and Encrypted Traffic of Internet of Things

Abstract

With the increasing types and number of IoT devices and malicious programs and the popularization of encryption technology in the communication process between the internet and the Internet of Things (IoT), a large amount of encrypted abnormal traffic among devices endangers IoT cybersecurity. How to identify abnormal encrypted traffic of the IoT has become the premise of cybersecurity. Presently, most of the detection methods for traffic in the IoT have problems such as simple dataset processing, imperfect feature extraction, data imbalance, and low multi-classification accuracy. In this paper, we propose a multi-classification deep learning model named the cost matrix time-space neural network (CMTSNN) for abnormal and encrypted IoT traffic. The CMTSNN is divided into three parts. The first part is the preprocessing stage of the dataset, which needs to retain the timing relation between two data packets in the stream and create a cost penalty matrix according to the sample distribution. Aimed at the robustness of feature extraction in network flow, the second part extracts time series features and then space features to ensure the robustness of feature extraction. The third part is aimed at the problem of data imbalance. The cost penalty matrix is applied to the cost penalty layer in the training process, and then the improved cross-entropy loss function is used to calculate the loss to improve the classification accuracy of minority categories and increase the overall multi-classification performance of the model. Experiments were carried out with the ToN-IoT, BoT-IoT and ISCX VPN-NonVPN datasets. Compared with current methods, the proposed method shows better performances, including accuracy, precision, recall, F1 Score and false alarm rate.