Hybrid Anomaly Detection Model on Trusted IoT Devices

Abstract

Most machine learning proposals in the Internet of Things (IoT) are designed and evaluated on pre-processed datasets, where data acquisition and cleaning steps are often considered a black box. In addition, IoT environments have numerous challenges related to acquiring data from sensors, where sensitive data can be threatened by malicious users who seek to interfere with the communication channel or storage. Additionally, sensor data can also be affected by noise. Therefore, differentiating the type of threat/anomaly requires additional energy and computational resources. We propose to carry out data cleaning/anomaly techniques on the IoT device itself, not in the cloud servers but closer to the data source. Therefore, the IoT device sends trusted data to the Cloud. Among the benefits of this is the considerable reduction in the cost of implementation due to less movement of data between IoT devices and the Cloud. Consequently, we define three anomaly detection steps using smoothing filters, unsupervised learning, and deep learning techniques (i.e., hybrid model) to detect different variations of anomalies and threats while focusing on a small computational/memory footprint. The deployment of the hybrid model on AVR, Tensilica, and ARM microcontrollers showed that the last ones are an adequate target to implement the model because they best satisfy the necessary hardware requirements. The proposed model consumes 50KB of Flash and 12KB of RAM and processes data locally, achieving a bandwidth reduction of 60%. Finally, the hybrid model was tested in external datasets.