QAE-IDS: DDoS anomaly detection in IoT devices using Post-Quantization Training

Abstract

ABSTRACT Over the past few years, many intellectuals have focused on unsupervised learning for anomaly detection in IoT networks. Deploying an unsupervised Autoencoder algorithm for Intrusion Detection System (IDS) is computationally intensive for IoT devices with limited resources. In this work, we propose two distinct AI models using Post-Training Quantization; Quantized Autoencoder float16 (QAE-float16) and Quantized Autoencoder uint8 (QAE-uint8). QAE models are derived using Autoencoder models, which work on the assumption of generating high Reconstruction Error (RE) for anomaly data. Post Training Quantization includes pruning, clustering, and Quantization techniques. The proposed models were tested against the RT-IoT23 dataset, which includes normal and attack traces. This study is focused on the three major types of attacks, namely SSH brute-force, UFONet and DDoS (Distributed Denial of Service) exploitation. Since these attacks are the gateway for future exploitation. The model performance evaluated on IoT devices reveals that QAE-uint8 is the most efficient model by a wide margin, with average memory utilization decreased by 70.01%, memory size compressed by 92.23%, and peak CPU utilization decreased by 27.94%. Therefore, the proposed QAE-uint8 model has the potential to be used in low-power IoT Edge devices to detect anomalies.