Autoencoder-Guided ML for Real-Time IoT Anomaly Detection

As the volume and complexity of Internet of Things (IoT) implementations proliferate, new cybersecurity challenges emerge that make anomaly detection harder, particularly in the case of limited data and real time requirements. In the past, Intrusion Detection Systems (IDS) are usually trained on balanced datasets, having access to clean normal traffic, which is rarely the case in working IoT environments. This paper presents a framework for supervised anomaly detection based on inverting the usual way of applying information to data labelling; in this case using only the attack traffic rather than normal traffic to train a deep autoencoder in order to generate realistic pseudo-normal samples based on low reconstruction error, and then using this data to produce normal balanced traffic made up of pseudo-normal samples, which statistically represents a true behavior without the