The widespread use of IoT devices has increased the importance of IoT security, and research on anomaly detection has attracted attention due to the properties of IoT devices, such as low resources. Flow data-based methods such as IPFIX, have attracted attention for the purpose of reducing analysis data from scalability perspective, but improving detection accuracy remains challenging. Recently, anomaly detection methods based on natural language processing (NLP) techniques have been proposed, and improved accuracy has been reported by considering the flow data context. In the application of NLP to flow data containing quantitative variables, it is necessary to construct a vocabulary by tokenization, which is different from the NLP. In this study, we propose a novel anomaly detection method combining a Vector Quantized Variational AutoEncoder (VQ-VAE) and a Transformer. This method improves the accuracy of anomaly detection by simultaneously learning the VQ-VAE and Transformer to achieve aggregated tokenization between flows with similar statistical and sequential characteristics. Experimental results on the ToN-IoT dataset showed that the proposed method achieves higher accuracy than methods in previous studies.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Unsupervised Contextual Anomalous Communication Detection Using VQ Tokenization with Flow Data

  • Norihiro Okui,
  • Shotaro Fukushima,
  • Ayumu Kubota,
  • Takuya Yoshida

摘要

The widespread use of IoT devices has increased the importance of IoT security, and research on anomaly detection has attracted attention due to the properties of IoT devices, such as low resources. Flow data-based methods such as IPFIX, have attracted attention for the purpose of reducing analysis data from scalability perspective, but improving detection accuracy remains challenging. Recently, anomaly detection methods based on natural language processing (NLP) techniques have been proposed, and improved accuracy has been reported by considering the flow data context. In the application of NLP to flow data containing quantitative variables, it is necessary to construct a vocabulary by tokenization, which is different from the NLP. In this study, we propose a novel anomaly detection method combining a Vector Quantized Variational AutoEncoder (VQ-VAE) and a Transformer. This method improves the accuracy of anomaly detection by simultaneously learning the VQ-VAE and Transformer to achieve aggregated tokenization between flows with similar statistical and sequential characteristics. Experimental results on the ToN-IoT dataset showed that the proposed method achieves higher accuracy than methods in previous studies.