Nowadays, the Internet of Things (IoT) environment faces a large number of malicious threats and cyber-attacks, so the anomaly detection technology based on machine learning (DL) model, as an effective means of defense, has been favored by researchers. This paper introduces an Effective Anomaly Detection System (EADS) towards multiple DL models integration in IoT environment, which tries to address the issue of poor robustness in a single detection model. EADS first uses word embedding to transfer system call sequences as vectors. It then uses various ML model to merge the features of system call sequences, enhancing the reliability of the detection. Besides, EADS also adaptively integrates detection results of multiple models, thereby enhancing the robustness of anomaly detection. Finally, based on historical detection data, EADS updates ML models to stay clean. Experimental results show that EADS performs better than single detection model and its detection accuracy can reach 98% with a false positive rate of 3%.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

An Effective Anomaly Detection System Towards Multi-models Integration in IoT Environment

  • Kun Zhou,
  • Peng Yi,
  • Hailong Ma,
  • Weitao Han,
  • Tao Hu

摘要

Nowadays, the Internet of Things (IoT) environment faces a large number of malicious threats and cyber-attacks, so the anomaly detection technology based on machine learning (DL) model, as an effective means of defense, has been favored by researchers. This paper introduces an Effective Anomaly Detection System (EADS) towards multiple DL models integration in IoT environment, which tries to address the issue of poor robustness in a single detection model. EADS first uses word embedding to transfer system call sequences as vectors. It then uses various ML model to merge the features of system call sequences, enhancing the reliability of the detection. Besides, EADS also adaptively integrates detection results of multiple models, thereby enhancing the robustness of anomaly detection. Finally, based on historical detection data, EADS updates ML models to stay clean. Experimental results show that EADS performs better than single detection model and its detection accuracy can reach 98% with a false positive rate of 3%.