Cost-sensitive stacked auto-encoders for intrusion detection in the Internet of Things

Abstract

Abstract Intrusion Detection System (IDS) is an important tool for protecting the Internet of Things (IoT) networks against cyber-attacks. Traditional IDSs can only distinguish between normal and abnormal behaviors. On the other hand, modern techniques can identify the kind of attack so that the appropriate reactions can be carried out against each type of attack. However, these techniques always suffer from the class-imbalance which affects the performance of IDS. In this paper, we propose a cost-sensitive stacked auto-encoder, CSSAE, to deal with class imbalance problem in IDS. CSSAE generates a cost matrix in which a unique cost is assigned to each class based on the distribution of different classes. This matrix is created in the first stage of CSSAE. In the second phase, a two-layer stacked auto-encoder is applied to learn features with better distinguish between the minority and the majority classes. These costs are used in the feature learning of deep learning, where the parameters of the neural network are modified by applying the corresponding costs in the cost function layer. The proposed method is able to perform on both binary-class data and multiclass data. Two well-known KDD CUP 99 and NSL-KDD datasets are used to evaluate the performance of CSSAE. Compared with other IDSs that have not considered class imbalance problem, CSSAE shows better performance in the detection of low-frequency attacks.