Intrusion detection systems (IDSs) play a critical role in protecting
billions of IoT devices from malicious attacks. However, the IDSs for IoT
devices face inherent challenges of IoT systems, including the heterogeneity of
IoT data/devices, the high dimensionality of training data, and the imbalanced
data. Moreover, the deployment of IDSs on IoT systems is challenging, and
sometimes impossible, due to the limited resources such as memory/storage and
computing capability of typical IoT devices. To tackle these challenges, this
article proposes a novel deep neural network/architecture called Constrained
Twin Variational Auto-Encoder (CTVAE) that can feed classifiers of IDSs with
more separable/distinguishable and lower-dimensional representation data.
Additionally, in comparison to the state-of-the-art neural networks used in
IDSs, CTVAE requires less memory/storage and computing power, hence making it
more suitable for IoT IDS systems. Extensive experiments with the 11 most
popular IoT botnet datasets show that CTVAE can boost around 1% in terms of
accuracy and Fscore in detection attack compared to the state-of-the-art
machine learning and representation learning methods, whilst the running time
for attack detection is lower than 2E-6 seconds and the model size is lower
than 1 MB. We also further investigate various characteristics of CTVAE in the
latent space and in the reconstruction representation to demonstrate its
efficacy compared with current well-known methods.

该研究文章提出了一种称为受限双变分自编码器（CTVAE）的新型深度神经网络 / 架构，可用于将入侵检测系统（IDS）的分类器提供更可分离 / 可区分和低维表示数据，相较于现行状态 - of-the-art 的神经网络，CTVAE 所需的内存 / 存储和计算能力更少，因此更适用于 IoT IDS 系统。通过与 11 个最流行的 IoT 僵尸网络数据集的广泛实验，表明 CTVAE 可以相对于现行的机器学习和表示学习方法，将攻击检测的准确度和 F 分数提高约 1％，同时攻击检测的运行时间低于 2E-6 秒，模型大小低于 1 MB。我们还进一步研究了 CTVAE 在潜在空间和重建表示中的各种特征，以证明与当前有名的方法相比，其有效性。