Secure signal authentication is arguably one of the most challenging problems
in the Internet of Things (IoT) environment, due to the large-scale nature of
the system and its susceptibility to man-in-the-middle and eavesdropping
attacks. In this paper, a novel deep learning method is proposed for dynamic
authentication of IoT signals to detect cyber attacks. The proposed learning
framework, based on a long short-term memory (LSTM) structure, enables the IoT
devices (IoTDs) to extract a set of stochastic features from their generated
signal and dynamically watermark these features into the signal. This method
enables the cloud, which collects signals from the IoT devices, to effectively
authenticate the reliability of the signals. Moreover, in massive IoT
scenarios, since the cloud cannot authenticate all the IoTDs simultaneously due
to computational limitations, a game-theoretic framework is proposed to improve
the cloud's decision making process by predicting vulnerable IoTDs. The
mixed-strategy Nash equilibrium (MSNE) for this game is derived and the
uniqueness of the expected utility at the equilibrium is proven. In the massive
IoT system, due to a large set of available actions for the cloud, it is shown
that analytically deriving the MSNE is challenging and, thus, a learning
algorithm proposed that converges to the MSNE. Moreover, in order to cope with
the incomplete information case in which the cloud cannot access the state of
the unauthenticated IoTDs, a deep reinforcement learning algorithm is proposed
to dynamically predict the state of unauthenticated IoTDs and allow the cloud
to decide on which IoTDs to authenticate. Simulation results show that, with an
attack detection delay of under 1 second the messages can be transmitted from
IoT devices with an almost 100% reliability.

本文提出了一种基于深度学习的新颖方法，通过动态认证 IoT 信号以检测网络攻击，并提出了在大规模 IoT 场景中，基于博弈理论框架来预测易受攻击的 IoT 设备，以提高云端的决策能力。通过模拟结果表明，本方法使得消息几乎以 100% 的可靠性从 IoT 设备传输。

大规模物联网系统中的信号认证和安全的深度学习分析

Deep Learning for Signal Authentication and Security in Massive Internet  of Things Systems

It is important to understand to what extent, and in what perspectives, cyber
attacks can be predicted. Despite its evident importance, this problem was not
investigated until very recently, when we proposed using the innovative
methodology of {\em gray-box prediction}. This methodology advocates the use of
gray-box models, which accommodate the statistical properties/phenomena
exhibited by the data. Specifically, we showed that gray-box models that
accommodate the Long-Range Dependence (LRD) phenomenon can predict the attack
rate (i.e., the number of attacks per unit time) 1-hour ahead-of-time with an
accuracy of 70.2-82.1\%. To the best of our knowledge, this is the first result
showing the feasibility of prediction in this domain. We observe that the
prediction errors are partly caused by the models' incapability in predicting
the large attack rates, which are called {\em extreme values} in statistics.
This motivates us to analyze the {\em extreme-value phenomenon}, by using two
complementary approaches: the Extreme Value Theory (EVT) and the Time Series
Theory (TST). In this paper, we show that EVT can offer long-term predictions
(e.g., 24-hour ahead-of-time), while gray-box TST models can predict attack
rates 1-hour ahead-of-time with an accuracy of 86.0-87.9\%. We explore
connections between the two approaches, and point out future research
directions. Although our prediction study is based on specific cyber attack
data, our methodology can be equally applied to analyze any cyber attack data
of its kind.

通过使用灰盒预测，可以使用能够适应数据的统计特性和现象的灰盒模型来预测网络攻击率，同时使用极端值理论和时间序列理论，可以更好地分析长期趋势和短期趋势，并提出未来的研究方向。