GMCWAE: A Representation Learning Technique for Network Intrusion Detection in IoT

Abstract

In the context of the Internet of Things (IoT), edge nodes often face constraints in computational and storage resources, making dimensionality reduction of high-dimensional raw traffic essential to alleviate the device burden. However, current representation learning (RL) methods struggle to extract meaningful features from such data, leading to reduced accuracy in network intrusion detection (NID). To address this challenge, we propose the gaussian mixture Cramér-wold auto-encoder (GMCWAE), designed to learn low-dimensional representations of network traffic that are both interpretable and discriminative, thereby enhancing the detection performance of classifiers. Furthermore, we integrate the lightweight ensemble learning method light gradient boosting machine (LightGBM) for detecting intrusive traffic. A comprehensive evaluation of the multiclass classification performance was conducted using three benchmark datasets: 1) NSL-KDD; 2) UNSW-NB15; and 3) CIC-IoT 2023. Compared to existing supervised dimensionality reduction methods, the low-dimensional representations learned by GMCWAE across the three datasets achieved higher accuracy and F1-scores across all classifiers used. And the proposed NID method achieved accuracies of 83.1%, 81.1%, and 97.62% across the three datasets, showing strong competitiveness compared to recent related works. The results indicate that GMCWAE is capable of providing high-quality low-dimensional representations of network traffic for resource-constrained devices, and the proposed NID model effectively safeguards against network threats in IoT environments.