Deep Neural Network for Anomaly Detection
- Publication Type:
- Thesis
- Issue Date:
- 2024
Open Access
Copyright Clearance Process
- Recently Added
- In Progress
- Open Access
This item is open access.
The rapid growth in diverse network devices (e.g., Internet of Things/IoT devices) and new cyber-physical systems (CPSs) services create new surfaces for cyberattacks. To safeguard these CPSs, anomaly detection (AD) that detects potential attacks/adversarial behaviors plays a pivotal role. This thesis aims to design novel deep neural models to handle four challenges of the AD problem to deal with new/unknown attacks, imbalanced data, the lack of labelled data, and the vulnerability to data poisoning attacks.
First, to detect new/unknown anomalies (attacks) effectively, the thesis proposes a novel representation learning method, i.e., AutoEncoders (AEs) based models, that better represents unknown attacks, facilitating supervised learning-based AD methods. An AE consists of an encoder and a decoder component. The encoder compresses the input data into a lower-dimension representation, while the decoder attempts to reconstruct the original input from this compressed representation. Specifically, we develop three regularized AEs variants to learn a latent representation from the input data. In the new feature space, the normal and the attack data are more effectively separated. Therefore, the accuracy of detecting both known and unknown attacks is improved significantly.
Second, the thesis introduces two deep generative models to handle the imbalanced data. The first model, Conditional Denoising Adversarial AutoEncoder (CDAAE), generates specific types of attack samples. The second model (CDAEE-KNN) is a hybrid of CDAAE and the K-nearest Neighbor algorithm to generate borderline attack samples. By training on the augmented datasets, the accuracy of the AD problems is enhanced significantly.
Third, the thesis designs a Deep Transfer Learning (DTL) model to build an effective AD system from both labelled and unlabelled data. Specifically, we develop a DTL model based on two AEs. The first AutoEncoder (AE) is trained on the source datasets (source domains) in the supervised mode using the label information, and the second AE is trained on the target datasets (target domains) in an unsupervised manner without label information. As a result, the latent representation of the second AE can be used to detect attacks in the target domain effectively.
Fourth, to reduce the influence of data poisoning attacks that are damaging and popular to low-end IoT devices, the thesis proposes a novel Federated Learning (FL) system with the Shrink Denoising AutoEncoder (FL-SDAE). The reconstruction term of the loss function helps Shrink Denoising AutoEncoder (SDAE) reconstruct the original data from its corrupted version. Therefore, the proposed SDAE model makes FL-SDAE robust to data poisoning attacks.
Please use this identifier to cite or link to this item: