G-Mean for Optimum Threshold in Anomaly Detection with Autoencoder: Cyber Security on The RT-IOT2022 Dataset

Autoencoder is one of the most prominent methods in detecting attacks in RT-IoT2022 because the unsupervised learning method can capture abnormal patterns in the dataset. However, finding the optimum threshold is challenging in autoencoder-based anomaly detection, while false positives and false negatives are delicate matters in cybersecurity. This study aims to use g-mean to obtain the optimum threshold in autoencoder-based anomaly detection on the RT-IoT2022 dataset. We received the dataset from Kaggle and then applied several pre-processing methods, such as label encoder and normalization. The next step is to design and train the autoencoder model for anomaly detection. The receiver operating curve (ROC) and area under the curve (AUC) show how the autoencoder separates anomalous and non-anomalous data distribution. G-mean determines the optimum threshold for anomaly detection. We benchmark the g-mean with significance level alpha, z-score, and Bayesian model. The test results show that applying an autoencoder can increase the mean difference between normal and anomaly data from 0.0414 to 0.0453. Then, the autoencoder with g-mean thresholding has the highest accuracy, sensitivity, and g-mean compared to alpha, z-score, and Bayesian models, which are 0.94,0.94, and 0.93, respectively. Although its specificity is not the highest, its value is still above 0.9. Other methods cannot maintain accuracy, sensitivity, and g-mean above 0.4.