An Unsupervised Self-Organizing Map Assisted Deep Autoencoder Gaussian Mixture Model for IoT Anomaly Detection

70% of Internet-connected devices are vulnerable to cyber-threats. Malicious traffic detection is essential for taking defensive measures. The current state-of-the-art anomaly detection research focuses on using different machine learning methods rather than taking advantage of high-dimensional datasets to find lurking anomalies. We propose an unsupervised self-organizing map-assisted deep autoencoder Gaussian mixture model. It detects anomalous activities of IoT devices in real-time. The proposed model consists of two key constituents: self-organizing map (SOM) and deep autoencoder Gaussian mixture model (DAGMM). SOM preserves the topology of the input space also its high-quality dimension reduction helps to develop an efficient estimation network. The other phase is DAGMM, which stores necessary information in low dimensional space and predicts anomalies by a pre-chosen threshold. In this work, we emphasize the real-world applicability of our proposed model. The increasing number of IoT devices caused a humongous amount of IoT traffic data which are often curated to train a model. With that goal in mind, we train and evaluate our model on internet traffic data which has a mixture of regular and irregular communication among IoT devices. It helps us to minimize false-positive rates than the current state-of-the-art models while keeping the scope of improvement via incoming communications