Distributed Device-Specific Anomaly Detection using Deep Feed-Forward Neural Networks

The Internet of Things (IoT) requires sophisticated security measures because of heterogeneity and resource constraints. Current approaches in Anomaly Detection (AD) do not meet both challenges. Device-specific AD models can account for the heterogeneity of devices. However, existing approaches fail to run on constrained devices. This paper presents the approach of distributed device-specific AD models. Each model processes only data from one device. Through this simplification of the prediction task, lightweight AD models can be created. They provide the ability to counter the resource constraints of devices. With less requirements in processing power, IoT devices can perform AD on their own. The novel approach improves the optimization metrics detection performance, latency, and model complexity. The evaluation uses the publicly available UNSW-NB15 dataset. It shows that models can be simplified to run on IoT devices. Measurements with a device-specific model on a Raspberry PI show only a little increase in training and processing time compared to central processing on a desktop PC. While the accuracy maintains >98%, the F1-score increases from 0.64 up to 0.89 in the distributed approach.