Empowering Anomaly Detection in IoT Traffic Through Multiview Subspace Learning

With the frequent occurrence of information security incidents within the Internet of Things (IoT) landscape, there has been an increasing emphasis on anomaly detection in IoT traffic. Recently, supervised machine learning techniques have shown significant potential on this topic. However, the intricate nature of IoT network environments has posed a challenge in acquiring sufficient labeled samples of abnormal traffic. In comparison to supervised learning, unsupervised learning has more lenient sample requirements. Researchers have proposed various unsupervised detection methods, yet limitations persist. First, unsupervised learning, lacking guidance from labeled information, necessitates a more diverse range of traffic perspectives for comprehensive information coverage. Second, despite efforts to extract multiview traffic features from various perspectives, existing methods struggle to integrate these features effectively, limiting interpretability and introducing redundancy and noise. Lastly, conventional unsupervised methods often rely heavily on manually crafted features, potentially leading to biased and limited representations. In this article, we propose an unsupervised IoT traffic anomaly detection method based on multiview subspace learning. Specifically, we first construct a multiview traffic representation, including a protocol field view and a payload semantic view. Subsequently, a multiview subspace learning algorithm is designed to project the different views of traffic onto a unified and low-rank subspace, optimized using the augmented lagrangian multiplier with alternating direction minimization (ALM-ADM) strategy. Finally, spectral clustering is employed to accomplish IoT traffic anomaly detection. We benchmark the proposed method on multiple IoT traffic datasets and diverse computational platforms. The experimental results demonstrate that the method outperforms other state-of-the-art approaches in terms of accuracy and computational efficiency.