Abstract:Machine learning-based techniques have proven to be effective in IoT network behavioral inference. Existing works developed data-driven models based on features from network packets and/or flows, but mainly in a static and ad-hoc manner, without adequately quantifying their gains versus costs. In this paper, we develop a generic architecture that comprises two distinct inference modules in tandem, which begins with IoT network behavior classification followed by continuous monitoring. In contrast to prior relevant works, our generic architecture flexibly accounts for various traffic features, modeling algorithms, and inference strategies. We argue quantitative metrics are required to systematically compare and efficiently select various traffic features for IoT traffic inference. This paper makes three contributions. (1) For IoT behavior classification, we identify four metrics, namely cost, accuracy, availability, and frequency, that allow us to characterize and quantify the efficacy of seven sets of packet-based and flow-based traffic features, each resulting in a specialized model. By experimenting with traffic traces of 25 IoT devices collected from our testbed, we demonstrate that specialized-view models can be superior to a single combined-view model trained on a plurality of features by accuracy and cost. We also develop an optimization problem that selects the best set of specialized models for a multi-view classification; (2) For monitoring the expected IoT behaviors, we develop a progressive system consisting of one-class clustering models (per IoT class) at three levels of granularity. We develop an outlier detection technique on top of the convex hull algorithm to form custom-shape boundaries for the one-class models. We show how progression helps with computing costs and the explainability of detecting anomalies; and, (3) We evaluate the efficacy of our optimally-selected classifiers versus the superset of specialized classifiers by applying them to our IoT traffic traces. We demonstrate how the optimal set can reduce the processing cost by a factor of six with insignificant impacts on the classification accuracy. Also, we apply our monitoring models to a public IoT dataset of benign and attack traces and show they yield an average true positive rate of 94% and a false positive rate of 5%. Finally, we publicly release our data (training and testing instances of classification and monitoring tasks) and code for convex hull-based one-class models.

Multiple Hypothesis Testing in Cognitive IoT Sensor Network

Decentralized multiple hypothesis testing in Cognitive IOT using massive heterogeneous data

Plausible reasoning and knowledge extraction in Cognitive IoT

Data Aestheticization: A Cognitively-Inspired Method for Knowledge Discovery in Cognitive IoT Sensor Network

Combined Localization and Clustering Approach for Reduced Energy Presumption in Heterogeneous IoT

Multi-sensor data fusion for an efficient object tracking in Internet of Things (IoT)

KIHCDP: An Incremental Hierarchical Clustering Approach for IoT Data Using Dirichlet Process

Sparse Activity Discovery in Energy Constrained Multi-Cluster IoT Networks Using Group Testing

Evaluating Short-Term Forecasting of Multiple Time Series in IoT Environments

Anomaly-based intrusion detection system for IoT application

Multiple Hypothesis Testing Framework for Spatial Signals

Symptom-Based COVID-19 Prognosis through AI-Based IoT: A Bioinformatics Approach

A Bio-Inspired Solution to Cluster-Based Distributed Spectrum Allocation in High-Density Cognitive Internet of Things

Fault Matters: Sensor Data Fusion for Detection of Faults using Dempster-Shafer Theory of Evidence in IoT-Based Applications

Hypothesis Testing for Network Data with Power Enhancement.

Efficient IoT Traffic Inference: from Multi-View Classification to Progressive Monitoring

Optimization of IoT-Enabled Physical Location Monitoring Using DT and VAR

Hyperspectral Image Processing in Internet of Things model using Clustering Algorithm

MultiIoT: Benchmarking Machine Learning for the Internet of Things

Multi-Class Imbalanced Data Handling with Concept Drift in Fog Computing: A Taxonomy, Review, and Future Directions

A Graph Signal Processing Perspective of Network Multiple Hypothesis Testing with False Discovery Rate Control