Detecting Out-of-Distribution Samples in Complex IoT Traffic Based on Distance Loss
Source abstract
Abstract
Out-of-distribution (OOD) detection is critical for securing Internet of Things (IoT) systems, particularly in applications such as intrusion detection and device identification. However, conventional classification-based approaches struggle in IoT environments due to challenges like large class numbers and data imbalance. To address these limitations, we propose a novel framework that combines class mean clustering and a group-level feature distance loss to optimize both intra-group compactness and inter-group separability. Our framework utilizes Mahalanobis distance for robust OOD scoring and Kernel density estimation (KDE) for adaptive threshold selection, enabling precise boundary estimation under varying data distributions. Experimental results on real-world IoT datasets show that our framework outperforms baseline techniques, achieving at least a 10% improvement in AUROC and a 33% reduction in FPR95, demonstrating its scalability and effectiveness in complex, imbalanced IoT scenarios.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: IoT and Edge/Fog Computing · Smart Grid Security and Resilience · Network Security and Intrusion Detection
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
School of Cyberspace Security, Beijing University of Posts and Telecommunications, Beijing 100876, China
National Engineering Research Center of Disaster Backup and Recovery, Beijing University of Posts and Telecommunications, Beijing 100876, China
China Industrial Control Systems Cyber Emergency Response Team, Beijing 100040, China
Funding
the National Key Research and Development Program of China
References (31)
Show source-provided references
1. Ullah, I., and Mahmoud, Q.H. (May, January 15). Network traffic flow based machine learning technique for IoT device identification. Proceedings of the 2021 IEEE International Systems Conference (SysCon), Vancouver, BC, Canada.10.1109/SysCon48628.2021.9447099 ↗
2. Generalized out-of-distribution detection: A survey10.1007/s11263-024-02117-4 ↗
3. Yang, L., Guo, W., Hao, Q., Ciptadi, A., Ahmadzadeh, A., Xing, X., and Wang, G. (2021, January 11–13). {CADE}: Detecting and explaining concept drift samples for security applications. Proceedings of the 30th USENIX Security Symposium (USENIX Security 21), Virtual.
4. Liang, S., Li, Y., and Srikant, R. (2017). Enhancing the reliability of out-of-distribution image detection in neural networks. arXiv.
5. React: Out-of-distribution detection with rectified activations
6. Zhu, J., Li, H., Yao, J., Liu, T., Xu, J., and Han, B. (2023). Unleashing mask: Explore the intrinsic out-of-distribution detection capability. arXiv.
7. Wei, H., Xie, R., Cheng, H., Feng, L., An, B., and Li, Y. (2022, January 17–23). Mitigating neural network overconfidence with logit normalization. Proceedings of the International Conference on Machine Learning. PMLR, Baltimore, MD, USA.
8. Mobile edge computing: A survey on architecture and computation offloading10.1109/COMST.2017.2682318 ↗
9. A survey on mobile edge computing: The communication perspective10.1109/COMST.2017.2745201 ↗
10. Hendrycks, D., and Gimpel, K. (2016). A baseline for detecting misclassified and out-of-distribution examples in neural networks. arXiv.
11. Michelucci, U. (2022). An introduction to autoencoders. arXiv.10.1007/978-1-4842-8020-1_9 ↗
12. Energy-based out-of-distribution detection
13. A simple unified framework for detecting out-of-distribution samples and adversarial attacks
14. Huang, R., and Li, Y. (2021, January 20–25). Mos: Towards scaling out-of-distribution detection for large semantic space. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, Nashville, TN, USA.10.1109/CVPR46437.2021.00860 ↗
15. Hendrycks, D., Basart, S., Mazeika, M., Zou, A., Kwon, J., Mostajabi, M., Steinhardt, J., and Song, D. (2019). Scaling out-of-distribution detection for real-world settings. arXiv.
16. Comparing Threshold Selection Methods for Network Anomaly Detection10.1109/ACCESS.2024.3452168 ↗
17. A threshold selection method from gray-level histograms
18. Anomaly detection in catalog streams10.1109/TBDATA.2022.3161925 ↗
19. Hoang, D.H., and Nguyen, H.D. (2018, January 11–14). A PCA-based method for IoT network traffic anomaly detection. Proceedings of the 2018 20th International Conference on Advanced Communication Technology (ICACT), Chuncheon, Republic of Korea.10.23919/ICACT.2018.8323765 ↗
20. A survey of hierarchical clustering algorithms10.22436/jmcs.05.03.11 ↗
21. A comparative study of various clustering algorithms in data mining
22. Zaeemzadeh, A., Bisagno, N., Sambugaro, Z., Conci, N., Rahnavard, N., and Shah, M. (2021, January 20–25). Out-of-distribution detection using union of 1-dimensional subspaces. Proceedings of the IEEE/CVF conference on Computer Vision and Pattern Recognition, Nashville, TN, USA.10.1109/CVPR46437.2021.00933 ↗
23. Techapanurak, E., Suganuma, M., and Okatani, T. (December, January 30). Hyperparameter-free out-of-distribution detection using cosine similarity. Proceedings of the Asian Conference on Computer Vision, Kyoto, Japan.
24. Miettinen, M., Marchal, S., Hafeez, I., Asokan, N., Sadeghi, A.R., and Tarkoma, S. (2017, January 5–8). IoT sentinel: Automated device-type identification for security enforcement in IoT. Proceedings of the 2017 IEEE 37th International Conference on Distributed Computing Systems (ICDCS), Atlanta, GA, USA.10.1109/ICDCS.2017.283 ↗
25. Dadkhah, S., Mahdikhani, H., Danso, P.K., Zohourian, A., Truong, K.A., and Ghorbani, A.A. (2022, January 22–24). Towards the development of a realistic multidimensional IoT profiling dataset. Proceedings of the 2022 19th Annual International Conference on Privacy, Security & Trust (PST), Fredericton, NB, Canada.10.1109/PST55820.2022.9851966 ↗
26. Chen, J., Li, Y., Wu, X., Liang, Y., and Jha, S. (2021). Atom: Robustifying out-of-distribution detection using outlier mining. Proceedings of the Machine Learning and Knowledge Discovery in Databases. Research Track: European Conference, ECML PKDD 2021, Bilbao, Spain, 13–17 September 2021, Springer. Proceedings, Part III 21.10.1007/978-3-030-86523-8_26 ↗
27. Lee, K., Lee, H., Lee, K., and Shin, J. (2017). Training confidence-calibrated classifiers for detecting out-of-distribution samples. arXiv.
28. Zong, B., Song, Q., Min, M.R., Cheng, W., Lumezanu, C., Cho, D., and Chen, H. (May, January 30). Deep autoencoding gaussian mixture model for unsupervised anomaly detection. Proceedings of the International Conference on Learning Representations, Vancouver, BC, Canada.
29. Data, M.C., Komorowski, M., Marshall, D.C., Salciccioli, J.D., and Crutain, Y. (2016). Exploratory data analysis. Secondary Analysis of Electronic Health Records, Springer.10.1007/978-3-319-43742-2_15 ↗
30. Network anomaly detection methods in IoT environments via deep learning: A fair comparison of performance and robustness10.1016/j.cose.2023.103167 ↗
31. Wang, H., Li, Z., Feng, L., and Zhang, W. (2022, January 18–24). Vim: Out-of-distribution with virtual-logit matching. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, New Orleans, LA, USA.10.1109/CVPR52688.2022.00487 ↗