Kernel-Based Outlier Detection For IoT Networks

Abstract

Due to the increasing number of Internet of Things (IoT) devices surfacing, the network security of IoT devices is becoming an increasingly complex problem. With a growth in the number of devices on the market, attacks aimed at and utilizing these devices are also rising commensurately. As a result, being able to secure IoT networks and devices by finding effective ways to monitor and protect them is necessary. This project provides a novel method from unsupervised machine learning literature to identify anomalies in IoT networks. Anomalies are expected to be harmful activity in networks and are most commonly attacks by a botnet, privacy leaks, or intrusions. In current literature, there exist a multitude of different methods aimed at accomplishing outlier detection to improve the security of IoT networks, each with different capabilities. In this thesis, Kernel K-means is proposed as a basis for a generalizable outlier detection method for network security applications. It is run on a sample of benign network data in order to capture regular activity. This is then compared to potentially anomalous data, containing a combination of attack data and normal data to be classified with respect to the benign clustering. Due to the limited assumptions necessary to use Kernel K-means and its ability to capture highly irregular geometry in models, it is well suited to this problem and this is demonstrated in both toy examples and real network data.