MultiCIDS: Anomaly-based collective intrusion detection by deep learning on IoT/CPS multivariate time series

Intrusion detection plays a key role to support secure operations of critical assets and services based on the Internet of Things (IoT) and cyber–physical systems. Most papers on the topic tend to favor the use of point anomaly approaches to detect intrusions by means of machine and deep learning. However, addressing intrusions through point anomaly approaches causes a major under-utilization of the monitoring data available. Differently from existing work, this paper proposes MultiCIDS, a novel approach that handles monitoring data as multivariate time series – typically available in any IoT system – to detect collective intrusions. MultiCIDS capitalizes on a hybrid strategy, which pipelines a per-point scoring function implemented by a semi-supervised autoencoder and a sliding window algorithm. The evaluation is based on normal and intrusion time series pertaining to IoT devices, a cyber–physical system and a ubiquitous server. The benchmark datasets used in the experiment cover a wide spectrum of intrusions. The results indicate that MultiCIDS is competitive with other state-of-the-art deep learning techniques for handling sequential data. More importantly, MultiCIDS is characterized by negligible training–detection duration and achieves a major reduction of the false positives, which makes it suitable for real-life operations.