This is one of the most commonly used datasets for the benchmarking of modern-day internet traffic. This dataset contains 42 features per record, of which 41 features are considered input features, and the last feature is the label to determine whether it is a normal or malicious value. Furthermore, it contains 4 different classes of cyberattacks including Probe, Remote to Local (R2L), Denial of Service (DoS), and User to Root (U2R) [13].

This is considered a new generation dataset and it was firstly published in 2015. This dataset has a total of 49 features and a variety of normal and malicious values with the class label of a total of 257,673 samples. It contains 164673 malicious and 93000 normal samples [14,15]. Features of this dataset are categorized into 6 groups which are named “basic”, “time”, “flow”, “content”, “additional generated”, and “labeled” features. Further, UNSW-NB15 has 9 different classes of modern attacks which include analysis, backdoor, Dos, exploits, fuzzers, generic, reconnaissance, shellcode, and Worms.

It is one of the most important stages of each ML/DL model. It transforms the data into the most compatible form for input of any neural network. In our study, four different datasets have been utilized, hence, different procedures have been adopted for the pre-processing of each dataset.

a) Pre-processing of NSL-KDD: In the NSL-KDD dataset, data contains some text values. Therefore, we need to transform the nominal features into numeric values. At this stage, categorical features are transformed into numerical features by using one-hot encoding. Since the dataset is very large and there is a large variation between values, data normalization is also required for better performance. We’ll use mean normalization here. It makes the values of each feature in the data have zero-mean and unit variance. We utilized “min-max scaling” for the normalization process. The detailed class distribution of the NSL-KDD dataset is presented in Table 1.

The proposed attack detection scheme contains three main stages including the feature extraction stage, feature selection stage, and classification stage. The first two stages perform the dimensionality reduction operation that increases the computational efficiency of the model to make it highly compatible with resource-constrained IoT devices. A DAE is used for the extraction of optimal features with mutual information (MI) and a support vector machine (SVM) is incorporated with a gradient descent (GD) algorithm to perform the detection process.

The basic design of the proposed DAE is shown in Fig. 2. The DAE is an unsupervised neural network that uses a backpropagation algorithm to learn from unlabeled information. The input and output values of DAE are the same that try to lean the hypothesis function.(1) hW, b(r)≈r 

The DAE contains an encoder and decoder. The main function of the encoder is to compress the incoming information in low-dimensional representation. On the other hand, the decoder performs the reconstruction of data from the low-dimensional representation. In the encoding process, the input vectors are transformed into an abstract vector and the input data space’s dimensionality is also reduced.

To accurately perform the encoding and decoding operations, multiple constraints are involved in the neural network. The selection of the hidden neurons less than the input features and some useful representation can be discovered during reconstruction operation. As a result, if there are any correlations among the features, the DAE will be able to discover them.

The constraint shown in Eq. (2) is applied to hidden neurons in the encoder that compresses the input data representation and performs feature extraction. Here δ^z in Eq. (3) represents the average activation and az(r) represent the activation of hidden neuron z. The neuron z is considered to be in an active or inactive state if the activation of a neuron is 1 and 0 respectively. The variable δ indicates the sparsity parameter and is usually set near zero to ensure the inactive state of neurons most of the time.(2) δ^z=δ (3) δ^z=1m ∑y=1m⁡[az(r)]

The mean squared error (MSE) shown in Eq. (4) specifies the cost function of DAE.(4) MSE=1m∑y=1m‖12hW,b(r(y))−s(y)‖2

L2 regulation shown in Eq. (5) is added to the cost function that prevents overfitting by decreasing the weights Wzy(l) among neuron y in layer l  and neuron z in layer l+1 :(5) ΩL2Reg=12∑l=1L−1⁡∑y=1n⁡∑z=1k⁡(Wyz(l))2

Here L represents the total layers in a neural network. The other parameters n and k indicate the number of neurons in layers l and l+1 respectively.

Additionally, a sparsity regularization is added to a cost function as shown in Eq. (6). It penalizes δ^j for deviating from δ using the Kullback-Leibler (KL) divergence [16]. KL is an indicator of the difference between two different distributions. This function will be zero if Eq. (2) is satisfied or can have a higher value if δ^j diverges from δ. The minimization of this term enables the δ^j to be close to δ. Here S2 represents the hidden neurons within the encoder. ΩSparsity=∑z=1s2⁡KL(δ |δ^j| (6) ΩSparsity=∑z=1s2⁡δ logδδ^z+(1−δ) log1−δ1−δ^z

The cost function consists of the sum of L2 regularization, MSE, and a sparsity regularization term. Here φ and ϑ regulate the strength of L2 regularization and sparsity respectively.(7) ξSparse (W, b)=MSE+φ∗ΩSL2Reg+ϑ∗ΩSparsity

The proposed attack detection scheme performs the feature selection operation through DAE. It facilitates obtaining the most optimal features and removing the irrelevant features to reduce the computational complexity and increase the attack detection performance. In the proposed scheme mutual information (MI) is incorporated with optimal feature selection.

MI is a measure of the mutual dependency among two random variables. It describes the level of information of one random variable about another. In other words, it denotes the reduction in uncertainty of one random variable as a result of information about another. As stated in Eq. (8), MI is related to the concept of entropy ψ , which is the anticipated information content of a random variable R:(8) ψ(R)=−∑i⁡μ(ry)logP(ry) 

Here, μ represents the probability of occurrence of an event with index y. The entropy of two random variables R and S with values ry and rz can be defined as shown in Eq. (9)(9) ψ(R | S)=−∑y, z⁡μ(ry,  sy)logμ(ry,  sy)μ(sy)

Here (ry,  sy) represents the joint probability distribution. Then, MI of two discrete variables R and S can be described as I(R; S)=ψ(R)−ψ(R|S) =ψ(R)−ψ(R)−ψ(R, S) (10) =∑y, z⁡μ(ry,  sz)logμ(ry,  sy)μ(ry)P(sy) 

Here, ψ(R, S) indicates the joint entropy. The bigger MI value reduces the uncertainty in a variable is lower value can increase uncertainty.

The proposed scheme classifies the data into two classes attack and normal using SVM. To perform this operation, a linear SVM with GD is used as the optimizer. Linear SVM is a supervised ML technique that is used to solve two-class binary classification problems. Several hyperplanes can split the classes, thus a technique for determining the optimal one is necessary. SVM seeks the best decision boundary by maximizing the margin between the boundary and the nearest data occurrences. Support vectors are the nearest data occurrences that establish the greatest margin.

Providing training data of n instances (r1,  s1), …, (rn,  sn) , where si is the real class of input data ry (y=1, …, n ) and either 1 or −1 , the decision boundary is defined as(11) f(ry)=WTry+b=0

Here, w and b represent the weight vector and bias respectively.

To prevent data instances from lying on the wrong side, the following constraints are enforced for each y :(12) if sy=1, wTry+b≥1 (13) if sy=−1, wTry+b≤−1

Eqs. (12) and (13) can be combined as(14) sy(wTry+b)≥1 for all 1≤y≤n

SVM may address non-linearly issues by employing the kernel technique, which translates the original information into higher dimensional space. One possible issue is that SVM may need a lengthy training period. Despite producing high-performance outcomes, SVM training periods are frequently excessively long in contrast to alternative classifiers. However, a linear variant of SVM was used in this work, which shortened training time while getting equivalent results.

SVM optimizes using hinge loss as its loss function. The hinge loss can be defined with an output sy=±1 as(15) max(0,  1− yf(ry)) (16) c(r,  s,  f(ry))=1−syf(ry) (17) c(r, s,  f(ry))={0, sy f(ry)≥11−syf(ry), otherwise

The objective function ϵ(w) presented in Eq. (18) is made up of two terms: the regularization term and the loss term. Due to the convexity of the hinge loss function, ML convex optimizers can be employed. The goal function should be minimized for optimization:(18) Minimize ϵ(w)=φ2‖w2‖+1n∑y=1n⁡max(0,  1−syf(ry)) 

GD uses repeated stages to update parameters in the gradient’s direction. GD requires derivatives concerning b and w. However, because the hinge loss is not differentiable, the following sub-gradient should be utilized for w and f(ry) :(19) ∂∂Wmax(0,  1−syf(ry))={0, sy f(ry)≥1−syf(ry)otherwise 

To analyze the proposed DAE, several performance assessment metrics are defined. All of these parameters are described in the following.

a) Accuracy: It is the most commonly used performance indicator that presents a ratio of accurately predicted observations to the total number of observations. Accuracy=Tpos+TnegTpos+Fpos+Fneg+Tneg

This parameter defines how much the model should change in response to the expected error when the model weights are updated. The selection of learning rate is tricky since a number that is too little may result in a protracted training process that becomes stuck, while a value that is too large may result in learning an inefficient set of weights too rapidly or in an unstable training process.

The parameter demonstrates how many samples must be processed before the internal model parameters are updated.

This parameter indicates how many times the learning algorithm will traverse the training dataset. Each epoch is an opportunity for each sample in the training dataset to change the internal model parameters.

Latent space is a compressed data format in which related data points are relatively close together. Latent space may be used to discover features of the data and to develop simpler representations of data for analysis.

The simulations for the NSL-KDD dataset have been conducted with a range of learning rates of 0.001, 0.01, and 0.10 on 32, 64, and 128 batch sizes. The latent space is fixed as 12 and all the simulations are executed for 100 epochs. The efficiency of the suggested DAE is evaluated for both binary class and multi-class scenarios using the NSL-KDD dataset.

a) Binary-class Performance Assessment: In the first batch of the experiments, the effectiveness of the suggested scheme was evaluated for the NSL-KDD dataset in a binary class scenario. Experiments were conducted by using three learning rates 0.001, 0.01, and 0.10 and batch sizes 32, 64, and 128. Performance scores of the proposed DAE for batch size 32 are presented in bar graphs in Fig. 3. The suggested scheme attained the highest accuracy of 98.86% at a learning rate of 0.001. In the second stage, all experiments were repeated for batch size 64 using the same learning rates. Performance scores of the proposed DAE for batch size 64 are presented in bar graphs in Fig. 4. The suggested DAE attained the highest accuracy of 98.68% at the learning rate of 0.002. In the third stage, all experiments were repeated for batch size 128 using the same learning rates. Performance scores of the proposed DAE for batch size 128 are presented in bar graphs in Fig. 5. The suggested scheme attained the highest accuracy of 98.51% at a learning rate of 0.001.

The simulations for the UNSW-NB15 dataset have been conducted with a range of learning rates of 0.005, 0.075, and 0.150 on 64, 128, and 256 batch sizes. The latent space is fixed as 14 and all the simulations are executed for 100 epochs. The effectiveness of the suggested scheme is analyzed in both binary class and multi-class scenarios using the UNSW-NB15 dataset.

To further investigate the efficiency and robustness of the proposed scheme, the performance is also compared to the related works. A brief performance comparison is presented in Table 4. This comparison is organized based on the utilized DL algorithm, datasets, hyperparameter selection, and attack detection accuracy. Most of the researchers utilized time-intensive deep learning algorithms which are not suitable for deployment in resource-constrained IoT networks. Second, only a few studies focused on the selection of suitable hyperparameters for the optimal training of their schemes. Third, most of the studies presented their evaluation for binary class scenarios and multiclass evaluation is missing. The performance of the proposed scheme is analyzed in both binary and multiclass scenarios and it attained higher attack detection accuracies as compared to the several state-of-the-art IDSs.