Deep Clustering Based Latent Representation for IoT Malware Detection

The Internet of Things with a billion connected devices can generate a huge amount of data daily. This poses challenges to security tasks (i.e. identifying IoT malware). Our previous studies used analytic techniques to reduce the data size and extract valuable information. Currently, clustering is a key technique for many data-driven applications, and it has been widely studied with different distance functions and algorithms. One research direction is to use representation learning for clustering. This research proposes a combination of Deep Clustering AutoEncoder (DCAE) with anomaly detection algorithms for an end-to-end anomaly detection framework. The DCAE maps the data from the original space to a lower-dimensional latent space, where it iteratively minimizes the clustering loss. Then, the output of DCAE is fed to algorithms such as Isolation Forest (IF), K -nearest Neighbors (KNN), Local Outlier Factor (LOF), and One-class Support Vector Machine (OCSVM) for identifying anomalies. The proposed model is evaluated on nine recent devices in the N-BaIoT dataset and measure their performance. The experimental results show that the new latent representation improves the IoT outlier detection methods significantly. The model's time efficiency is also recorded to assess its suitability for practical applications. © 2023 IEEE.