# A Novel Hybrid Unsupervised Learning Approach for Enhanced Cybersecurity in the IoT
### Expected Outcomes  
The proposed method initiates by employing dimensionality reduction through a basic autoencoder (bAE). This technique aims to extract encoded features from individual data categories, enhancing the efficiency of subsequent processing and analysis [9]. In its role as a stage 1 detector, the one-class support vector machine (OCSVM) utilizes the hyperparameter \(\
u\) to regulate the trade-off, acting as an upper limit on the proportion of anomalies included in model training from normal network traffic. The kernel function is designed to establish a hyperplane that effectively segregates data from the origin [10; 11]. Anomalies are identified when new samples deviate to the opposite side of the hyperplane, thereby yielding a negative value in the decision function for these outlier points [12]. The OCSVM accurately classifies normal traffic, supplying essential data for the dAE neural network, forming the foundation of a stage 2 detector for effective anomaly detection. The dAE captures essential features for model training from normal network traffic. By computing the disparity between input and output, a detection threshold is set, ensuring precise discrimination between normal and abnormal traffic [13]. After passing through the OCSVM and dAE, abnormal traffic undergoes processing with DBSCAN, which serves as a stage 3 detector, forming clusters based on feature density. DBSCAN's key parameters, such as epsilon (\(\epsilon\)) and MinPts, influence cluster shape and density, providing the ability to identify dense clusters, handle noise, adapt to various shapes, automatically determine cluster count, scale effectively, and reduce false negatives and false positives [14]. These accurately delineated clusters can help in mapping attack tactics for intrusion prevention. Using the MITRE ATT&CK framework [15], we establish the \"Cyber Threat Repository\" to catalog attacks, tactics, and mitigation strategies. Detected attacks trigger immediate responses based on priority levels. The proposed methodology focuses on employing OCSVM + dAE + DBSCAN for outlier detection. It entails analyzing the disparity between the input and output of the detection model and assessing density within the clustering model. Our novel approach involves reducing dimensions, training models, detecting anomalies, clustering them, and ultimately preventing any identified anomalies. During dimensionality reduction, the basic autoencoder (bAE) extracts features and captures normal traffic data without supervision, resulting in unique patterns within the latent space features. In one-class SVMs, the hyperparameter \"nu\" (v) governs the balance between capturing normal instances and minimizing margin violations or support vectors [10]. In anomaly detection, when test data are input, samples that fall on the wrong side of the hyperplane are identified as anomaly points. Anomalous points are determined by a decision function that yields a negative value [16]. The dAE neural network proceeds to reconstruct the input data via encoding-decoding, generating an average reconstruction error employed as the detection threshold [17]. The output of normal traffic from the OCSVM serves as input, and the mean squared error (MSE) is calculated to determine the reconstruction error. If this error surpasses the established threshold, the traffic is flagged as abnormal; otherwise, it is classified as normal [18]. Following this, abnormal traffic from both OCSVM and dAE is subjected to DBSCAN processing, which identifies clusters based on packet feature density. The critical parameters of DBSCAN, epsilon (\(\epsilon\)) and MinPts, affect both the shape and density of the clusters [14]. Upon detection of an attack by the intrusion detection module, the intrusion prevention module is triggered to mitigate the intrusion and take necessary actions. Integrated with the MITRE ATT&CK threat intelligence framework [19], the prevention module implements resolution based on priority if the attack is already in the cyber threat repository database.