# A Deep Learning Method for Lightweight and Cross-Device IoT Botnet Detection +
## 1 Introduction
More importantly, given the ever-growing number and the dynamicity and complexity of devices in an IoT network, IDS models should be scalable and maintainable: learning separate models per device clashes with the ever-increasing scale of current IoT networks. This study instantiates the cross-device method in the context of the detection of IoT botnets by **deep autoencoders (AE)**. The use of deep learning and autoencoders is motivated by several reasons. First, while understanding the \"power of depth\" in deep neural networks is an ongoing challenge in learning theory [4], deep networks perform better than traditional shallow neural networks in many practical applications (e.g., [5,6]). Furthermore, multiple AEs-- possibly complemented by sophisticated feature selection methods-- are often used in complex cascades/ensembles for IoT intrusion detection; as such, they are suitable to explore whether the complexity of related deep learning IDS proposals is actually justified. More importantly, AEs can be conveniently trained only by means of normal network traffic in order to learn a semi-supervised IDS model, i.e., one of the principles driving our proposal. The study is based on the widely used N-BaIoT dataset, which provides normal and attack traffic data collected with 9 IoT devices ranging from a thermostat to webcams and security cameras and arranged into _separate_ datasets--1 per device--in the form of records of 115 features. Our study is twofold. First, we conduct a fine-grain experiment aiming to pursue a \"conventional\" approach by training a distinct AE per IoT device, i.e., **separate autoencoding**. Second, we train a single AE with the normal traffic of all the IoT devices, i.e., **all-in-one autoencoding**, which provides a single cross-device IDS model for botnet detection. Both separate and all-in-one models are tested by means of the typical metrics of recall (R), precision (P), false positive rate (FPR) and F1 score computed through a test set of normal and attack traffic held-out from training. These metrics--extensively described in Section 5--provide insights into the effectiveness of the classification: values of R, P and F1 score close to one and FPR close to zero indicate that the IDS is effective. The results indicate that it is relatively easy to achieve impressive detection figures by separate training-testing an autoencoder on top of each individual device. In fact, a \"minimal\" AE with three hidden layers could be successfully applied--although after retraining from device to device--to seven out of nine devices with _no changes_ of the implementation; moreover, the same AE could be extended to all the devices by means of a minor addition of neurons. Overall, **separate autoencoding** achieves 0.9995-1.0 recall, 0.9997-0.9999 precision, 0.0002-0.0417 FPR and 0.9997-0.9999 F1 score, depending on the device. Although remarkable, the separate approach underlies the need for maintain ing one model per device, which poses major scalability and maintainability issues in large-scale IoT networks. As for the **all-in-one autoencoding**, we observe that an AE of 5 hidden layers is enough to obtain a single cross-device IDS model, which achieves within 0.9994-0.9997 recall, 0.9999-1.0 precision, 0.0-0.0071 FPR and 0.9996-0.9998 F1 score, depending on the device. The results indicate that it is possible to train a single model with normal traffic collected from different devices, which is strongly beneficial to the FPR. The cross-device learning method paves the way for more scalable intrusion detection solutions in the context of IoT. As for the Cloud-Edge-IoT paradigm, Edge nodes are suited to host our all-in-one IDS, which means IoT devices are not subjected to extra computational and energy burden. Moreover, the proposed approach does not interfere with IoT operations. As only passive tracing of network traffic--also known as _sniffing_--is required, the approach is inherently nonintrusive. In a previously paper [7], we documented a preliminary experimentation of the \"all-in-one\" notion.