# A Deep Learning Method for Lightweight and Cross-Device IoT Botnet Detection +
## 1 Introduction  
The Internet of Things (IoT) is intertwined with many critical assets of our daily lives, and it plays an increasingly key role in cyber-physical systems (CPSs). In fact, CPSs are becoming more and more advanced--integrating industrial IoT, Edge and Cloud computing--although their protection mainly relies on physical protection and isolation, which makes security an open topic [1]. Assuring security of IoT devices in the face of threats and attacks is a primary concern. To this aim, intrusion detection systems (IDS) are a key component in IoT security as they support online detection and response to incidents. The body of scientific literature on IDS for IoT is huge and ever-increasing. IDS for IoT is often addressed through machine learning and (deep) neural networks, e.g., [2, 3]. This trend is pushed by: (i) the availability of commercial and open-source products to transform raw network packets into ready-to-use _records_ suited for machine learning, (ii) the large number of public IoT datasets, such as MedBIoT ([[https://cs.taltech.ee/research/data/medbiot/](https://cs.taltech.ee/research/data/medbiot/)]([https://cs.taltech.ee/research/data/medbiot/](https://cs.taltech.ee/research/data/medbiot/)), accessed on 3 January 2023), N-BaIoT ([[http://archive.ics.uci.edu/ml/datasets/detection_of_IoT_botnet_attacks_N_BaIoT](http://archive.ics.uci.edu/ml/datasets/detection_of_IoT_botnet_attacks_N_BaIoT)]([http://archive.ics.uci.edu/ml/datasets/detection_of_IoT_botnet_attacks_N_BaIoT](http://archive.ics.uci.edu/ml/datasets/detection_of_IoT_botnet_attacks_N_BaIoT)), accessed on 3 January 2023) and IoTID20 ([[https://sites.google.com/view/iot-network-intrusion-dataset/home](https://sites.google.com/view/iot-network-intrusion-dataset/home)]([https://sites.google.com/view/iot-network-intrusion-dataset/home](https://sites.google.com/view/iot-network-intrusion-dataset/home)), accessed on 3 January 2023)--just to mention a few--and (iii) specialized hardware and deep learning frameworks (e.g., Keras, TensorFlow and PyTorch). It is a fact that IoT network traffic--transformed into fixed-length records of features--can be successfullyleveraged to recognize potential attacks, which is the primary aim of an IDS. As a result, a wide community of academics and practitioners has the chance to conduct measurement studies at the intersection of machine learning and intrusion detection for IoT. In spite of the large availability of scientific proposals, there is a gap between \"lab-made\" machine learning and real-life operations. For example, highly complex deep networks proposed so far for intrusion detection, such as convolutional neural network (CNN), long short-term memory (LSTM) and cascades/ensembles of autoencoders (AE), might find no or limited adoption in production IoT environments. Another point is that recent contributions in the area use the training data to learn a separate IDS model per IoT device [2] or per attack [3]. Different from several related proposals, the aim of this work _is not_ the mere application of increasingly complex deep learning models for intrusion detection. Rather, the novelty of our proposal is the application of well-founded principles to a **cross-device method**,which allows us to learn a single IDS model--as opposed to many separate models--atop the traffic of different IoT devices. The method stems from the following principles. A \"usable\" IDS should opt for unsupervised and semi-supervised approaches over supervised ones. It is unlikely that attacks are known beforehand; as such, unsupervised and semi-supervised approaches are more widely applicable. As for **IoT-specific constraints**, intrusion detection should pursue simplicity over complexity (e.g., small-footprint neural networks) in order to assure low detection latency, portability and energy efficiency.