# Towards Deep-Learning-Driven Intrusion Detection for the Internet of Things
## 3 Intrusion-Detection Framework
### Components of Detection System
#### 3.2.2 Anomaly-Detection Phase  
In this phase, data packets are assembled and transformed before feeding into the machine-learning module. Instead of requiring a dedicated host or specialized hardware, this module performs highly optimized data collection and transformation thereby enabling IIDs to be implemented on resource-constrained networks. The components of this phase are described below.  
1. **Data Collection and Transformation (DCT):** DCT module is responsible for stripping the data packets, extracting the header tags as features, populating the cached database, and feeding these tuples into machine-learning-based anomaly-detection module. The features extracted in this work is listed in Table 1. Algorithm 1 details the process where each input network packet is sliced into distinct layers of the TCP/IP stack, and thereafter, respective header tags are extracted for each layer in string format. Each non-empty layer is then designated a label for future reference. Consequently, the extracted header tags are added to a list under the label of their respective layer, thereby removing any repetition of header tags. The data collection and transformation module also pipelines these lists back to the cache. ```
```
0:T - List of all header tags from all packets in network interface queue. functionPacketHandler(\(pkt\)) /\"_where pkt - captured network packet*/  Extract TagString /\"Get tagstring from the packet*/  Divide the TagString for each Layer for every Layer in Packetdo  Get LayerName ifLayer \(\
eq Empty\)then  Split the Tags endif for every Tagdo  Add the Tag to a list endfor  Assign the List to Layer endfunction
```  
**Algorithm 1** Extracting tags from the sniffed network packets.  
**Machine-learning-based anomaly-detection (MLAD):** This module is the principal machine-learning engine of the proposed IDS, responsible for classifying benign network traffic from malicious network traffic. It employs a perceptual learning model for performing anomaly detection. This module is activated when the IDS enters the _Anomaly-Detection_ phase, which consists of two phases, i.e., the training phase and the detection phase. The training phase is performed across long intervals of time, and performed off-line. The perceptual model is trained using supervised learning over the tuples of features generated during the data-preprocessing. Before feeding the tuple into the perceptual learning model, each tuple is manually augmented with a binary-classification label representing malicious or benign nature of network packet. The perceptual learning model uses information gain at each perceptual layer to filter out the preferred features, before feeding to the next perceptual layer. We discuss the MLAD module in detail in Section 4.  
**Trainer:** This module is invoked when MLAD is required to train for an unknown tuple and it requires human intervention.  
\begin{table}
\begin{tabular}{c c} \hline \hline \(transmission\)\(rate\) & \(reception\)\(rate\) \\ \hline \(transmission\)\(to\)\(reception\)\(ratio\) & \(activity\)\(duration\) \\ \hline \(transmission\)\(mode\) & \(source\)\(IP\) \\ \hline \(destination\)\(1P\) & \(datavalue\)\(information\) \\ \hline \hline \end{tabular}
\end{table}
Table 1: Extracted Feature Set.