# Towards Deep-Learning-Driven Intrusion Detection for the Internet of Things
## 4 Detection Using Deep Learning
### Deep-Learning-Based Anomaly Detection  
We use a Deep Belief Network (DBN) to fabricate the feed-forward Deep Neural Network (DNN) as the perceptual learning model. A DBN is a model of un-directed connections between different layers, where each layer comprises \(n\)-number of neural nodes, while a DNN is a type of feed-forward neural network with many layers. Although a DNN can be fabricated in different ways, an advantage of developing a DNN model from a DBN model is that the DBN layers can be initially trained using unsupervised learning algorithm. DNN can thus be created from a model pre-trained using unsupervised learning which is very fast in comparison to supervised learning. We use the pre-trained layers of DBN model to create a DNN model. (Figure 3). As shown in Figure 3, the weights for all the hidden layers of this DBN model, denoted by \(w_{i}\), are obtained by performing unsupervised training. However, the parameters generated from this unsupervised training are only used for assigning the initial set of weights. For each network transaction, a binary-classification layer and label information (\(a\)) is added at the top layer of the DBN model to successfully construct a DNN. Figure 4 shows that the DBN is augmented with binary-classification layer and label information to transform into a DNN. Now, this DNN model is trained with a bottom-up supervised learning approach using the label information \(a\). During the supervised learning process, each node in a DNN layer is assigned with a weight parameter which are manipulated by using the gradient descent methodology. The proposed deep-learning model uses supervised training and binary classification for identifying malicious activities. If the DNN detects an unknown anomaly or a zero-day attack, it stores the corresponding tuple of the filtered features to the 'Cache' as a feedback. This feedback mechanism is used during retraining of the DNN, which enriches the feature extraction and labeling functionality of the detection system. However, if the extracted features are not sufficient to classify the network traffic, feedback is sent to the data collection and transmission module for retraining. As shown in the Figure 5, we developed a 5-layer deep-learning model for this research, containing 1 input layer, 3 hidden perceptual layers, and 1 output layer which is a binary-classifier layer. The input layer comprises of 56 nodes which represents an exhaustive list of _maximum_ number of network features that can be fed into the DNN. As mentioned earlier, these input features are represented as a tuple, formed from a combination of both the primary and secondary features. During the supervised training process, each tuple and its label information \(a\) is fed to the DNN where it passes through the first hidden encode layer and gets filtered out as the \(x\) most significant features. The \(x\) features are then passed into the second encode hidden layer where they get filtered into \(y\) features and the second encode layer feeds them into the third encode hidden layer. The third hidden encode layer takes the \(y\) features as input from the previous layer and filters two outputs. It also acts as a soft-max layer that fine tunes the results to classify the attack into categories. The result is passed to the output layer representing the classification as malicious and benign traffic. Output layer does not perform  
Figure 5: Deep-Learning model for proposed IDS. Figure 3: Deep Belief Network Structure Figure 4: Deep Neural Network Structure  
any filtration but ingests the output from the third hidden layer and yields the classification result. Thus, the rest of the hidden layers i.e., the second and third encode layers also use the labeled traffic to train themselves in the same way as the first encode layer. Each layer of the DNN thus feeds onto this data, and maps it to a numerical value. The mapped values are normalized to 0 and 1, where benign network traffic is represented by the value 0 and malign network traffic is represented by the value 1.