# Towards Deep-Learning-Driven Intrusion Detection for the Internet of Things
## 1 Introduction  
The Internet of Things (IoT) has emerged as the next big technological revolution in computing in recent years with the potential to transform every sphere of human life. With an expanding network of interconnected Internet-enabled devices, IoT devices are used in a range of applications from connected cars, smart homes, healthcare, smart retail, and supply-chain management [1, 2]. Juniper research predicts that nearly 38 billion devices will be connected to the Internet by the year 2020 [3]. The rise of this transformative technology is however deeply mired with security and privacy concerns [4, 5, 6, 7]. The massive influx of connected devices introduces new vulnerabilities and opens new avenues for security attacks. To make things worse, IoT devices are often manufactured with little regard for security and/or shipped without adequate security controls in place. Research shows that a large percentage of current IoT devices on the market have serious security flaws and vulnerabilities [8]. Simple IoT devices can be turned into attack vectors if not properly secured. Recent evidence of this was observed in October 2016 where hacked IoT devices (cameras and DVRs) targeted Dyn, the largest DNS provider, resulting in massive Internet outage, disrupting the availability of popular websites such as Twitter, Amazon, and Netflix [9]. More recently, researchers have been able to cause a car crash in the autopilot mode [10], demonstrating the vulnerabilities of connected vehicles. New trends in cyber-attacks (ransomware, malware) increasingly target connected medical IoT devices resulting in attacks on healthcare institutions, compromised electronic health record systems, or in the worst-case scenario, even loss of life [11]. Even with some security measures in place, IoT networks are still vulnerable to multiple attacks due to their large attack surface. It is hence essential to be able to design defense mechanisms capableof detecting attacks. Security defense measures such as intrusion-detection systems (IDS) are critical to vulnerable IoT environments. Due to intrinsic resource and computational constraints, traditional security methods cannot be directly applied to secure IoT systems. Existing research on intrusion detection for the IoT is largely focused on rule-based detection techniques [12; 13; 14]. For efficient detection of zero-day threats, anomaly-based detection techniques are essential especially in emerging IoT environments. Also, in an IoT ecosystem, where many devices are constantly generating tons of data, machine-learning algorithms can be useful to perform automated data analysis and provide meaningful interpretations and predictions about the system. Use of machine learning for IoT security is especially very promising to detect any outliers to normal activity in the system. To that end, we explore an anomaly-based IDS that leverages the use of machine-learning techniques, to detect any known or unknown attacks on IoT devices in real time. Our goal is to develop a secure, portable, and ready-to-deploy security system that provides a practical and effective solution for securing future large-scale IoT networks. In this article, we present an Integrated Intrusion-Detection (IID) system that works independent of IoT protocols and network structure, and requires no prior knowledge of security threats. We develop an artificially intelligent IDS to provide security as a service to IoT networks. We provide an overview of the initial design framework of the proposed system in our earlier research [15]. In this article, we significantly expand the framework to incorporate a deep-learning algorithm to adapt to the changing threat landscape and network topology for anomaly detection. Our approach requires no prior knowledge of captured network payload binaries, traffic signatures, or compromised node address. The proposed IDS categorizes the network traffic into sessions and investigates anomalous characteristics of network activity.