# Towards Deep-Learning-Driven Intrusion Detection for the Internet of Things
## 4 Detection Using Deep Learning
### Deep-Learning-Based Anomaly Detection
The DNN thus develops a binary classifier for anomaly detection. As shown in Algorithm 2, the objective function of the proposed DNN model, a _binary_crossentropy_ loss function, tries to minimize the total cost in the model (Equation (5)). We retrofit the DNN model for training, and testing the predictions. The proposed IDS is trained and tested against the _testing dataset_. However, if the predictions from testing do not match the results from the _testing dataset_, the system mixes the _training dataset_ with the _testing dataset_ and re-trains itself with cross-validation. ```
0: N - List of all header tags from all packets in network interface queue. functionPredict(Cache) /*where cachePipe - is the pipe established with cache*/ \(matrix\leftarrow\)Cache /*translate packets to matrices*/ Extract\(features\) from matrix  Define\(dataset_{train}\) & \(dataset_{test}\)  InitializeSequential deep-learning model ifinitializedthen  Compile\(binary\)-crossentropy classifier \(m\gets Sequential\) deep-learning model endif  Training: \(m\gets dataset_{train}\) ifTraining is completethen  Prediction: \(m\gets dataset_{test}\) ifPredictions are correctthen  Re-Train the model else  Invoke\(Mitigation\) Phase endif endif  Store: \(classificationStore\gets Predictions\) /*store the classifier model*/ endfunction
```  
**Algorithm 2** Intrusion-Detection using Deep-Learning model  
Training Deep Neural Network  
Figure 6 details the training mechanism used for the proposed DNN model. At the lowest level, when the feature vector \(f_{v}\) is input into the DNN, it passes through each layer of the DNN. Neural nodes in each DNN layer calculates an output using an activation function and generates a filtered result. In this work, we use a rectified linear unit (ReLU) activation function for developing this system. ReLU function is defined as:  
\[f(x)=\max(0,x), \tag{4}\]  
with the input x e.g., a matrix from a convolved image. Here, the negative values in the matrix x are set to zero while other values remain constant. Each hidden layer links to the next hidden layer by using linear-combinations of outputs and feeds the filtered output generated by the ReLU activation function to the next layer. To facilitate supervised learning, we fabricate the training set as a set of real-number, \(K\), defined as \(\{(f_{v}^{1},a^{1}),(f_{v}^{2},a^{2}),...,(f_{v}^{K},a^{K})\}\) samples where each tuple represents a feature vector, \(f_{v}^{i}\) and the corresponding binary classification, \(a^{i}\). Each feature vector \(f_{v}\) represents the probability in the Byte-representation of meta-features generated from a single data-packet, and \(a\) is the binary label information attached to each data-packet. In the training phase, the input feature \(f_{v}\) enters the DNN through the external nodes that are present at the bottom of the DNN. We initialize the weights attached with each neural node in the DNN using the DBN model. Consequently, these weight vectors are modified as more data passes through DNN layers with each cycle in supervised training. The machine-learning algorithm assigns a cost function, cumulative cost function, and an optimization function [32] to manipulate our detection model. We assign a cost function for each layer of the proposed DNN as formulated in Equation (5), defined as the mean square error function between the prediction value and the output, as,  
\[C(w,f_{v},a)=\
icefrac{{1}}{{2}}\parallel h_{w}(f_{v})-a\parallel ^{2}, \tag{5}\]  
where \(w\) is the set of weights designated for each connection between simultaneous layers in the proposed DNN, \(a\) is the binary label information, and \(h_{w}(f_{v})\) is the hypothesis function for every meta-feature vector.