# Towards Deep-Learning-Driven Intrusion Detection for the Internet of Things
## 2 Related Work  
While the IoT has gained popularity, security, privacy and reliability challenges pose a significant barrier to widespread adoption and deployment of these devices [16; 17; 18; 19]. The security vulnerabilities introduced by heterogeneity and interconnectivity of IoT devices and applications makes them a prime target for cyber-criminals to exploit. The increasing number of attacks and information leaks from the IoT has resulted in a surge of research addressing security and privacy in this domain [5; 7; 20; 21]. Despite several preventive measures in place, IoT systems continue to be targeted by malicious actors. It has become more pertinent than ever to emphasize early detection of intrusions to minimize the negative impact on these systems. [PERSON] et al. proposed a signature-based IDS for 6 LoWPAN-based IoT networks [12]. The goal of this system was to detect DoS attacks with a lower false positives rate. This system was later extended to monitor larger networks [22]. [PERSON] et al. proposed a host-based IDS for IoT that also depends on rule-based detection [23]. Both solutions rely on signature and rule-based detection systems that are not capable of detecting new and unknown attacks in IoT. These solutions also face the challenge of frequently updating the signature database. [PERSON] et al. proposed a specification-based IDS, where a human expert manually defines the rules for each specification, to address RPL attacks such as rank-attack, local repair attack, and the resource-depletion attack [24]. [PERSON] et al. developed a specification IDS using behavioral rules to detect sinkhole attacks on 6 LoWPAN networks [25]. The specification-based systems discussed above are limited in that they are only as effective as the expertise level of the expert system. Incorrect specifications can result in false detections and might jeopardize the network security. Intrusion detection based on protocol model are developed to detect anomalies associated with specific IoT protocols [25; 26; 27; 28]. [PERSON] et al. proposed a hybrid signature and anomaly-based IDS, known as SVELTE, for IoT networks based on 6 LoWPAN protocol [28]. This system is however based on a centralized IDS and cannot monitor traffic between local nodes in the network and is specifically targeted only towards detecting routing protocol attacks in IoT. [PERSON] et al. proposed a hybrid specification IDS for detecting RPL-based protocol attacks [26]. The specification-based anomaly module was used to analyze the behavior of the host nodes while the anomaly-based agent employed the unsupervised optimum-path forest algorithm for projecting clustering models. While this method presented promising results, performance of the proposed framework can be improved by incorporating data mining techniques and machine-learning methods. Machine-learning techniques have been used to improve the effectiveness of intrusion detection in traditional networks. With the advent of smart attacks on IoT, along with their resource and computation constraints, it is necessary to explore the use of machine learning for securing IoT systems. [PERSON] et al. used machine learning and signature-based model to detect new attacks in IoT [29]. This approach uses artificial immune system for self-adaptation and self-learning to detect new attacks. Even with machine learning, this approach still suffers from the setbacks of a signature-based detection. [PERSON] et al. proposed machine learning for anomaly and signature-based intrusion detection for securing IoT networks using the Constrained Application Protocol (CoAP) [13] for transport applications. The authors demonstrated using their own evaluation framework that the attack detection techniques failed when used individually but presented improved performance when signature and anomaly-detection approaches were combined. [PERSON] et al. proposed a host-based IDS that uses machine learning for anomaly-based intrusion detection [30].