# Towards Deep-Learning-Driven Intrusion Detection for the Internet of Things
## 3 Intrusion-Detection Framework
### Components of Detection System
#### 3.2.1 Network Connection Phase  
During the Network Connection Phase, the proposed IDS attempts to determine and deploy appropriate network channel for facilitating translation of sniffed network traffic. The IDS works in transport layer and monitors traffic using two modules in this phase, namely the connection proper module and the virtual network client module.  
1. **Connection Prober:** The connection proper module is responsible for sending probe-signals and broadcast beacons to all the devices within the host IoT personal area network. The module is executed periodically and on-line, as the communication links are constructed dynamically within an IoT network. Connection Prober module maintains a list of all the active communications protocols that are being used in the network. It uses this list to maintain active network interfaces which can be used to intercept different wireless communication signals, transmitted in the surrounding environment. Consequently, it attempts to intercept broadcast beacons, handshake messages, or session requests to learn the communication protocols that are being used by IoT devices. On receiving a handshake or a session request, the connection proper module translates the data-packet into appropriate network packet format. Typically, the connection proper module is designed to use a secondary storage location as a default cache location that is simultaneously replicated in the physical memory using a _cache-handle_. After fetching the bit stream, it uses the known communication protocols to bisect the bit stream into different networks packets and then feeds these packets into cache and the data collection and transformation module (discussed in the next subsection). If the connection proper fails at intercepting the broadcast beacons, or handshake messages, it attempts to deduce the connection protocol by apprehending the data packets transmitted during regular data communication of surrounding IoT devices. This is made possible because CoAP communication cycle involves at least 4 successful messages and when connection proper fails to intercept a communication, it attempts to gather information from successive messages, resulting in CP's probability of success, \(P(S)=\frac{3}{4}\). The number of messages in an IoT communication cycle increases as bare IoT communication is loaded with payload. With increase in number of messages, probability of successful interception increases, resulting in \(P(S)>\frac{3}{4}\), approaching towards unity. In worst-case scenario, if CP misses the entire IoT communication cycle, the IDS uses pre-trained neural networks to estimate the network behavior in the current period. Subsequently, with further training the IDS can be trained to respond to a new protocol.
2. **Virtual Network Client (VNC):** The VNC module is a client-based network emulator responsible for establishing compatible network channels with various IoT devices after gathering information about their network protocols. VNC module transforms the packets from different network channels and switches the network protocol according to a specific IoT device.
3. **Controller:** The Controller module is responsible for controlling and interfacing the exchange of data packets or commands between the data collection & transformation module and the VNC module. All the modules other than connection proper and VNC module are autonomous and not governed by the Controller module.