CMTSNN: A Deep Learning Model for Multiclassification of Abnormal and Encrypted Traffic of Internet of Things

With the increasing types and number of Internet of Things (IoT) devices and malicious programs and the popularization of encryption technology in the communication process between the Internet and the IoT, a large amount of encrypted abnormal traffic among devices endangers IoT cybersecurity. How to identify abnormal encrypted traffic of the IoT has become the premise of cybersecurity. Presently, most of the detection methods for traffic in the IoT have problems, such as simple data set processing, imperfect feature extraction, data imbalance, and low multiclassification accuracy. In this article, we propose a multiclassification deep learning model named the cost matrix time–space neural network (CMTSNN) for abnormal and encrypted IoT traffic. The CMTSNN is divided into three parts. The first part is the preprocessing stage of the data set, which needs to retain the timing relation between two data packets in the stream and create a cost penalty matrix according to the sample distribution. Aimed at the robustness of feature extraction in network flow, the second part extracts time series features and then space features to ensure the robustness of feature extraction. The third part is aimed at the problem of data imbalance. The cost penalty matrix is applied to the cost penalty layer in the training process, and then the improved cross-entropy loss function is used to calculate the loss to improve the classification accuracy of minority categories and increase the overall multiclassification performance of the model. Experiments were carried out with the ToN-IoT, BoT-IoT, and ISCX VPN-NonVPN data sets. Compared with current methods, the proposed method shows better performances, including accuracy, precision, recall, F1 Score, and false alarm rate.