Due to the heterogeneity of Internet of Things (IoT) devices and the diversity of IoT communication protocols, it is challenging to model the communication behaviors of IoT devices to facilitate attack defense. Considering the complex correlation between the IoT device types and the patterns of their communication behaviors, one possible solution is to cluster IoT devices into different types based on the characteristics of their communication behaviors and deal with each type, respectively. However, IoT traffic includes a significant proportion of abnormal traffic, such as attack traffic sourcing from compromised devices, which cannot reflect the behavioral characteristics of the source device. In this article, we propose a Transformer-based IoT device-type identification method to address the above challenges. Specifically, our approach consists of three main components. First, we classify the traffic data from IoT devices into normal and abnormal types by a Transformer-based traffic diagnosis model. Next, another Transformer-based model is adopted on the normal traffic to identify the IoT device type. Finally, considering the immutability of IoT device types, a results-ensemble algorithm is designed to improve the accuracy of IoT device-type identification. Experimental results verify the effectiveness of our method, which brings a noticeable improvement in terms of both accuracy and macro$F1$-score compared to other methods. Moreover, by applying the results-ensemble algorithm in the test phase, we can achieve 100% accuracy under certain conditions.

Unsupervised domain adaptation (UDA) becomes more and more popular in tackling real-world problems without ground truths of the target domain. Though tedious annotation work is not required, UDA unavoidably faces two problems: 1) how to narrow the domain discrepancy to boost the transferring performance; 2) how to improve the pseudo annotation producing mechanism for self-supervised learning (SSL). In this paper, we focus on UDA for semantic segmentation tasks. Firstly, we introduce adversarial learning into style gap bridging mechanism to keep the style information from two domains in a similar space. Secondly, to keep the balance of pseudo labels on each category, we propose a category-adaptive threshold mechanism to choose category-wise pseudo labels for SSL. The experiments are conducted using GTA5 as the source domain, Cityscapes as the target domain. The results show that our model outperforms the state-of-the-arts with a noticeable gain on cross-domain adaptation tasks.

Due to the heterogeneity of Internet of Things (IoT) devices and the diversity of IoT communication protocols, it is challenging to defend against malicious traffic from IoT devices. In this paper, a novel malicious traffic detection method is proposed based on the deep learning method. Specifically, a Transformer-based encoder is designed to automatically select key features of IoT traffic for the detection task, which avoids the cumbersome feature screening process that has been widely used in traditional machine learning methods. To address the complexity of the feature space and improve the efficiency of model training, we exploit the correlation between the characteristics of malicious traffic and the device type of IoT bots to further improve the detection accuracy by introducing a device classification auxiliary loss in the training phase. Experimental results show that our method outperforms the state-of-the-art machine learning-based methods in terms of accuracy, precision, recall and f1-score on real IoT traffic traces. In addition, the benefit of device type information on detection efficiency is verified.

The link flooding attack (LFA) has emerged as a new category of distributed denial of service (DDoS) attacks in recent years. Along with the massive deployment of low-cost insecure Internet-of-Things (IoT) devices, the fast proliferation of IoT botnets dramatically increases the risk of LFAs. However, how to efficiently defend against LFAs in IoT still remains as an open problem. To overcome this challenge, we model the interaction between an LFA attacker and the network manager as a two-person Bayesian game in this article to precisely characterize the behaviors of both sides. Then, the rational behaviors of the attacker and the optimal strategies of the defender are unveiled by deriving the Bayesian Nash equilibrium (BNE). Inspired by the obtained BNEs, a cost-effective decision framework is proposed for the defender to make defense decisions. Furthermore, we numerically analyze the effect of all the related factors and present feasible suggestions to deter attack motivations fundamentally. Experimental results demonstrate that the proposed method not only consistently outperforms baseline methods in terms of the defender’s utilities under different attack intensities, but also is robust to the changes in important parameters, including the value of benign traffic and the latency of traffic scrubbing.

With the rapid development of 5G networks, a great amount of Internet of Things (IoT) devices are connected to the Internet. Most of these devices are cost limited and thus are easily compromised by attackers to launch distributed denial of service (DDoS) attacks. The traditional DDoS defense methods at server side can not adapt to this new challenge, thus access-side DDoS detection architecture is urgently needed. In this paper, we propose a deep learning (DL) based IoT device classification method to support fine-grained behavior modeling of malicious traffic and thus enable access-side DDoS detection. Different from traditional studies based on machine learning (ML) which need expertise feature engineering, we propose a time characteristics extraction method based on 1-D convolutional neural network to capture high level time series features automatically for better classification performance. To avoid the feature loss problem, we propose a feature enhancement method based on residual connection module. Experimental results verify the effectiveness of our method, which offers a meaningful gain in terms of both accuracy and macro F1 score over existing approaches.

Structural scene graph based image generation provides a new paradigm for image-oriented semantic communications, whose goal is the semantic level rather than pixel-level reconstruction. The challenges include capturing relationships between objects and producing a reasonable geometric layout for each object accordingly. However, category information alone is not instructive enough for the generation process at the receiver side. Moreover, it is worth effort to extract the spatial dependencies among different objects in an image, therefore determine the object layouts on the whole instead of in an independent manner. In this paper, a deformable geometry framework for scene graph based image generation is proposed, in order to reconstruct images with higher semantic fidelity and visual pleasure. In particular, we introduce shape and appearance information to guide the generation process, from the scope of statistic modeling. Furthermore, we apply a spatial warping network to conduct geometric deformations on the layouts of different objects. Qualitative and quantitative experiments illustrate the superiority of our model compared to the state-of-the-art Sg2im method.