Abnormal driving behavior is a leading cause of road accidents. Traditional detection methods, relying on classification or unsupervised learning, struggle with accuracy and generalization. Deep Reinforcement Learning (DRL) offers potential but faces challenges such as handling unlabeled and imbalanced data, designing effective reward functions, and ensuring efficient exploration. To address these, we propose an expert-guided DRL framework that integrates a CNN-BiLSTM-Self Attention (CBSA) model and an Isolation Forest (iForest) to guide Proximal Policy Optimization (PPO), enhancing detection accuracy and computational efficiency. Our framework consists of two stages. First, a deep learning model trained on labeled data provides expert guidance. Second, unlabeled data is processed through the pre-trained model and iForest, refining the DRL model via a sparse reward function to detect unknown anomalies while mitigating class imbalance and improving generalization. Experiments on an open-source dataset show our method out-performs baselines, achieving the highest recall (0.70) and Fl-score (0.63). Additionally, attention maps and anomaly heatmaps enhance interpretability, confirming its effectiveness for real-time abnormal driving behavior detection and improved driver safety.

The increasing frequency of cyber attacks targeting IoT highlights the crucial need for accurate and real-time intrusion detection methods. Deep learning, renowned for its remarkable pattern recognition and adaptive learning capabilities, emerges as a promising solution. The current deep learning-based intrusion detection methods face two main issues: dependence on cloud computing architecture, making it challenging to meet the real-time requirements of IoT, and a limited focus on the detection of unknown attacks. In this article, we build our deep learning-based intrusion detection models within fog computing architecture to meet the real-time needs of IoT. Initially, we collect traffic data and conduct feature selection in the fog layer. Subsequently, the Bi-LSTM models integrated with Multi-Head Self-Attention mechanism are trained using the feature-selected data in the cloud. To assess our models’ ability to detect unknown attacks, we utilize some known attacks data for model training, and then assess the models’ performance in detecting other attacks. Ultimately, we deploy the models within fog layer to detect intrusions. Our method is evaluated on the Bot-Iot dataset that contains massive IoT traffic. Experimental results reveal that our models exhibit an average accuracy of 99.85% and perform well in detecting unknown attacks.

Protocol reverse engineering (PRE) serves as an instrumental tool in various security research, such as protocol fuzzing and intrusion detection. Its primary objective lies in uncovering the format, semantics, and behavior of an unknown protocol without prior information. This paper presents DL-ProS2, a deep learning-based approach for binary protocol reversing, focusing on format segmentation and semantic inference from network traffic. Our approach is underpinned by highlighting the effectiveness of multi-scale features within the network traffic for identifying various types of fields and semantics. Based on this, DL-ProS2 employs a comprehensive end-to-end model that integrates U-Net, siamese network, and BiLSTM-CRF, which enables the effective analysis of unknown protocol traffic to extract the field boundaries and semantics. Meanwhile, to address the issue of limited data diversity and coverage, we implement an innovative knowledge-driven traffic simulation technique. This method harnesses the ChatGPT to extract protocol knowledge from publicly available protocol documents, such as RFCs, as the foundational rules for the simulation. Empirical results substantiate the efficacy of our approach, demonstrating precision rates exceeding 0.95 and recall rates surpassing 0.97 for partially unknown protocol format segmentation and semantic inference. It also retains effectiveness in the inference of completely unknown protocols, with average precision and recall rates of 0.69 and 0.62 for format segmentation, and 0.43 and 0.47 for semantic inference, respectively.