# Detecting Unknown Attacks in IoT Environments: An Open Set Classifier for Enhanced Network Intrusion Detection

arXiv: https://arxiv.org/abs/2309.07461 · HTML: https://mlsanity.com/paper/2309.07461/

## Key facts

- Cited by 2 papers in the map (data through 14 Oct 2026).
- Builds on 9 of its 25 references that are in the map.
- First posted on arXiv 14 Sep 2023.

## Builds on (most cited first, 9 of 9)

- [Open-Set Recognition: a Good Closed-Set Classifier is All You Need?](https://mlsanity.com/paper/2110.06207/) (2021)
- [Deep Semi-Supervised Anomaly Detection](https://mlsanity.com/paper/1906.02694/) (2019)
- [ECOD: Unsupervised Outlier Detection Using Empirical Cumulative Distribution Functions](https://mlsanity.com/paper/2201.00382/) (2022)
- [COPOD: Copula-Based Outlier Detection](https://mlsanity.com/paper/2009.09463/) (2020)
- [Deep Weakly-supervised Anomaly Detection](https://mlsanity.com/paper/1910.13601/) (2019)
- [Open Set Intrusion Recognition for Fine-Grained Attack Categorization](https://mlsanity.com/paper/1703.02244/) (2017)
- [Cybersecurity Anomaly Detection in Adversarial Environments](https://mlsanity.com/paper/2105.06742/) (2021)
- [Novelty Detection in Network Traffic: Using Survival Analysis for Feature Identification](https://mlsanity.com/paper/2301.06229/) (2023)
- [Stacked Generalizations in Imbalanced Fraud Data Sets using Resampling Methods](https://mlsanity.com/paper/2004.01764/) (2020)

## Built on by (most cited first, 2 of 2)

- [Towards Novel Malicious Packet Recognition: A Few-Shot Learning Approach](https://mlsanity.com/paper/2409.11254/) (2024)
- [ByteStack-ID: Integrated Stacked Model Leveraging Payload Byte Frequency for Grayscale Image-based Network Intrusion Detection](https://mlsanity.com/paper/2310.09298/) (2023)

## Abstract (arXiv)

The widespread integration of Internet of Things (IoT) devices across all facets of life has ushered in an era of interconnectedness, creating new avenues for cybersecurity challenges and underscoring the need for robust intrusion detection systems. However, traditional security systems are designed with a closed-world perspective and often face challenges in dealing with the ever-evolving threat landscape, where new and unfamiliar attacks are constantly emerging. In this paper, we introduce a framework aimed at mitigating the open set recognition (OSR) problem in the realm of Network Intrusion Detection Systems (NIDS) tailored for IoT environments. Our framework capitalizes on image-based representations of packet-level data, extracting spatial and temporal patterns from network traffic. Additionally, we integrate stacking and sub-clustering techniques, enabling the identification of unknown attacks by effectively modeling the complex and diverse nature of benign behavior. The empirical results prominently underscore the framework's efficacy, boasting an impressive 88% detection rate for previously unseen attacks when compared against existing approaches and recent advancements. Future work will perform extensive experimentation across various openness levels and attack scenarios, further strengthening the adaptability and performance of our proposed solution in safeguarding IoT environments.