  Intrusion detection systems (IDSs) play a critical role in protecting
billions of IoT devices from malicious attacks. However, the IDSs for IoT
devices face inherent challenges of IoT systems, including the heterogeneity of
IoT data/devices, the high dimensionality of training data, and the imbalanced
data. Moreover, the deployment of IDSs on IoT systems is challenging, and
sometimes impossible, due to the limited resources such as memory/storage and
computing capability of typical IoT devices. To tackle these challenges, this
article proposes a novel deep neural network/architecture called Constrained
Twin Variational Auto-Encoder (CTVAE) that can feed classifiers of IDSs with
more separable/distinguishable and lower-dimensional representation data.
Additionally, in comparison to the state-of-the-art neural networks used in
IDSs, CTVAE requires less memory/storage and computing power, hence making it
more suitable for IoT IDS systems. Extensive experiments with the 11 most
popular IoT botnet datasets show that CTVAE can boost around 1% in terms of
accuracy and Fscore in detection attack compared to the state-of-the-art
machine learning and representation learning methods, whilst the running time
for attack detection is lower than 2E-6 seconds and the model size is lower
than 1 MB. We also further investigate various characteristics of CTVAE in the
latent space and in the reconstruction representation to demonstrate its
efficacy compared with current well-known methods.
