Traffic Classification of IoT Devices by Utilizing Spike Neural Network Learning Approach

In the last decade a new technology called an Internet of Things (IoTs) has become a favorable infrastructure to answer to the on-request needs of the users. An IoT creates a network of billions smart devices (such as cameras, smartphones, printers, TVs, …, etc.) that interconnect with each other and exchanged data without human intervention (Machine to Machine) M2M [1]. This can lead to a massive amount of exchanged data, that cause a traffic congestion causes a significant network performance bottleneck in diverse layers of an end point to end point (P2P) communication route, involving of the resource needs for handling IoT data at the border or cloud. Also, it causes delay in case of dangerous emergency scenarios [2, 3]. To solve this problem, many researchers [4-7] presents the Internet Traffic Control (ITC) framework to handle the network performance degradation. The ITC framework classifies network either on the type of application or the type of IoT devices. However, ITC is classified into four approaches: port-based technique, payload-based technique, statistical based technique, trace based (Machine Learning ML) technique. In the port number method, the network traffic is classified based on the port information (such as data segment, transmission unit) to allocated the traffic. The main advantage port approach is that traffic classification process fast and low cost in contrast to other techniques. The disadvantage, its limitation for applications which can run in whatever port number [8].

While, the payload approach based on the isolation of the traffic IP in the application layer, in order to characterize Point to Point (P2P) application traffic. In this technique, payload information (such as number of sessions, the arrival time of the packet, …, etc.) is used to check the packet payload and match it with saves signature in the database. So, when it matches the traffic is classified. The main disadvantage of this technique, it consumes more memory and need more calculation process besides it ignores the encrypted traffic [9]. To overcome the problem of payload approach with encrypted traffic, the statistical based technique has been utilized to classify network traffic based on the statistical features [10] (i.e., characteristics) of the traffic such as traffic influx, packet volume, optimal time and interval of the packet. The gauges of features can characterize different applications among each other as applications with unique type. The main problem of the statistical approach, that it required high resource usage (memory and data processing time). In contrast, ML based approach utilizes features to classify network traffic. The main idea is about using ML (supervised, unsupervised) algorithms to trace the features (such as packet length, source port number, destination port number, inter-arrival time, Media Access Control (MAC) address, …, etc.) from large network data influx and afterwards utilize these features to characteristic and predict the network traffic and IoT devices characteristics [11]. This technique gives high accuracy of traffic characteristics in comparison with port and payload approaches. In contrast, the main deficiency of ML based approach is the high calculation cost due to not consider the fine precision of trace traffic features [12].

However, the increase of applications and devices in the Internet of Things (IoT) often makes us rethink their access capabilities, and the end-to-end network performance is also the focus of attention. So, machine learning method has been widely used to solve the above problems, but machine learning method does not take the flow classification of the IoT into account. So how to use neural network method to investigate stream classification in IoT devices is an urgent problem to be solved and considered. Therefore, contributions of this paper are as follows: (1) A new model based on Spike Neural Network (SNN) is proposed, which uses neural network SNN learning method to classify the traffic of IoT devices according to the peak value called IoT-TCSNN model; (2) The traffic can be classified by using packet capacity characteristics and packet capture time information. At the same time, the rank correlation coefficient (Spearman) of SNN can be used as the classifier of crop networking device traffic to extract the best feature group from the global feature group. The IoT-TCSNN applied-on dataset “IoT Traffic Traces” that's available on repository of University of New Souths Wales so as to train IoT-TCSNN model [13]. The proposed model is divided into four phases: Data preprocessing, the feature selection based on two statistical approaches: Correlation coefficient and Spearman rank correlation, classifier of IoT traffic devices by utilizing SNN learning approach, and evaluation of IoT-TCSNN model via using four metrics (accuracy, precision, recall and F1_score). The rest of this paper is organized as follow: section 2, explores the related works that utilize ML to classify IoT devices traffic, section 3 describes the IoT-TCSNN, section 4 presents the implements and results discussion. Finally, section 5 includes study’s conclusion.

Table 1. A summary comparison of existing approaches

Study	Year	ML based technique	Summary
[14]	2022	DNN learning approach with cross entropy approach	-Extract features from the traffic feature influx. -Cross-entropy approach is utilized as classifier of the internet traffic by obtaining maximum entropy classifier value for the traffic
[15]	2021	Auto-encoder neural network (ANL) with “gradient boosting decision tree” GBDT algorithm	-ANL to select features based on the characteristics of communication behavior among network nodes. -The GBDT algorithm is used to train unusual traffic disclosure model to enhance the detection of lopsided botnet data
[16]	2022	multi class neural network	- Features selected based on “Deep Packet Inspection” DPI approach and used them as input to TCN to classify malicious traffic from normal traffic
[17]	2021	(adaboost and Xgboost) and DNNs	-Segregation the heavy IoT traffic into four classes: frequent traffic, incident-based traffic, inquiry based on traffic and malignant traffic.
[18]	2022	Hierarchical DNN (HDNNs)	-Extract feature set (such as source port number, source MAC address, total forward packet, …etc.) from IoT traffic flow so as to classify IoT devices from non IoT devices
[19]	2022	Supervised ML algorithm	- Designation IoT devices from non IoT devices from network traffic in smart home based on an application type utilized seven supervised ML algorithms
[20]	2021	ML algorithm	- Identify IoT device classes according to on traffic flux characteristics
[21]	2022	DL algorithm	-Extracted feature by using a correlation coefficient approach and obtained it as input to the DL algorithm to category the devices to four classes.
[22]	2021	Five ML methods and ACF and ANOVA	- ACF and ANOVA to select a feature and 1D CNN, MLP and Long LSTM and LR algorithm to identify local ideal value time window for the predicate on odd IoT traffic device
[23]	2021	Cross Entropy (CE)	-Selecting optimal features group from public features group to minimize the misclassification of IoT device traffic within a specific limit.
[24]	2022	SNN	-Traffic is classified based on the information on packet volume features and packet capture time.
Propose study		SNN	- SNN is used as classifier for IoT device traffic based on a rank correlation coefficient (Spearman) method to extract the optimal feature group from global feature group.

1.png

Figure 1. Linear relationship between IoT traffic features

2.png

Figure 2. IoT-TCSNN model

Table 2. Description of dataset

3.2 Feature extraction

In this phase, a Pearson correlation coefficient (PCC) [25] approach is used to measure the linear relationship between the features set (f₁, f₂, …, f₁₁). The PCC measures the intensity of difference values between the two features (variables) based on association among them. The coefficient is computed by using Eq. (1). Where, a and b two features, a' represent the mean of a, b' represent the mean of b, a_i and bi are variations of a and b values. To increase feature extraction accuracy a Spearman correlation coefficient (SCC) [26] approach is utilized to compute the range (increase or decrease) of feature in association with other feature (in between two ordinary variables (features) (i.e., considering the rank of the feature), the rank of SCC is calculated by using Eq. (2). Where, R represents the SCC rank value, $d_i^2$ variation among two ranks (R_f1-R_f2) of each observation and n is the number of arranged paired. The CC value is ranged between -1 (strong negative correlation) and 1 (strong positive correlation). To visualized the linear relationship between the features set (f₁, f₂, …, f₁₁) the heatmap utilized, see Figure 1.

$\frac{\sum\left(a_i-a^{\prime}\right)\left(b_i-b^{\prime}\right)}{\left.\sqrt{\sum\left(a_i\right.}-a\right)^2 \sum\left(b_i-b\right)^2}$     (1)

$R=1-\frac{6 \sum d_i^2}{n(n-1)}$     (2)

The heatmap visualization graph shows strong positive correlation among the WS (f₈) with IP_SRC (f₃), WS with MAC_DST (f₁₀), WS (f₈) with IP_SRC (f₃). Also, strong positive correlation between MAC_DST (f₁₀) and TTL(f₁₁), MAC_DST (f₁₀) and IP_SRC (f₃), Port_SRC (f₆) with protocol (f₅), packet length (f₂) with PIT (f₁) and Port_DST (f₇) with PIT (f₁). Besides, strong negative correlation among MAC_SRC (f₉) with MAC_DST (f₁₀), MAC_SRC (f₉) with Port_SRC (f₆), Protocol (f₅) with packet length (f₂), MAC_DST(f₁₀) with IP_DST (f₄), protocol (f₅) with PIT (f₁). In our case, the elected features are the independent variables and IoT devices calssifies (e.g., cam, hub, etc.) are the dependent variables. So, to estimate the probability p for a combination of selected features (independent variables) is performed by using the logit function Eq. (3) [21]. Where, ln is the natural logorithm, p logarithm of selected features that enables to predict regression coefficients (i.e., first temporary persecution).

$\operatorname{Logit}(p)=\ln \frac{p}{1-p}$    (3)

3.3 Classifier

In this phase an SNN is utilized as classier for the input features set from phase 3 to give a prediction set of classes (C₁, C₂, C₃, …, C_n). Where, each C represents a IoT Device. The SNN consists of a number of biological “synaptic” neurons. Each neuron is able to receive an input signal and produces an output signal, regardless of the actions for the rest of the other neurons (i.e., neurons have an interior dynamic that causes biological “synaptic” neurons modify through time). So, when, the time exceeds the neuron rest to emptying and minimizing its membrane possibility. Subsequently, divides input spike must not reason a synaptic neuron to spike or fire [27, 28]. The neuron interconnects with each other via synaptic side with the weights. So, according to the synaptic weight modification, the learning process is performed v by using either supervised or an unsupervised approach [29]. However, the most public model that used to train SNN is “Synaptic Time Dependent Plasticity” STDP unsupervised method [30-32]. The STDP is used beside restrained fit spiking threshold to learn a representation for an input spike model that suitable for classification. The spikes are encoded via transforming the input signal into a series of spikes called “spiketrains” in a process called “encoding”. The encoded process in STDP is trained via using “Leaky integrate neurons Fire” (LIF) [33, 34]. The temporal coding (rank code order (ROC)) method is used in this step. Where, in the temporal coding method, accurate timing of spikes and among action potentials isused to encode information. This involves the order that a group of nodes produces specific spikes. In the ROC is a method that established according to the firing order of a group of nodes in relation to the universal reference (i.e., considering the accuracy timing of the spikes). So, the ROC algorithm is applied on the output layer to get the output value, the order is calculated by utilizing Eq. (4), where ne is the elected output node, nj is the input node, the mod is the modulation factor that gives value in the range (0,1) and order(ne) is nj s’ spiking order value, that established as results of the V encoding. To illustrate, let V=0.5, W_0, ne=0.5 and order n₀ =4. Thus, predicted value (PV) 0.52=0.25 and according to the PV the device type will be detected where the PV is in the range (0,1). Also, when all PV values are less than 0.5 the output node will not detect any type of devices. Otherwise, the highest PV will be selected to identify the device type [34].

$P V=\sum_{j=0}^{\text {Winow time size-1 }} W n j$, ne mod $\operatorname{order}($ ne $)$     (4)

$a_i(V)=\frac{1}{\sigma \sqrt{2 \pi}} \exp \left(\frac{(x-\mu)^2}{\sigma^2}\right)$     (5)

$\mu_i=V_{\min }+\left(V_{\max }-V_{\min }\right) \cdot \frac{i}{n-1}$ for $i=0$ to $n-1$     (6)

$T=\max \left(a_i(V)\right)$     (7）

$W_i=W_i-b\left(\frac{\partial E r r o r}{\partial W i}\right)$     (8)

In this study, the SNN is consisted of an input layer, one hidden layer and the output layer. To train the selected features value that obtained for the input layer a “Gaussian Receptive Fields” GRF algorithm, is utilized to encode information into firing times for the input layer by utilizing Eq. (5). Where, input value between (minimum data value (Vmin) and maximum data value Vmax) with σ is centered by utilizing Eq. (6). The spike timing is arranged between (0 to T), the T value is computed by using Eq. (7). The σ is allocated by the passing points of the V with corresponding Gaussian summits: the i-th input receives a spike at T-a_i(V). So, when a_i(V)>0.01 and no spikes, then the nearest value of v to the $\sigma$ will be taken, while the SNN modified synaptic weights in this study according to localized learning rules of STDP model. Also, the Backpropagation method is used in the hidden layer to update weight so as to alleviate error, see Eq. (8). Where, W_i, represents a new weight and (b) represent the learning rate (the minimum value) for the error function. The output layer gives the predicated classes (C₁, C₂, C₃, …, C_n), see Figure 2.

3.4 Evaluation model

To evaluate IoT-TCSNN model two ML approach are utilized: Support Vector Machine (SVM) and Deep learning Convolutional Neural Networks (CNN) in order to compare their performance with IoT-TCSNN model. The SVM is a supervised ML method, which make a binary classification from complicated nonlinear problem [35]. It needs data features (samples) to make a hyperplane, resolution surface and increasing the margin round it. Its subject training phase in which every data feature called as xi is allocated to the class called yi (predicted value). Thus, the training a group is labeled as (xi,yi), i=1,2,3,..., n where $\mathrm{x} \in \mathbb{R}^n$ and y {-1,1}. So, the outcome of SVM is a group of support vectors which make the ideal hyperplane and the W (weight) that responsible to each input data feature which utilized to predicate the y value. While, CNN is an unsupervised ML model that consisted of a convolution layer (CL), Rectified linear unit (ReLU), Pooling layer (PL) and fully connected layer (FCL). In CL a series of filters are applied on input feature data to generate various output vectors for each filter together with a one weight. In ReLU layer, a negative value is maintained so as only positive vale are forward to the PL. In the PL, a pooling form from nonlinear down-sampling. The main aim of the PL is to reduce the number of parameters that network require to learn [36]. However, the performance of the three models (IoT-TCSVM, IoT-TCSNN and IoT-TCDNN) by is evaluated by using metrics: accuracy, precision, recall and F1_score that described in the next section.

This study proposes a new model IoT-TCSNN for classifying IoT devices network traffic so as to optimize the network performance. The model classifies IoT devices traffic based on SNN and statistical characteristics of the devices’ features. The model consists of four levels: data preprocessing (cleaning data and converting string data to number), feature extraction according to the linear relationship among features by using PCC and SNN method, classier devices level (predicates IoT-device via utilizing SNN) and finally model has evaluated according to the performance evaluation metrics: accuracy, precision, recall and F1-score with two models: IoT-TCSVM and IoT-TCDNN. However, three scenarios have been implemented for the three models using python language. The evaluation results have been shown that IoT-TCSNN consumes less energy in comparison with IoT-TCSVM and IoT-TCDNN. Also, IoT-TCSNN model shows high accuracy in comparison with IoT-TCSVM model and less accuracy in comparison with IoT-TCDNN.