arXiv subjects

Son Pham Bao

Publications and source records attributed to Son Pham Bao.

3 recordsLinked to original sources

arXiv2026

Teacher-free Latent Self-distillation and Class-separable Representations for Lightweight IoT Attack Detection

Knowledge distillation (KD) has been widely used to improve lightweight AI models by transferring soft-label knowledge from a large teacher model to a student model. However, existing KD methods are primarily designed for the image domain rather than lightweight IoT devices, and they often struggle to maintain well-separated feature representations for different attack types, especially as the number of classes increases and attack behaviors become more diverse. This paper proposes a novel \textit{teacher-free latent self-distillation framework based on a Twin Autoencoder (TAE)}. Instead of relying on an external teacher, TAE self-learns intrinsic class-wise latent representations, which act as soft labels, similar to KD, but without requiring a teacher model. The decoder then projects the input back into soft labels, enforcing class separation in the decoder output. The resulting decoder representations are used for classification, improving the discrimination between benign and malicious traffic while maintaining a lightweight design suitable for IoT deployment. We theoretically derive conditions for perfect class separation and show that lower empirical risk yields better representations, identifying regimes where TAE achieves strictly lower empirical risk than models using fixed class centers. Extensive experiments on 13 cybersecurity datasets, covering IoT botnets, network intrusion detection, malware, cloud DDoS, and synthetic multi-class data, show that TAE achieves up to 96.1% average accuracy for IoT attack detection and 98.7% for cloud intrusion detection. With a compact model size (1 MB) and ultra-fast inference (0.26 μs per sample), TAE offers a practical and scalable solution for real-world cybersecurity and IoT systems.

cs.CR↗

arXiv2025

Multiple-Input Auto-Encoder Guided Feature Selection for IoT Intrusion Detection Systems

While intrusion detection systems (IDSs) benefit from the diversity and generalization of IoT data features, the data diversity (e.g., the heterogeneity and high dimensions of data) also makes it difficult to train effective machine learning models in IoT IDSs. This also leads to potentially redundant/noisy features that may decrease the accuracy of the detection engine in IDSs. This paper first introduces a novel neural network architecture called Multiple-Input Auto-Encoder (MIAE). MIAE consists of multiple sub-encoders that can process inputs from different sources with different characteristics. The MIAE model is trained in an unsupervised learning mode to transform the heterogeneous inputs into lower-dimensional representation, which helps classifiers distinguish between normal behaviour and different types of attacks. To distil and retain more relevant features but remove less important/redundant ones during the training process, we further design and embed a feature selection layer right after the representation layer of MIAE resulting in a new model called MIAEFS. This layer learns the importance of features in the representation vector, facilitating the selection of informative features from the representation vector. The results on three IDS datasets, i.e., NSLKDD, UNSW-NB15, and IDS2017, show the superior performance of MIAE and MIAEFS compared to other methods, e.g., conventional classifiers, dimensionality reduction models, unsupervised representation learning methods with different input dimensions, and unsupervised feature selection models. Moreover, MIAE and MIAEFS combined with the Random Forest (RF) classifier achieve accuracy of 96.5% in detecting sophisticated attacks, e.g., Slowloris. The average running time for detecting an attack sample using RF with the representation of MIAE and MIAEFS is approximate 1.7E-6 seconds, whilst the model size is lower than 1 MB.

cs.LG↗

arXiv2023

Constrained Twin Variational Auto-Encoder for Intrusion Detection in IoT Systems

Intrusion detection systems (IDSs) play a critical role in protecting billions of IoT devices from malicious attacks. However, the IDSs for IoT devices face inherent challenges of IoT systems, including the heterogeneity of IoT data/devices, the high dimensionality of training data, and the imbalanced data. Moreover, the deployment of IDSs on IoT systems is challenging, and sometimes impossible, due to the limited resources such as memory/storage and computing capability of typical IoT devices. To tackle these challenges, this article proposes a novel deep neural network/architecture called Constrained Twin Variational Auto-Encoder (CTVAE) that can feed classifiers of IDSs with more separable/distinguishable and lower-dimensional representation data. Additionally, in comparison to the state-of-the-art neural networks used in IDSs, CTVAE requires less memory/storage and computing power, hence making it more suitable for IoT IDS systems. Extensive experiments with the 11 most popular IoT botnet datasets show that CTVAE can boost around 1% in terms of accuracy and Fscore in detection attack compared to the state-of-the-art machine learning and representation learning methods, whilst the running time for attack detection is lower than 2E-6 seconds and the model size is lower than 1 MB. We also further investigate various characteristics of CTVAE in the latent space and in the reconstruction representation to demonstrate its efficacy compared with current well-known methods.

cs.LG↗