对比两种无监督异常检测方法，发现隔离森林更适合资源受限的物联网设备。
Unsupervised Anomaly Detection for Smart IoT Devices: Performance and Resource Comparison
- 采用隔离森林和一类SVM在温控器数据集上进行无监督异常检测。
- 隔离森林准确率、召回率和F1分数均更高，且推理时间更短、内存占用更少。
- 适合部署在边缘计算设备上，尤其适用于高维、不平衡的物联网安全场景。
物联网在各领域的快速部署显著提升了运营效率，但也因暴露面扩大而加剧了网络安全风险。传统基于特征签名的异常检测系统难以应对新型和零日攻击，本文研究了两种无监督异常检测技术——隔离森林（Isolation Forest, IF）和一类支持向量机（One-Class SVM, OC-SVM），基于TON_IoT温控器数据集进行了全面评估。评估指标包括准确率、精确率、召回率和F1分数，以及推理时间、模型大小和峰值内存使用等资源消耗指标。实验结果表明，隔离森林在各项性能指标上均优于一类SVM，F1分数更高，且推理时间更短、内存占用更少。这表明隔离森林在高维、非平衡的物联网环境中具备更强鲁棒性，更适合在资源受限的物联网边缘设备上实时部署。
原文摘要 · Abstract (English)
The rapid expansion of Internet of Things (IoT) deployments across diverse sectors has significantly enhanced operational efficiency, yet concurrently elevated cybersecurity vulnerabilities due to increased exposure to cyber threats. Given the limitations of traditional signature-based Anomaly Detection Systems (ADS) in identifying emerging and zero-day threats, this study investigates the effectiveness of two unsupervised anomaly detection techniques, Isolation Forest (IF) and One-Class Support Vector Machine (OC-SVM), using the TON_IoT thermostat dataset. A comprehensive evaluation was performed based on standard metrics (accuracy, precision, recall, and F1-score) alongside critical resource utilization metrics such as inference time, model size, and peak RAM usage. Experimental results revealed that IF consistently outperformed OC-SVM, achieving higher detection accuracy, superior precision, and recall, along with a significantly better F1-score. Furthermore, Isolation Forest demonstrated a markedly superior computational footprint, making it more suitable for deployment on resource-constrained IoT edge devices. These findings underscore Isolation Forest's robustness in high-dimensional and imbalanced IoT environments and highlight its practical viability for real-time anomaly detection.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。