Research Article
Anomaly Detection and Attack Type Identification Based on IoT Traffic Characteristics
@INPROCEEDINGS{10.1007/978-3-032-33662-0_13, author={Ming Dai and Hongwei Xing and Jian Du and Jie Luo and Bingjie Wang and Linjia He and Yicong Li}, title={Anomaly Detection and Attack Type Identification Based on IoT Traffic Characteristics}, proceedings={Communications and Networking. 20th EAI International Conference, ChinaCom 2025, Xi’an, China, November 8--9, 2025, Proceedings}, proceedings_a={CHINACOM}, year={2026}, month={10}, keywords={Internet of Things Anomaly Detection Traffic Characteristics Machine Learning}, doi={10.1007/978-3-032-33662-0_13} }- Ming Dai
Hongwei Xing
Jian Du
Jie Luo
Bingjie Wang
Linjia He
Yicong Li
Year: 2026
Anomaly Detection and Attack Type Identification Based on IoT Traffic Characteristics
CHINACOM
Springer
DOI: 10.1007/978-3-032-33662-0_13
Abstract
With the rapid development of internet of things (IoT) technology, its applications in smart transportation and other scenarios are becoming increasingly widespread. Traditional anomaly detection algorithms have not deeply explored IoT traffic information and have certain limitations. Therefore, this paper proposes an anomaly detection and attack type identification algorithm based on traffic characteristics for IoT. The algorithm first analyzes traffic patterns on real IoT data and extracts key information for feature construction. In the anomaly detection phase, four features are constructed, utilizing the density-based spatial clustering of applications with noise (DBSCAN) clustering algorithm with Manhattan distance as a metric. Finally, in the attack type identification phase, multiple features are generated based on the key information, employing a joint algorithm of Principal Component Analysis and the C4.5 decision tree. Experimental results indicate that the features extracted from both phases have a certain degree of accuracy in the designed algorithm, providing practical technical support for anomaly detection and attack identification, and possessing theoretical significance and reference value.