Internet of things security analytics and solutions with deep learning

A method of detecting anomalous network traffic implemented in a computer system comprising a processor, memory accessible by the processor and storing computer program instructions and data, and computer program instructions to perform:

• monitoring an operational IoT network to obtain network traffic data representing events occurring in the monitored operational IoT network;
• extracting data relating to a plurality of features of the events from the obtained network traffic data;
• training a machine learning model to classify the events using the extracted data relating to a plurality of features;
• monitoring additional operation of the operational IoT network to obtain additional network traffic data representing additional events occurring in the monitored operational IoT network and extracting additional data relating to a plurality of features of the additional events from the obtained network traffic data;
• classifying the additional events using the extracted additional data relating to a plurality of features;
• and
• detecting an anomalous event based on the classification of the additional events.

A system for detecting anomalous network traffic comprising a processor, memory accessible by the processor, and computer program instructions stored in the memory and executable by the processor to perform:

• monitoring an operational IoT network to obtain network traffic data representing events occurring in the monitored operational IoT network;
• extracting data relating to a plurality of features of the events from the obtained network traffic data;
• training a machine learning model to classify the events using the extracted data relating to a plurality of features;
• monitoring additional operation of the operational IoT network to obtain additional network traffic data representing additional events occurring in the monitored operational IoT network and extracting additional data relating to a plurality of features of the additional events from the obtained network traffic data;
• classifying the additional events using the extracted additional data relating to a plurality of features;
• and
• detecting an anomalous event based on the classification of the additional events.