Unsupervised Real-Time Flow Data Drift Detection Based on Model Logits for Internet of Things Network Traffic Classification

In recent years, numerous Internet of Things (IoT) traffic classification techniques based on deep learning have been proposed, demonstrating impressive classification performance. With ubiquitous access to massive heterogeneous IoT endpoints, networks exhibit high levels of dynamism, heterogeneity, and complexity, leading to potential data distribution drift (DDD), which will significantly degrade the performance of IoT network traffic classification. Although numerous scholars have explored various drift detection methods, most studies require real-time stream data labeling. Meanwhile, some unsupervised methods incur high resource consumption and latency when applied to network traffic. To address this issue, we propose an unsupervised real-time drift detection method based on Model Logits (ML-UDD). Based on the Logit scores from the deep learning model’s traffic classification/inference process, the model’s Maximum Logit Score (MLS) will be calculated as the key metric for detection DDD. This method does not need to rely on the data labels, thus it can explore in an unsupervised manner, which is superior to many other supervised methods in terms of expert experience and labor. Furthermore, an adaptive weighted CUSUM-type rapid detection approach is proposed to detect the DDD based on a sliding time window during the traffic flow proceeding. In addition, this method can further locate the ’Drift Flow’ where DDD happened, namely Flow Drift Location. This offers a real-time and efficient method to monitor and identify DDD with minimal resource consumption. The experiments have been conducted on two public and private network traffic datasets. The comparative experiments with other SOTA DDD detection methods have demonstrated that the proposed ML-UDD method can surpass these methods in terms of different performance metrics.