Network Anomaly Detection for IoT Using Hyperdimensional Computing on NSL-KDD

TL;DR

The paper addresses the challenge of securing IoT networks from high-dimensional and evolving threats by employing Hyperdimensional Computing (HDC) to perform network anomaly detection on the NSL-KDD dataset. It introduces an encoding pipeline that maps features to $D=10{,}000$-dimensional binary hypervectors using base and level hypervectors, followed by a XOR-based mapping, aggregation, and binarization, and couples this with a one-class similarity detector trained on normal versus shuffled data. The approach demonstrates competitive performance, achieving a reported accuracy of 91.55% on KDDTrain+ and favorable test-set results against a range of traditional models, while emphasizing scalability and efficiency for IoT deployments. The work suggests that HDC can provide robust, real-time capable anomaly detection suitable for resource-constrained IoT environments and offers directions for real-world integration and hybrid modeling with other ML techniques.

Abstract

With the rapid growth of IoT devices, ensuring robust network security has become a critical challenge. Traditional intrusion detection systems (IDSs) often face limitations in detecting sophisticated attacks within high-dimensional and complex data environments. This paper presents a novel approach to network anomaly detection using hyperdimensional computing (HDC) techniques, specifically applied to the NSL-KDD dataset. The proposed method leverages the efficiency of HDC in processing large-scale data to identify both known and unknown attack patterns. The model achieved an accuracy of 91.55% on the KDDTrain+ subset, outperforming traditional approaches. These comparative evaluations underscore the model's superior performance, highlighting its potential in advancing anomaly detection for IoT networks and contributing to more secure and intelligent cybersecurity solutions.

Figures (3)

• Figure 1: Encoding Phase: dataset features are transformed into high-dimensional binary hypervectors for efficient anomaly detection. This process involves preserving feature identity, quantizing feature values using level hypervectors, and applying XOR operations to form a final representation that captures feature structure and relationships.
• Figure 2: Defining one-class hypervector: Using the hyperdimensional encoder from the previous stage, normal and shuffled datasets are encoded into hypervectors. A one-class similarity vector is iteratively updated using Euclidean similarity, classifying data points as normal or anomalous based on similarity thresholds.
• Figure 3: Performance comparison with other approaches on KDDTrain+