A new network forensic framework based on deep learning for Internet of Things networks: A particle deep framework

Nickolaos Koroniotis, Nour Moustafa, Elena Sitnikova

Research output: Contribution to journalArticlepeer-review

74 Citations (Scopus)


With the prevalence of Internet of Things (IoT) systems, inconspicuous everyday household devices are connected to the Internet, providing automation and real-time services to their users. In spite of their light-weight design and low power, their vulnerabilities often give rise to cyber risks that harm their operations over network systems. One of the key challenges of securing IoT networks is tracing sources of cyber-attack events, along with obfuscating and encrypting network traffic. This study proposes a new network forensics framework, called a Particle Deep Framework (PDF), which describes the digital investigation phases for identifying and tracing attack behaviors in IoT networks. The proposed framework includes three new functions: (1) extracting network data flows and verifying their integrity to deal with encrypted networks; (2) utilizing a Particle Swarm Optimization (PSO) algorithm to automatically adapt parameters of deep learning; and (3) developing a Deep Neural Network (DNN) based on the PSO algorithm to discover and trace abnormal events from IoT network of smart homes. The proposed PDF is evaluated using the Bot-IoT and UNSW_NB15 datasets and compared with various deep learning techniques. Experimental results reveal a high performance of the proposed framework for discovering and tracing cyber-attack events compared with the other techniques.

Original languageEnglish
Pages (from-to)91-106
Number of pages16
JournalFuture Generation Computer Systems
Publication statusPublished - Sept 2020
Externally publishedYes


  • Attack tracing
  • Deep learning
  • Network forensics
  • Particle swarm optimization
  • Threat detection


Dive into the research topics of 'A new network forensic framework based on deep learning for Internet of Things networks: A particle deep framework'. Together they form a unique fingerprint.

Cite this