Auto-EAD: An Automated Ensemble Anomaly Detection Framework for the CEN-IoT

The Internet of Things (IoT) based on consumer electronic networks (CEN-IoT) is confronting diverse, stealthy, and large-scale network attacks. The targets of attackers are no longer limited to individual devices or data, but also extend to multiple domains, including device hijacking, data exfiltration, and service disruption. Anomaly detection based on machine learning, as an effective defensive measure, is gradually being applied to IoT systems to enhance cybersecurity. Although anomaly detection algorithms based on artificial intelligence/machine learning are widely employed in constructing cybersecurity mechanisms, such technologies not only require substantial support from human experts but also suffer from model drift, posing considerable challenges to the development of autonomous cybersecurity measures. This paper proposes an Automated Ensemble Anomaly Detection Framework (Auto-EAD) for the automatic identification of abnormal behaviors in dynamic consumer electronics network environments. The proposed model consists of automated data preprocessing, automated feature engineering, automated base model learning with hyperparameter optimization, automated model selection, and automated model integration modules. Specifically, the primary automated data preprocessing techniques employed include automatic data transformation, inverse transformation, feature standardization, and data balancing. The Covariance Matrix Adaptation Evolution Strategy (CMA-ES) is utilized for hyperparameter optimization (HPO) of tree-based machine learning (ML) models, while a novel stair ensemble method is proposed for automated model ensemble.This model was developed to minimize human intervention and achieve full-lifecycle automation of anomaly detection. The Auto-EAD framework was evaluated on three public datasets (SWaT, WADI, and IoT Network Intrusion Dataset), with results showing superior performance of the proposed model compared to state-of-the-art methods, and thereby highlighting its effectiveness in handling and detecting abnormal behaviors in dynamically complex network environments. The present paper offers a novel approach to the construction of cybersecurity ecosystems with autonomous decision-making and response capabilities.