{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,2,4]],"date-time":"2026-02-04T21:50:22Z","timestamp":1770241822449,"version":"3.49.0"},"reference-count":21,"publisher":"MDPI AG","issue":"2","license":[{"start":{"date-parts":[[2026,2,4]],"date-time":"2026-02-04T00:00:00Z","timestamp":1770163200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/summer-heart-0930.chufeiyun1688.workers.dev:443\/https\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Computers"],"abstract":"<jats:p>The rise of SIM cloning, identity spoofing, and covert manipulation in mobile and IoT networks has created an urgent need for continuous post-registration verification. This work introduces an unsupervised deep learning framework for detecting behavioral anomalies in SIM-tagged network flows by modeling the intrinsic structure of benign behavioral descriptors (TTL, timing drift, payload statistics). A Temporal Deep Autoencoder (TDAE) combining Conv1D layers and an LSTM encoder is trained exclusively on normal traffic and used to identify deviations through reconstruction error, enabling one-class (label-free) training. For deployment, alarms are set using an unsupervised quantile threshold \u03c4\u03b1 calibrated on benign traffic with a false-alarm budget; \u03c4* is reported only as a diagnostic reference for model comparison. To ensure realism, a large-scale corpus of 3.6 million SIM-tagged flows was constructed by enriching public IoT traffic with pseudo-operator identifiers (synthetic SIM tags derived from device identifiers) and controlled anomaly injections. Cross-domain experiment transfer under SIM-grouped protocol: Training on clean Cassavia-like traffic and testing on attack-rich Guarascio-like flows yields a PR-AUC of 0.93 for the proposed Conv-LSTM Temporal Deep Autoencoder, outperforming Dense Autoencoder, Isolation Forest, One-Class SVM, and LOF baselines. Conversely, the reverse direction collapses to PR-AUC \u22480.5, confirming the absence of data leakage and the validity of one-class behavioral learning. Sensitivity analysis shows that performance is stable around the unsupervised quantile operating point. Overall, the proposed framework provides a lightweight, interpretable, and data-efficient behavioral verification layer for detecting cloned or unauthorized SIM activity, complementing existing registration mechanisms in next-generation telecom and IoT ecosystems.<\/jats:p>","DOI":"10.3390\/computers15020107","type":"journal-article","created":{"date-parts":[[2026,2,4]],"date-time":"2026-02-04T09:02:01Z","timestamp":1770195721000},"page":"107","update-policy":"https:\/\/summer-heart-0930.chufeiyun1688.workers.dev:443\/https\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["Unsupervised TTL-Based Deep Learning for Anomaly Detection in SIM-Tagged Network Traffic"],"prefix":"10.3390","volume":"15","author":[{"ORCID":"https:\/\/summer-heart-0930.chufeiyun1688.workers.dev:443\/https\/orcid.org\/0009-0009-3593-1298","authenticated-orcid":false,"given":"Babe","family":"Haiba","sequence":"first","affiliation":[{"name":"Computer Science Research Laboratory (LaRI), Faculty of Sciences, Ibn Tofail University, Kenitra 14000, Morocco"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Najat","family":"Rafalia","sequence":"additional","affiliation":[{"name":"Computer Science Research Laboratory (LaRI), Faculty of Sciences, Ibn Tofail University, Kenitra 14000, Morocco"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"1968","published-online":{"date-parts":[[2026,2,4]]},"reference":[{"key":"ref_1","first-page":"209","article-title":"Ensembling Sparse Autoencoders for Network Covert Channel Detection in IoT Ecosystems","volume":"Volume 13515","author":"Cassavia","year":"2022","journal-title":"AIxIA 2022\u2014Advances in Artificial Intelligence"},{"key":"ref_2","unstructured":"Guarascio, M., Zuppelli, M., Cassavia, N., Manco, G., and Caviglione, L. (2022, January 15\u201317). Detection of Network Covert Channels in IoT Ecosystems Using Machine Learning. Proceedings of the ICDL 2022\u2014CEUR Workshop Proceedings, \u00d6rebro, Sweden. Available online: https:\/\/summer-heart-0930.chufeiyun1688.workers.dev:443\/https\/ceur-ws.org\/Vol-3260\/paper7.pdf."},{"key":"ref_3","unstructured":"Caviglione, L., Guarascio, M., Pisani, F.S., and Zuppelli, M. (2024, January 8\u201312). A Few to Unveil Them All: Leveraging Mixture of Experts on Minimal Data for Detecting Covert Channels in Containerized Cloud Infrastructures. Proceedings of the 2024 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW), Vienna, Austria. Available online: https:\/\/summer-heart-0930.chufeiyun1688.workers.dev:443\/https\/www.semanticscholar.org\/paper\/A-Few-to-Unveil-Them-All%3A-Leveraging-Mixture-of-on-Caviglione-Guarascio\/dea68588503b2b3762a7abf4262ddbd078f96b43."},{"key":"ref_4","doi-asserted-by":"crossref","first-page":"925","DOI":"10.1007\/s10844-023-00819-8","article-title":"Learning Autoencoder Ensembles for Detecting Malware Hidden Communications in IoT Ecosystems","volume":"62","author":"Cassavia","year":"2024","journal-title":"J. Intell. Inf. Syst."},{"key":"ref_5","doi-asserted-by":"crossref","unstructured":"Mirsky, Y., Doitshman, T., Elovici, Y., and Shabtai, A. (2018, January 18\u201321). Kitsune: An Ensemble of Autoencoders for Online Network Intrusion Detection. Proceedings of the Network and Distributed System Security Symposium (NDSS), San Diego, CA, USA.","DOI":"10.14722\/ndss.2018.23204"},{"key":"ref_6","doi-asserted-by":"crossref","first-page":"613","DOI":"10.1145\/362375.362389","article-title":"A Note on the Confinement Problem","volume":"16","author":"Lampson","year":"1973","journal-title":"Commun. ACM"},{"key":"ref_7","doi-asserted-by":"crossref","unstructured":"Rowland, C.H. (1997). Covert Channels in the TCP\/IP Protocol Suite. First Monday, 2.","DOI":"10.5210\/fm.v2i5.528"},{"key":"ref_8","doi-asserted-by":"crossref","first-page":"44","DOI":"10.1109\/COMST.2007.4317620","article-title":"A Survey of Covert Channels and Countermeasures in Computer Network Protocols","volume":"9","author":"Zander","year":"2007","journal-title":"IEEE Commun. Surv. Tutor."},{"key":"ref_9","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/2684195","article-title":"Pattern-Based Survey and Categorization of Network Covert Channel Techniques","volume":"47","author":"Wendzel","year":"2015","journal-title":"ACM Comput. Surv."},{"key":"ref_10","first-page":"1887","article-title":"Information Hiding in Network Protocols: Fundamentals, Mechanisms, Applications, and Countermeasures","volume":"18","author":"Mazurczyk","year":"2016","journal-title":"IEEE Commun. Surv. Tutor."},{"key":"ref_11","doi-asserted-by":"crossref","first-page":"5","DOI":"10.1145\/1198255.1198257","article-title":"Traffic Classification through Simple Statistical Fingerprinting","volume":"37","author":"Crotti","year":"2007","journal-title":"Acm Sigcomm Comput. Commun. Rev."},{"key":"ref_12","doi-asserted-by":"crossref","first-page":"249","DOI":"10.1109\/TDSC.2017.2656078","article-title":"Towards a Reliable Detection of Covert Timing Channels over Real-Time Network Traffic","volume":"14","author":"Rezaei","year":"2017","journal-title":"IEEE Trans. Dependable Secur. Comput."},{"key":"ref_13","unstructured":"Elsadig, M.A., and Gafar, A. (2022, April 02). Covert Channel Detection: Machine Learning Approaches. Preprint, 2022. Available online: https:\/\/summer-heart-0930.chufeiyun1688.workers.dev:443\/https\/www.researchgate.net\/publication\/359735672."},{"key":"ref_14","doi-asserted-by":"crossref","first-page":"5156","DOI":"10.1109\/TDSC.2023.3241451","article-title":"Weaknesses of Popular and Recent Covert Channel Detection Methods and a Remedy","volume":"20","author":"Zillien","year":"2023","journal-title":"IEEE Trans. Dependable Secur. Comput."},{"key":"ref_15","doi-asserted-by":"crossref","first-page":"102207","DOI":"10.1016\/j.cose.2021.102207","article-title":"Comprehensive Analysis of MQTT 5.0 Susceptibility to Network Covert Channels","volume":"104","author":"Mileva","year":"2021","journal-title":"Comput. Secur."},{"key":"ref_16","first-page":"2785","article-title":"Efficient distributed network covert channels for Internet of things environments","volume":"20","author":"Cabaj","year":"2020","journal-title":"IEEE Commun. Surv. Tutor."},{"key":"ref_17","doi-asserted-by":"crossref","unstructured":"Zuppelli, M., and Caviglione, L. (2021, January 17\u201320). pcapStego: A Tool for Generating Traffic Traces for Experimenting with Network Covert Channels. Proceedings of the 16th International Conference on Availability, Reliability and Security (ARES), Vienna, Austria.","DOI":"10.1145\/3465481.3470067"},{"key":"ref_18","unstructured":"Liguori, A., Mungari, S., Zuppelli, M., Comito, C., and Caviglione, L. (2023, January 29\u201330). Using AI to Face Covert Attacks in IoT and Softwarized Scenarios: Challenges and Opportunities. Proceedings of the Ital-IA Workshop, CEUR Workshop Proceedings, Pisa, Italy. Available online: https:\/\/summer-heart-0930.chufeiyun1688.workers.dev:443\/https\/ceur-ws.org\/Vol-3486\/37.pdf."},{"key":"ref_19","doi-asserted-by":"crossref","unstructured":"Doshi, R., Apthorpe, N., and Feamster, N. (2018, January 24). Machine Learning DDoS Detection for Consumer IoT Devices. Proceedings of the 2018 IEEE Security and Privacy Workshops (SPW), San Francisco, CA, USA.","DOI":"10.1109\/SPW.2018.00013"},{"key":"ref_20","first-page":"100656","article-title":"Deep Learning-Enabled Anomaly Detection for IoT Systems","volume":"20","author":"Abusitta","year":"2022","journal-title":"Internet Things"},{"key":"ref_21","doi-asserted-by":"crossref","unstructured":"Rathinasamy, V., Lognathan, D., Saranya, S., and Sumathi, S. (2025). Anomaly Detection in IoT Networks Using Federated Machine Learning Approaches. Int. J. Comput. Exp. Sci. Eng., 11.","DOI":"10.22399\/ijcesen.2485"}],"container-title":["Computers"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/summer-heart-0930.chufeiyun1688.workers.dev:443\/https\/www.mdpi.com\/2073-431X\/15\/2\/107\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,2,4]],"date-time":"2026-02-04T09:07:48Z","timestamp":1770196068000},"score":1,"resource":{"primary":{"URL":"https:\/\/summer-heart-0930.chufeiyun1688.workers.dev:443\/https\/www.mdpi.com\/2073-431X\/15\/2\/107"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,2,4]]},"references-count":21,"journal-issue":{"issue":"2","published-online":{"date-parts":[[2026,2]]}},"alternative-id":["computers15020107"],"URL":"https:\/\/summer-heart-0930.chufeiyun1688.workers.dev:443\/https\/doi.org\/10.3390\/computers15020107","relation":{},"ISSN":["2073-431X"],"issn-type":[{"value":"2073-431X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,2,4]]}}}