This website stores cookies on your computer. These cookies are used to collect information about how you interact with our website and allow us to remember your browser. We use this information to improve and customize your browsing experience, for analytics and metrics about our visitors both on this website and other media, and for marketing purposes. By using this website, you accept and agree to be bound by UVic’s Terms of Use for web and social media privacy.  If you do not agree to the above, you can configure your browser’s setting to “do not track.”

Skip to main content
People Departments Maps Buildings Rooms A-Z
University
of Victoria
Apply Library
Sign in Online tools Sign out
Faculty of Graduate Studies

Tianming Wang

  • B.Eng., (Wuhan University, China, 2018)

  • M.Sc., (New York University, 2020)

Notice of the Final Oral Examination for the Degree of Doctor of Philosophy

Topic

Content-Aided Anomaly Detection for Internet of Things: From Representation to Generalization

Department of Computer Science

Date & location

  • Thursday, September 3, 2026

  • 10:30 A.M.

  • Engineering Computer Science Building

  • Room 467

Reviewers

Supervisory Committee

  • Dr. Kui Wu, Department of Computer Science, University of Victoria (Supervisor)

  • Dr. Sudhakar Ganti, Department of Computer Science, UVic (Member)

  • Dr. Riham AlTawy, Department of Electrical and Computer Engineering, UVic (Outside Member) 

External Examiner

  • Dr. Yong Gao, Department of Computer Science, Mathematics, Physics and Statistics, University of British Columbia 

Chair of Oral Examination

  • Dr. Jim Tanaka, Department of Psychology, UVic

     

Abstract

Despite the rapid growth of the Internet of Things (IoT), pervasive hardware and firmware vulnerabilities render anomaly detection both essential and highly challenging. Comprehensive IoT security demands a multi-layered defence spanning the frontend edge gateway, which intercepts local device traffic, and the backend web ser vices, which support the broader system infrastructure. This dissertation introduces a framework for content-aided anomaly detection across both layers, systematically exploiting the rich payload content carried in network traffic rather than relying solely on traditional packet headers. 

At the frontend, we develop a content-aided approach that leverages packet pay loads to build a machine learning model. This approach is based on the observation that IoT devices, unlike general-purpose computers, are usually used for very specific tasks; for example, a smart camera primarily carries video data. Our content-aided approach considers both packet header and payload information and ensembles two machine learning models, one built with information from packet headers and the other with information from packet payload, to obtain the final detection results. Furthermore, we observe that the data content from IoT devices reflects the special application context of this device and thus can be treated as the special “language" this device speaks. As such, we leverage ChatGPT embeddings to extract features from the IoT traffic payload, which we then use to train an effective and efficient IoT traffic anomaly model. Experimental results on real-world benchmark data show that our solutions achieve accurate and robust anomaly detection. 

At the backend, we address a critical issue in pre-deployment model selection. Machine-learning detectors for Web Application Firewalls (WAFs) routinely score near-perfectly on independent and identically distributed (IID) test splits, yet many degrade sharply on out-of-distribution (OOD) traffic. Assembling OOD test sets to expose this gap is reactive and, in the face of zero-day threats, often infeasible. We introduce the Shortcut Score, a pre-deployment signal that quantifies how concentrated a model’s gradient-based attribution is on a small set of input tokens, computed entirely from IID data. Across nine model configurations spanning four architectural families, Shortcut Score correlates strongly with a model’s performance degradation when facing OOD data, thereby providing a reliable pre-deployment ranking of a model’s robustness. We also demonstrate three applications of Shortcut Score: guiding the selection of robust architectures by explaining how embedding strategy and architecture interact, diagnosing shortcut-driven errors at the level of individual predictions, and serving as a training signal to reduce reliance on shortcuts and enhance the model’s robustness.

Together, the above contributions bridge the gap between feature extraction and real-world deployment, moving from building detailed traffic profiles to ensuring those models actually generalize in the field. By addressing security concerns across IoT edges and backend servers, they advance IoT anomaly detection with stronger representations and measurable, generalizable robustness.

Back to oral exams