A Deep Learning Method for Lightweight and Cross-Device IoT Botnet Detection

Catillo, Marta; Pecchia, Antonio; Villano, Umberto

doi:10.3390/app13020837

Cited by 18 publications

(5 citation statements)

References 37 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Catillo et al 113 present an innovative method applicable to various IoT devices within the well‐known N‐BaIoT dataset, allowing the development of a single IDS model. In contrast to existing approaches that build separate IDS models per IoT device or attack, their approach centers on an all‐in‐one deep autoencoder.…”

Section: Discussionmentioning

confidence: 99%

Botnet‐based IoT network traffic analysis using deep learning

Singh,

Hoque,

Singh

et al. 2023

Security and Privacy

View full text Add to dashboard Cite

IoT networks are increasingly being connected to a wide range of devices, and the number of devices connected has significantly increased in recent years. As a consequence, the number of vulnerabilities to IoT networks has also been increasing tremendously. In IoT networks, botnet‐based Distributed Denial of Service attack is challenging due to its dynamic behavior. The sensors and actuators connected to IoT networks are low‐powered and have less memory. Because of their inherent vulnerability, IoT devices can always be compromised by an attacker and be used to form a large botnet. A detailed analysis of IoT botnet attacks is presented in this article, along with statistics and the architectures of the botnet. We also survey the existing literature on IoT botnet traffic analysis and present a taxonomy of attack detection methods. We particularly focus on deep learning‐based methods and conduct a comparative study to evaluate their performance on IoT traffic analysis. We identify the current issues and research challenges in this field, and we conclude by highlighting some future research directions.

show abstract

Section: Discussionmentioning

confidence: 99%

Botnet‐based IoT network traffic analysis using deep learning

Singh,

Hoque,

Singh

et al. 2023

Security and Privacy

View full text Add to dashboard Cite

show abstract

“…Recently, deep learning methods such as convolutional neural networks (CNNs) and natural language processing (NLP) have been applied to automate cybersecurity tasks [17][18][19][20], including the automatic extraction of URL features and the detection of phishing websites. Le et al [21] proposed an end-to-end deep learning framework called URLNet, which uses a convolutional neural network to directly learn non-linear URL embeddings, overcoming the limitations of traditional machine learning methods that only rely on the lexical properties of URL strings and require manual feature engineering.…”

Section: Url-based Methodsmentioning

confidence: 99%

A Lightweight Multi-View Learning Approach for Phishing Attack Detection Using Transformer with Mixture of Experts

Wang

et al. 2023

Applied Sciences

View full text Add to dashboard Cite

Phishing poses a significant threat to the financial and privacy security of internet users and often serves as the starting point for cyberattacks. Many machine-learning-based methods for detecting phishing websites rely on URL analysis, offering simplicity and efficiency. However, these approaches are not always effective due to the following reasons: (1) highly concealed phishing websites may employ tactics such as masquerading URL addresses to deceive machine learning models, and (2) phishing attackers frequently change their phishing website URLs to evade detection. In this study, we propose a robust, multi-view Transformer model with an expert-mixture mechanism for accurate phishing website detection utilizing website URLs, attributes, content, and behavioral information. Specifically, we first adapted a pretrained language model for URL representation learning by applying adversarial post-training learning in order to extract semantic information from URLs. Next, we captured the attribute, content, and behavioral features of the websites and encoded them as vectors, which, alongside the URL embeddings, constitute the website’s multi-view information. Subsequently, we introduced a mixture-of-experts mechanism into the Transformer network to learn knowledge from different views and adaptively fuse information from various views. The proposed method outperforms state-of-the-art approaches in evaluations of real phishing websites, demonstrating greater performance with less label dependency. Furthermore, we show the superior robustness and enhanced adaptability of the proposed method to unseen samples and data drift in more challenging experimental settings.

show abstract

“…In 2023, ref. [27] proposed a semi-supervised AE approach to the N-BaIoT dataset. To cope with the scalability of IoT, the proposed framework allows for the training of a single model, which can work across many devices.…”

Section: Related Workmentioning

confidence: 99%

Dragon_Pi: IoT Side-Channel Power Data Intrusion Detection Dataset and Unsupervised Convolutional Autoencoder for Intrusion Detection

Lightbody,

Ngo,

Temko

et al. 2024

Future Internet

View full text Add to dashboard Cite

The growth of the Internet of Things (IoT) has led to a significant rise in cyber attacks and an expanded attack surface for the average consumer. In order to protect consumers and infrastructure, research into detecting malicious IoT activity must be of the highest priority. Security research in this area has two key issues: the lack of datasets for training artificial intelligence (AI)-based intrusion detection models and the fact that most existing datasets concentrate only on one type of network traffic. Thus, this study introduces Dragon_Pi, an intrusion detection dataset designed for IoT devices based on side-channel power consumption data. Dragon_Pi comprises a collection of normal and under-attack power consumption traces from separate testbeds featuring a DragonBoard 410c and a Raspberry Pi. Dragon_Slice is trained on this dataset; it is an unsupervised convolutional autoencoder (CAE) trained exclusively on held-out normal slices from Dragon_Pi for anomaly detection. The Dragon_Slice network has two iterations in this study. The original achieves 0.78 AUC without post-processing and 0.876 AUC with post-processing. A second iteration of Dragon_Slice, utilising dropout to further impede the CAE’s ability to reconstruct anomalies, outperforms the original network with a raw AUC of 0.764 and a post-processed AUC of 0.89.

show abstract

A Deep Learning Method for Lightweight and Cross-Device IoT Botnet Detection

Cited by 18 publications

References 37 publications

Botnet‐based IoT network traffic analysis using deep learning

Botnet‐based IoT network traffic analysis using deep learning

A Lightweight Multi-View Learning Approach for Phishing Attack Detection Using Transformer with Mixture of Experts

Dragon_Pi: IoT Side-Channel Power Data Intrusion Detection Dataset and Unsupervised Convolutional Autoencoder for Intrusion Detection

Contact Info

Product

Resources

About