A Multi-Class Neural Network Model for Rapid Detection of IoT Botnet Attacks

Alzahrani, Haifaa Mohammed

doi:10.14569/ijacsa.2020.0110783

Cited by 11 publications

(26 citation statements)

References 24 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Its authors evaluate the performance of simple techniques including k-Nearest Neighbours classifiers, decision trees and random forests. Recurrent models have also been shown to be very effective for early-stage detection on MedBIoT [1]. These models, like the ones for detection of botnet attacks by which they are inspired [9], treat packet headers as sequences of fields, such as IP address, source port, packet length, etc.…”

Section: Related Workmentioning

confidence: 99%

“…Our approach, LiMNet, focuses on IoT botnet spreading, but differs from the discussed works [7,1] in several aspects. First, LiMNet is a memory network which learns device representations, rather than a recurrent network focused on packet representations.…”

Section: Related Workmentioning

confidence: 99%

“…While existing recurrent models from [1] and [9] have been shown to perform well, they present several issues that make their deployment in real-world IoT scenarios challenging. This motivates the contributions of this work: a review of these recurrent models to analyze their limitations and the proposal of the novel LiMNet architecture.…”

Section: Limitations Of Existing Recurrent Models For Early-stage Botnet Detectionmentioning

confidence: 99%

“…Therefore, unlike previous work [1], we focus our performance testing on single-core CPU inference, and use a batch size of 1. In these conditions, lightweight models that can fit in the small private cache of the core and only require small matrix multiplications gain a substantial performance advantage.…”

Section: Deployment Environmentmentioning

confidence: 99%

“…Yet, few works focus on detecting IoT botnets during their spreading phase, before any attacks. These approaches typically use shallow ML techniques [7] or recurrent neural networks [1] to analyze network packet headers. Unfortunately, while these models provide good accuracy, their architectures exhibit several limitations, such as low inference speed and the inability to account for temporal and topological information.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

LiMNet: Early-Stage Detection of IoT Botnets with Lightweight Memory Networks

Giaretta

Lekssays

Carminati

et al. 2021

Computer Security – ESORICS 2021

View full text Add to dashboard Cite

IoT devices have been growing exponentially in the last few years. This growth makes them an attractive target for attackers due to their low computational power and limited security features. Attackers use IoT botnets as an instrument to perform DDoS attacks which caused major disruptions of Internet services in the last decade. While many works have tackled the task of detecting botnet attacks, only a few have considered early-stage detection of these botnets during their propagation phase. While previous approaches analyze each network packet individually to predict its maliciousness, we propose a novel deep learning model called LiMNet (Lightweight Memory Network), which uses an internal memory component to capture the behaviour of each IoT device over time. This memory incorporates both packet features and behaviour of the peer devices. With this information, LiMNet achieves almost maximum AUROC classification scores, between 98.8% and 99.7%, with a 14% improvement over state of the art. LiMNet is also lightweight, performing inference almost 8 times faster than previous approaches.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

Section: Limitations Of Existing Recurrent Models For Early-stage Botnet Detectionmentioning

confidence: 99%

Section: Deployment Environmentmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

LiMNet: Early-Stage Detection of IoT Botnets with Lightweight Memory Networks

Giaretta

Lekssays

Carminati

et al. 2021

Computer Security – ESORICS 2021

View full text Add to dashboard Cite

show abstract

IoT malware: An attribute-based taxonomy, detection mechanisms and challenges

Victor,

Lashkari,

et al. 2023

Peer-to-Peer Netw. Appl.

View full text Add to dashboard Cite

During the past decade, the Internet of Things (IoT) has paved the way for the ongoing digitization of society in unique ways. Its penetration into enterprise and day-to-day lives improved the supply chain in numerous ways. Unfortunately, the profuse diversity of IoT devices has become an attractive target for malware authors who take advantage of its vulnerabilities. Accordingly, enhancing the security of IoT devices has become the primary objective of industrialists and researchers. However, most present studies lack a deep understanding of IoT malware and its various aspects. As understanding IoT malware is the preliminary base of research, in this work, we present an IoT malware taxonomy with 100 attributes based on the IoT malware categories, attack types, attack surfaces, malware distribution architecture, victim devices, victim device architecture, IoT malware characteristics, access mechanisms, programming languages, and protocols. In addition, we have mapped these categories into 77 IoT Malwares identified between 2008 and 2022. Furthermore, To provide insight into the challenges in IoT malware research for future researchers, our study also reviews the existing IoT malware detection works.

show abstract

Design and Development of a Deep Learning-Based Model for Anomaly Detection in IoT Networks

2021

View full text Add to dashboard Cite

The growing development of IoT (Internet of Things) devices creates a large attack surface for cybercriminals to conduct potentially more destructive cyberattacks; as a result, the security industry has seen an exponential increase in cyber-attacks. Many of these attacks have effectively accomplished their malicious goals because intruders conduct cyber-attacks using novel and innovative techniques. An anomalybased IDS (Intrusion Detection System) uses machine learning techniques to detect and classify attacks in IoT networks. In the presence of unpredictable network technologies and various intrusion methods, traditional machine learning techniques appear inefficient. In many research areas, deep learning methods have shown their ability to identify anomalies accurately. Convolutional neural networks are an excellent alternative for anomaly detection and classification due to their ability to automatically categorize main characteristics in input data and their effectiveness in performing faster computations. In this paper, we design and develop a novel anomaly-based intrusion detection model for IoT networks. First, a convolutional neural network model is used to create a multiclass classification model. The proposed model is then implemented using convolutional neural networks in 1D, 2D, and 3D. The proposed convolutional neural network model is validated using the BoT-IoT, IoT Network Intrusion, MQTT-IoT-IDS2020, and IoT-23 intrusion detection datasets. Transfer learning is used to implement binary and multiclass classification using a convolutional neural network multiclass pre-trained model. Our proposed binary and multiclass classification models have achieved high accuracy, precision, recall, and F1 score compared to existing deep learning implementations.

show abstract

A Multi-Class Neural Network Model for Rapid Detection of IoT Botnet Attacks

Cited by 11 publications

References 24 publications

LiMNet: Early-Stage Detection of IoT Botnets with Lightweight Memory Networks

LiMNet: Early-Stage Detection of IoT Botnets with Lightweight Memory Networks

IoT malware: An attribute-based taxonomy, detection mechanisms and challenges

Design and Development of a Deep Learning-Based Model for Anomaly Detection in IoT Networks

Contact Info

Product

Resources

About