AI-Based Two-Stage Intrusion Detection for Software Defined IoT Networks

Abstract

Software Defined Internet of Things (SD-IoT) Networks profits from centralized management and interactive resource sharing which enhances the efficiency and scalability of IoT applications. But with the rapid growth in services and applications, it is vulnerable to possible attacks and faces severe security challenges. Intrusion detection has been widely used to ensure network security, but classical detection means are usually signature-based or explicit-behavior-based and fail to detect unknown attacks intelligently, which are hard to satisfy the requirements of SD-IoT Networks. In this paper, we propose an AI-based two-stage intrusion detection empowered by software defined technology. It flexibly captures network flows with a globle view and detects attacks intelligently through applying AI algorithms. We firstly leverage Bat algorithm with swarm division and Differential Mutation to select typical features. Then, we exploit Random forest through adaptively altering the weights of samples using weighted voting mechanism to classify flows. Evaluation results prove that the modified intelligent algorithms select more important features and achieve superior performance in flow classification. It is also verified that intelligent intrusion detection shows better accuracy with lower overhead comparied with existing solutions.

Machine Learning in IoT Security: Current Solutions and Future Challenges

“…Therefore, artificial intelligence and its breeds are employed in intrusion detection system (IDS). Li et al [126] proposed an Artificial Intelligence-(AI) based mechanism for intrusion detection in SDN-driven IoT. This scheme is based on network traffic flow where the intrusion detection component of the network captures the flow and applies two algorithms for features extraction, i.e.…”

Q-MIND: Defeating Stealthy DoS Attacks in SDN with a Machine-Learning Based Defense Framework

“…The MDP is characterized by <S,A,r>, where S is the state space, A is the action space, and r is the immediate reward of the detection system. For evaluating the anomaly detection performance of an action (feature set and AI/ML algorithm), we consider common metrics [14] including precision (P r ), recall (R e ), F-score (F s ), accuracy (A c ), and false alarm rate (F a ). These metrics are calculated from the following observations: TP (True Positive) -number of attacks precisely detected; TN (True Negative) -number of normal patterns precisely classified; FP (False Positive) -number of normal patterns incorrectly classified; and FN (False Negative) -number of attacks unsuccessfully detected.…”

“….., f m } denotes a group of feasible feature sets composed of all available and suited features, e.g., a feature set f m consists of 4 features (average packets per flow, average packet size per flow, packet change ratio and flow change ratio). L = {l 1 , l 2 , ..., l n } represents a set of possible AI/ML algorithms that can be used for traffic flow classification, e.g., Support Vector Machine [12], Random Forest [14], and Self Organizing Map [15]. Then, a tuple, < f m , l n >, is referred as a combination of a feature set and an AI/ML algorithm.…”

“…The SDN network is controlled by an ONOS SDN controller [17]. We consider three well-known AI/ML based classifiers including Support Vector Machine (SVM-supervised learning) [12], Random Forest (RF-supervised learning) [14] and Self Organizing Maps (SOM-unsupervised learning) [15], hence L = {SV M, RF, SOM }. The applied feature set F is created by the following 10 suitable features: average packets per flow, average packet size per flow, packet change ratio, flow change ratio, average duration per flow, percentage of pairflows, growth of different ports, average flow inter-arrivaltime, fraction of TCP flows over total incoming flows and entropy of incoming flows.…”

“…To evaluate the Q-MIND framework, we first compare our optimized anomaly detection solution based on Q-Learning with three other AI/ML-based anomaly detection/classification methods that apply different feature selection techniques, namely a Principal Component Analysis with a SVM classifier (PCASVM) [12], a Generic Algorithm with a SVM classifier (GASVM) [12] and a Binary Bat Algorithm with a RF classifier (BBARF) [14]. We evaluate the stealthy DoS attack detection performance both in the cross-validation and in the runtime phase.…”