An adaptive intrusion detection and prevention system for Internet of Things

Bakhsh, Sheikh Tahir; Al-Ghamdi, Saleh; Alsemmeari, Rayan A.; Hassan, Syed Raheel

doi:10.1177/1550147719888109

Cited by 30 publications

(10 citation statements)

References 20 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Most IDSs classify attacks by analyzing network traffic generated from specialized environments [ 50 , 51 , 52 , 53 , 54 , 55 ]. Nevertheless, in reality, network traffic may originate from a broad range of traffic and include excessive data.…”

Section: Related Workmentioning

confidence: 99%

Using Embedded Feature Selection and CNN for Classification on CCD-INID-V1—A New IoT Dataset

Liu

Thapa

Shaver

et al. 2021

Sensors

View full text Add to dashboard Cite

As Internet of Things (IoT) networks expand globally with an annual increase of active devices, providing better safeguards to threats is becoming more prominent. An intrusion detection system (IDS) is the most viable solution that mitigates the threats of cyberattacks. Given the many constraints of the ever-changing network environment of IoT devices, an effective yet lightweight IDS is required to detect cyber anomalies and categorize various cyberattacks. Additionally, most publicly available datasets used for research do not reflect the recent network behaviors, nor are they made from IoT networks. To address these issues, in this paper, we have the following contributions: (1) we create a dataset from IoT networks, namely, the Center for Cyber Defense (CCD) IoT Network Intrusion Dataset V1 (CCD-INID-V1); (2) we propose a hybrid lightweight form of IDS—an embedded model (EM) for feature selection and a convolutional neural network (CNN) for attack detection and classification. The proposed method has two models: (a) RCNN: Random Forest (RF) is combined with CNN and (b) XCNN: eXtreme Gradient Boosting (XGBoost) is combined with CNN. RF and XGBoost are the embedded models to reduce less impactful features. (3) We attempt anomaly (binary) classifications and attack-based (multiclass) classifications on CCD-INID-V1 and two other IoT datasets, the detection_of_IoT_botnet_attacks_N_BaIoT dataset (Balot) and the CIRA-CIC-DoHBrw-2020 dataset (DoH20), to explore the effectiveness of these learning-based security models. Using RCNN, we achieved an Area under the Receiver Characteristic Operator (ROC) Curve (AUC) score of 0.956 with a runtime of 32.28 s on CCD-INID-V1, 0.999 with a runtime of 71.46 s on Balot, and 0.986 with a runtime of 35.45 s on DoH20. Using XCNN, we achieved an AUC score of 0.998 with a runtime of 51.38 s for CCD-INID-V1, 0.999 with a runtime of 72.12 s for Balot, and 0.999 with a runtime of 72.91 s for DoH20. Compared to KNN, XCNN required 86.98% less computational time, and RCNN required 91.74% less computational time to achieve equal or better accurate anomaly detections. We find XCNN and RCNN are consistently efficient and handle scalability well; in particular, 1000 times faster than KNN when dealing with a relatively larger dataset-Balot. Finally, we highlight RCNN and XCNN’s ability to accurately detect anomalies with a significant reduction in computational time. This advantage grants flexibility for the IDS placement strategy. Our IDS can be placed at a central server as well as resource-constrained edge devices. Our lightweight IDS requires low train time and hence decreases reaction time to zero-day attacks.

show abstract

Section: Related Workmentioning

confidence: 99%

Using Embedded Feature Selection and CNN for Classification on CCD-INID-V1—A New IoT Dataset

Liu

Thapa

Shaver

et al. 2021

Sensors

View full text Add to dashboard Cite

show abstract

“…Bakhsh et al proposed adaptive intrusion detection and prevention system for the IoT devices utilizing agent technology to support portability, rigidness, and self-started attributes [ 3 ]. The system was meant to sit in the middle of the network layout, serving its IoT devices.…”

Section: Related Workmentioning

confidence: 99%

“…The openness to the public exposes those devices to different security risks that exploit their vulnerabilities and consequently affect their integrity, confidentiality, and availability [ 3 ]. Even with the continuous expansion of IoT, attacks become more prevalent and complex.…”

Section: Introductionmentioning

confidence: 99%

Study of Machine Learning for Cloud Assisted IoT Security as a Service

Alsharif

Rawat

2021

Sensors

View full text Add to dashboard Cite

Machine learning (ML) has been emerging as a viable solution for intrusion detection systems (IDS) to secure IoT devices against different types of attacks. ML based IDS (ML-IDS) normally detect network traffic anomalies caused by known attacks as well as newly introduced attacks. Recent research focuses on the functionality metrics of ML techniques, depicting their prediction effectiveness, but overlooked their operational requirements. ML techniques are resource-demanding that require careful adaptation to fit the limited computing resources of a large sector of their operational platform, namely, embedded systems. In this paper, we propose cloud-based service architecture for managing ML models that best fit different IoT device operational configurations for security. An IoT device may benefit from such a service by offloading to the cloud heavy-weight activities such as feature selection, model building, training, and validation, thus reducing its IDS maintenance workload at the IoT device and get the security model back from the cloud as a service.

show abstract

“…Doesn't support the attacks like cloning of device ID, spoofing, and sybil attacks. Bakhsh et al [16] introduced an Integrated Intrusion Detection and Prohibition Program for the Internet of Things (IDPIoT) to improve protection and expand the range of devices connecting with the Internet. The main objective is to enforce one crucial aspect of defense, the IDP program.…”

Section: Introductionmentioning

confidence: 99%

Improved Ant Colony Optimization and Machine Learning Based Ensemble Intrusion Detection Model

Vanitha¹,

Balasubramanie²

2023

Intelligent Automation &Amp; Soft Computing

View full text Add to dashboard Cite

Internet of things (IOT) possess cultural, commercial and social effect in life in the future. The nodes which are participating in IOT network are basically attracted by the cyber-attack targets. Attack and identification of anomalies in IoT infrastructure is a growing problem in the IoT domain. Machine Learning Based Ensemble Intrusion Detection (MLEID) method is applied in order to resolve the drawback by minimizing malicious actions in related botnet attacks on Message Queue Telemetry Transport (MQTT) and Hyper-Text Transfer Protocol (HTTP) protocols. The proposed work has two significant contributions which are a selection of features and detection of attacks. New features are chosen from Improved Ant Colony Optimization (IACO) in the feature selection, and then the detection of attacks is carried out based on a combination of their possible properties. The IACO approach is focused on defining the attacker's important features against HTTP and MQTT. In the IACO algorithm, the constant factor is calculated against HTTP and MQTT based on the mean function for each element. Attack detection, the performance of several machine learning models are Distance Decision Tree (DDT), Adaptive Neuro-Fuzzy Inference System (ANFIS) and Mahalanobis Distance Support Vector Machine (MDSVM) were compared with predicting accurate attacks on the IoT network. The outcomes of these classifiers are combined into the ensemble model. The proposed MLEID strategy has effectively established malicious incidents. The UNSW-NB15 dataset is used to test the MLEID technique using data from simulated IoT sensors. Besides, the proposed MLEID technique has a greater detection rate and an inferior rate of false-positive compared to other conventional techniques.

show abstract

An adaptive intrusion detection and prevention system for Internet of Things

Cited by 30 publications

References 20 publications

Using Embedded Feature Selection and CNN for Classification on CCD-INID-V1—A New IoT Dataset

Using Embedded Feature Selection and CNN for Classification on CCD-INID-V1—A New IoT Dataset

Study of Machine Learning for Cloud Assisted IoT Security as a Service

Improved Ant Colony Optimization and Machine Learning Based Ensemble Intrusion Detection Model

Contact Info

Product

Resources

About