An ensemble deep learning based IDS for IoT using Lambda architecture

Abstract

The Internet of Things (IoT) has revolutionized our world today by providing greater levels of accessibility, connectivity and ease to our everyday lives. It enables massive amounts of data to be traversed across multiple heterogeneous devices that are all interconnected. This phenomenon makes IoT networks vulnerable to various network attacks and intrusions. Building an Intrusion Detection System (IDS) for IoT networks is challenging as they enable a massive amount of data to be aggregated, which is difficult to handle and analyze in real time mainly because of the heterogeneous nature of IoT devices. This inefficient, traditional IDS approach accentuates the need to develop advanced IDS techniques by employing Machine or Deep Learning. This paper presents a deep ensemble-based IDS using Lambda architecture by following a multi-pronged classification approach. Binary classification uses Long Short Term Memory (LSTM) to differentiate between malicious and benign traffic, while the multi-class classifier uses an ensemble of LSTM, Convolutional Neural Network and Artificial Neural Network classifiers to detect the type of attacks. The model training is performed in the batch layer, while real-time evaluation is carried out through model inferences in the speed layer of the Lambda architecture. The proposed approach gives high accuracy of over 99.93% and saves useful processing time due to the multi-pronged classification strategy and using the lambda architecture.

A Survey of Deep Learning Technologies for Intrusion Detection in Internet of Things

“…This is the author's version which has not been fully edited and content may change prior to final publication. Citation information: DOI 10.1109/ACCESS.2023.3349287 IoT-23 [78] Note: "√" means that the corresponding step is included. Where 𝑥 is the original feature value of the attribute, min(𝑥) is the minimum feature value, max(𝑥) is the maximum feature value, and 𝑥 ′ is the normalised feature value of the attribute.…”

“…From Table Ⅻ, deep learning models applied to IDS in IoT are mainly moving towards integrating hybrid deep learning models. For example, [78] proposed a hybrid IDS combining ANN, LSTM and CNN. In [91], a deep learningbased IoT IDS called MM-WMVEDL was designed, where the model includes BiLSTM, ELM and GRU, achieving the ability to process complex network traffic data in a multimodal structure.…”

“…In the future, we may see more research on how to effectively integrate multiple deep learning models, and future deep learning models may focus more on the ability of multimodal and cross-modal learning to understand better and utilise complex data. Furthermore, the use of datasets in IoT environments highlights the specialisation, and there will be more datasets used specifically for IoT environments such as Bot-IoT [83], [92][93][94], IoT-23 [78], [91], ToN-IoT [95], and so on.…”

UASDAC: An Unsupervised Adaptive Scalable DDoS Attack Classification in Large-Scale IoT Network Under Concept Drift

“…They achieved the high accuracy of 99.97% and 99.98% in binary and multiclass classification respectively when multilayer perceptron is used. R. Alghamdi and M. Bellaiche [32] introduced a scalable intrusion detection system utilizing multi-staged binary and multi-class classifiers, employing simple and ensemblebased deep learning techniques. They leveraged the Lambda architecture to enhance efficiency by training classifiers at the batch layer and analyzing real-time IoT traffic in the lowlatency speed layer.…”

Next-gen security in IIoT: integrating intrusion detection systems with machine learning for industry 4.0 resilience

“…ML empowers IDS to learn from data, discern pertinent features, and construct models capable the detection of known and unknown attacks. Additionally, ML facilitates the adaptation of IDS to the complexities of Fog/Edge computing, an emerging paradigm that involves bringing computation and storage closer to the data sources within the IIoT framework [14], [15]. This paper suggests a holistic strategy that involves the incorporation of sophisticated machine learning methods into intrusion detection systems.…”