Anomaly Detection on IoT Network Intrusion Using Machine Learning

Liu, Zhipeng; Thapa, Niraj; Shaver, Addison; Yuan, Xiaohong; Khorsandroo, Sajad

doi:10.1109/icabcd49160.2020.9183842

Cited by 49 publications

(21 citation statements)

References 15 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…e authors of [10] presented a scalable k-NN-based online anomaly detection addressing the lazylearning problem in wireless sensor networks [10]. e works in [16] also employed anomaly detection techniques for IDSs using binary classification. is means that they cannot identify the type of attack.…”

Section: Related Workmentioning

confidence: 99%

MidSiot: A Multistage Intrusion Detection System for Internet of Things

Dat-Thinh

Xuan-Ninh

2022

Wireless Communications and Mobile Computing

View full text Add to dashboard Cite

Internet of Things (IoT) has been thriving in recent years, playing an important role in a multitude of various domains, including industry 4.0, smart transportation, home automation, and healthcare. As a result, a massive number of IoT devices are deployed to collect data from our surrounding environment and transfer these data to other systems over the Internet. This may lead to cybersecurity threats, such as denial of service attacks, brute-force attacks, and unauthorized accesses. Unfortunately, many IoT devices lack solid security mechanisms and hardware security supports because of their limitations in computational capability. In addition, the heterogeneity of devices in IoT networks causes nontrivial challenges in detecting security threats. In this article, we present a collaborative intrusion detection system (IDS), namely, MidSiot, deployed at both Internet gateways and IoT local gateways. Our proposed IDS consists of three stages: (1) classifying the type of each IoT device in the IoT network; (2) differentiating between benign and malicious network traffic; and (3) identifying the type of attacks targeting IoT devices. The last two stages are handled by the Internet gateways, whereas the first stage is on the local gateway to leverage the computational resources from edge devices. The evaluation results on three popular IDS datasets (IoTID20, CIC-IDS-2017, and BOT-IoT) indicate our proposal could detect seven common cyberattacks targeting IoT devices with an average accuracy of 99.68% and outperforms state-of-the-art IDSs. This demonstrates that MidSiot could be an effective and practical IDS to protect IoT networks.

show abstract

Section: Related Workmentioning

confidence: 99%

MidSiot: A Multistage Intrusion Detection System for Internet of Things

Dat-Thinh

Xuan-Ninh

2022

Wireless Communications and Mobile Computing

View full text Add to dashboard Cite

show abstract

“…Aiming at improving security in IoT applications, several ML-based network traffic classification solutions have been proposed. Liu et al [16] presented a comparative analysis of different ML methodologies in classifying malicious and benign network traffic. Five methodologies were tested, namely Support Vector Machine (SVM), K-Nearest Neighbours (KNN), Logistic Regression (LR), eXtreme Gradient Boosting (XGBoost), and RF.…”

Section: Related Workmentioning

confidence: 99%

Performance of Machine Learning-Based Multi-Model Voting Ensemble Methods for Network Threat Detection in Agriculture 4.0

Πεππές

Daskalakis

Alexakis

et al. 2021

Sensors

View full text Add to dashboard Cite

The upcoming agricultural revolution, known as Agriculture 4.0, integrates cutting-edge Information and Communication Technologies in existing operations. Various cyber threats related to the aforementioned integration have attracted increasing interest from security researchers. Network traffic analysis and classification based on Machine Learning (ML) methodologies can play a vital role in tackling such threats. Towards this direction, this research work presents and evaluates different ML classifiers for network traffic classification, i.e., K-Nearest Neighbors (KNN), Support Vector Classification (SVC), Decision Tree (DT), Random Forest (RF) and Stochastic Gradient Descent (SGD), as well as a hard voting and a soft voting ensemble model of these classifiers. In the context of this research work, three variations of the NSL-KDD dataset were utilized, i.e., initial dataset, undersampled dataset and oversampled dataset. The performance of the individual ML algorithms was evaluated in all three dataset variations and was compared to the performance of the voting ensemble methods. In most cases, both the hard and the soft voting models were found to perform better in terms of accuracy compared to the individual models.

show abstract

“…They can perform under binary as well as multiclass conditions. For large datasets, SVM is not recommended as the training takes a long time [35,41]. Suman et al [31] proposed an IDS for IoT security based on SDN strategies which aimed to detect anomalous activity early and enhance resilience.…”

Section: Machine Learning Techniquesmentioning

confidence: 99%

Monitoring Real Time Security Attacks for IoT Systems Using DevSecOps: A Systematic Literature Review

et al. 2021

View full text Add to dashboard Cite

In many enterprises and the private sector, the Internet of Things (IoT) has spread globally. The growing number of different devices connected to the IoT and their various protocols have contributed to the increasing number of attacks, such as denial-of-service (DoS) and remote-to-local (R2L) ones. There are several approaches and techniques that can be used to construct attack detection models, such as machine learning, data mining, and statistical analysis. Nowadays, this technique is commonly used because it can provide precise analysis and results. Therefore, we decided to study the previous literature on the detection of IoT attacks and machine learning in order to understand the process of creating detection models. We also evaluated various datasets used for the models, IoT attack types, independent variables used for the models, evaluation metrics for assessment of models, and monitoring infrastructure using DevSecOps pipelines. We found 49 primary studies, and the detection models were developed using seven different types of machine learning techniques. Most primary studies used IoT device testbed datasets, and others used public datasets such as NSL-KDD and UNSW-NB15. When it comes to measuring the efficiency of models, both numerical and graphical measures are commonly used. Most IoT attacks occur at the network layer according to the literature. If the detection models applied DevSecOps pipelines in development processes for IoT devices, they were more secure. From the results of this paper, we found that machine learning techniques can detect IoT attacks, but there are a few issues in the design of detection models. We also recommend the continued use of hybrid frameworks for the improved detection of IoT attacks, advanced monitoring infrastructure configurations using methods based on software pipelines, and the use of machine learning techniques for advanced supervision and monitoring.

show abstract

Anomaly Detection on IoT Network Intrusion Using Machine Learning

Cited by 49 publications

References 15 publications

MidSiot: A Multistage Intrusion Detection System for Internet of Things

MidSiot: A Multistage Intrusion Detection System for Internet of Things

Performance of Machine Learning-Based Multi-Model Voting Ensemble Methods for Network Threat Detection in Agriculture 4.0

Monitoring Real Time Security Attacks for IoT Systems Using DevSecOps: A Systematic Literature Review

Contact Info

Product

Resources

About