Deep-IDS: A Real-Time Intrusion Detector for IoT Nodes Using Deep Learning

Abstract

The Internet of Things (IoT) represents a swiftly expanding sector that is pivotal in driving the innovation of today's smart services. However, the inherent resource-constrained nature of IoT nodes poses significant challenges in embedding advanced algorithms for cybersecurity, leading to an escalation in cyberattacks against these nodes. Contemporary research in Intrusion Detection Systems (IDS) predominantly focuses on enhancing IDS performance through sophisticated algorithms, often overlooking their practical applicability. This paper introduces Deep-IDS, an innovative and practically deployable Deep Learning (DL)-based IDS. It employs a Long-Short-Term-Memory (LSTM) network comprising 64 LSTM units and is trained on the CIC-IDS2017 dataset. Its streamlined architecture renders Deep-IDS an ideal candidate for edge-server deployment, acting as a guardian between IoT nodes and the Internet against Denial of Service (DoS), Distributed Denial of Service (DDoS), Brute Force (BRF), Man-in-the-Middle (MITM), and Replay (RP) Attacks. A distinctive aspect of this research is the trade-off analysis between the intrusion detection rate and the false alarm rate, facilitating the real-time performance of the Deep-IDS. The system demonstrates an exemplary detection rate of 96.8% and an overall classification accuracy of 97.67%. Furthermore, Deep-IDS achieves precision, recall, and F1-scores of 97.67%, 98.17%, and 97.91%, respectively. On average, Deep-IDS requires 1.49 seconds to identify and mitigate intrusion attempts, effectively blocking malicious traffic sources. The remarkable efficacy, swift response time, innovative design, and novel defense strategy of Deep-IDS not only secure IoT nodes but also their interconnected subnetworks, thereby positioning Deep-IDS as a leading intrusion detection system for IoT-enhanced computer networks.