IoT Crawler with Behavior Analyzer at Fog layer for Detecting Malicious Nodes

Abstract

The limitations in terms of power and processing in IoT (Internet of Things) nodes make nodes an easy prey for malicious attacks, thus threatening business and industry. Detecting malicious nodes before they trigger an attack is highly recommended. The paper introduces a special purpose IoT crawler that works as an inspector to catch malicious nodes. This crawler is deployed in the Fog layer to inherit its capabilities, and to be an intermediate connection between the things and the cloud computing nodes. The crawler collects data streams from IoT nodes, upon a priority criterion. A behavior analyzer, with a machine learning core, detects malicious nodes according to the extracted node behavior from the crawler collected data streams. The performance of the behavior analyzer was investigated using three machine learning algorithms: Adaboost, Random forest and Extra tree. The behavior analyzer produces better testing accuracy, for the tested data, when using Extra tree compared to Adaboost and Random forest; it achieved 98.3% testing accuracy with Extra tree.

Intrusion detection with Machine Learning in Internet of Things and Fog Computing: problems, solutions and research

“…Instead of looking for the most discriminating cut points, they are drawn randomly in ET, making the ET training process faster. In [Albdour et al 2020] is proposed an ET-based intrusion detection approach for the fog layer. The approach has 10 DTs and uses the Gini criterion.…”

“…Many approaches found in the state-of-the-art focus on performing binary detection (attack or non-attack). However, binary methods cannot identify the type or category of attack [Albdour et al 2020]. The approaches, which aim to classify the attack into specific categories, are multiclass.…”

“…Several state-of-the-art approaches focus on anomaly methods for binary detection (attack or non-attack) [Albdour et al 2020, Kumar et al 2021a, Rey et al 2022. They can detect an intrusion, but not the type or category of attack.…”

Application of Machine Learning in Malicious IoT Classification and Detection on Fog-IoT Architecture

“…A recent study by Layla Albdour et al . [8] uses a crawler that acts as a security checker to monitor IoT nodes and collect data streams to analyze the behavior of the nodes. Based on that, to put the fake IoT alert action.…”