IoT Intrusion Detection Taxonomy, Reference Architecture, and Analyses

Abstract

This paper surveys the deep learning (DL) approaches for intrusion-detection systems (IDSs) in Internet of Things (IoT) and the associated datasets toward identifying gaps, weaknesses, and a neutral reference architecture. A comparative study of IDSs is provided, with a review of anomaly-based IDSs on DL approaches, which include supervised, unsupervised, and hybrid methods. All techniques in these three categories have essentially been used in IoT environments. To date, only a few have been used in the anomaly-based IDS for IoT. For each of these anomaly-based IDSs, the implementation of the four categories of feature(s) extraction, classification, prediction, and regression were evaluated. We studied important performance metrics and benchmark detection rates, including the requisite efficiency of the various methods. Four machine learning algorithms were evaluated for classification purposes: Logistic Regression (LR), Support Vector Machine (SVM), Decision Tree (DT), and an Artificial Neural Network (ANN). Therefore, we compared each via the Receiver Operating Characteristic (ROC) curve. The study model exhibits promising outcomes for all classes of attacks. The scope of our analysis examines attacks targeting the IoT ecosystem using empirically based, simulation-generated datasets (namely the Bot-IoT and the IoTID20 datasets).

Challenges of Malware Detection in the IoT and a Review of Artificial Immune System Approaches

“…There are different datasets used to evaluate IoT security solutions. The most used datasets, as listed in [61], are the NSL-KDD, the Bot-IoT, the Botnet, and the Android malware datasets. In this performance analysis, we chose to use the NSL-KDD [55] for two reasons.…”

“…In this performance analysis, we chose to use the NSL-KDD [55] for two reasons. First, unlike the other datasets, the NSL-KDD eliminates the redundant records in the previous dataset (KDD'99), resulting in a reduction of the number of borderline records compared to any other dataset [61]. This leads to more accurate results when evaluating an AIS-based security solution.…”

IoT Security Challenges: Cloud and Blockchain, Postquantum Cryptography, and Evolutionary Techniques

“…Other aspects of IoT security can utilize deep learning, including those we already mentioned in this section. This includes intrusion detection [126][127][128][129] and other types of anomaly detection [130]. A full coverage of these areas would require a separate article.…”

ELBA-IoT: An Ensemble Learning Model for Botnet Attack Detection in IoT Networks

“…It can be defined as the "interconnection of things" having constrained computational power and capabilities. It can be used to send and receive data over the internet without requiring human-to-computer or human-to-human interaction [1]. The word "things" refers to the IP-enabled, networked devices (both physical and virtual).…”