ML-LGBM: A Machine Learning Model Based on Light Gradient Boosting Machine for the Detection of Version Number Attacks in RPL-Based Networks

Abstract

Internet of Things (IoT) has caused significant digital disruption to the future of the digital world. With the emergence of the 5G technology, IoT would shift rapidly from aspirational vision to realworld applications. However, one of the most pressing issues in IoT is security. Routing protocols of the IoT, such as the Routing Protocol for Low-power and lossy network protocol (RPL), are vulnerable to both insider and outsider attacks with the insider ones being more challenging because they are more difficult to detect and mitigate. Among the most concerning insider attacks to RPL in IoT applications is the Version Number Attacks (VNAs) that target the global repair mechanisms by consuming resources of IoT devices, such as power, memory, and processing power, to eventually cause the IoT ecosystem to collapse. In this paper, a lightweight VNA detection model named ML-LGBM is proposed. The work on the ML-LGBM model includes the development of a large VNA dataset, a feature extraction method, an LGBM algorithm and maximum parameter optimization. Results of extensive experiments demonstrate the advantages of the proposed ML-LGBM model based on several metrics, such as accuracy, precision, F-score, true negative rate and false-positive rate of 99.6%, 99%, 99.6%, 99.3% and 0.0093, respectively. Moreover, the proposed ML-LGBM model has slower execution time and less memory resource requirement of 140.217 seconds and 347,530 bytes, making it suitable for resource-constrained IoT devices.

A Systematic Literature Review on Machine and Deep Learning Approaches for Detecting Attacks in RPL-Based 6LoWPAN of Internet of Things

“…On the contrary, DL, a subset of ML, requires a vast quantity of data to train the system and takes a long time, but it usually gives higher accuracy [28,29]. In that sense, ML and DL are the most successful computational techniques for providing embedded intelligence in the IoT context due to their ability to deal with a tremendous amount of data, maximize feature engineering, learn from latent abnormal patterns, and reduce the time for detecting known and unknown attacks [30][31][32][33]. Thus, the ML and DL approaches improve the IoT security and RPL network in particular and overcome the weaknesses of other conventional solutions.…”

“…Osman et al [31] proposed a lightweight ML approach for detecting VN attacks in RPL-based IoT networks. The proposed approach, named ML-LGBM, used Gradient Boosting Machine for detecting the attacks.…”

“…• Challenge 1-Datasets Availability: This study discovered that most researchers use self-generated datasets from various simulation programs, either synthetic or real-time, to evaluate their approaches [7,47,48]. However, some researchers do use existing publicly available datasets [31,49], even though many of those datasets were based on traditional networks' traffic, which is different from the traffic of RPL-based 6LoWPAN networks [49]. Unfortunately, only a handful of researchers constructed datasets for RPL networks and made them available publicly [46,58,72].…”

DDoS Attacks Detection in the Application Layer Using Three Level Machine Learning Classification Architecture

“…A lightweight Version Number Attacks VNA detection model called ML-LGBM is suggested by Osman, M. et al [27]. The construction of a large VNA dataset, a feature extraction technique, an LGBM algorithm, and the highest parameter optimization are all part of the ML-LGBM model's effort.…”

STEER: Redes IoT Dirigidas por Intenções e Baseadas em SDN

“…Dentro desta vertente, as Self-driving Networks [Júnior et al 2021, Mai et al 2021, Jacobs et al 2018] têm ganhado grande notoriedade. Um elemento importante dessas abordagens refere-se ao uso de técnicas de aprendizado de máquina [Osman et al 2021] e de intenc ¸ões definidas pelo gerente da rede seguindo o conceito de Intent-Driven Networks [Davoli et al 2019]. O presente trabalho, contudo, emprega um algoritmo de tomada de decisão que age em tempo de execuc ¸ão à medida que coleta métricas da rede em tempo real.…”