Rapid: Robust and Adaptive Detection of Distributed Denial-of-Service Traffic from the Internet of Things

Mergendahl, Samuel; Li, Jun

doi:10.1109/cns48642.2020.9162278

“…IoTrelated Objective [19] Identify DDoS attacks as soon as they are launched from IoT devices that were recruited to a botnet [20] Create an IoT anomaly detection service [29] Create an anomaly detection IoT system for smart cities [30] Review machine learning (ML) and deep learning (DL) based intrusion detection systems (IDSs) used in IoT settings [31] Overcome certain limitations of the Density-Based Spatial Clustering of Applications with Noise (DBSCAN) algorithm [32] Compare several ML algorithms for attack and anomaly detection in IoT systems [33] Create an IDS for low-powered and resource-constrained IoT devices, using unsupervised learning [34] Create a real-time, self-training, easily deployed, anomaly-based DDoS detection system for IoT networks [35] Detect compromised IoT devices without sharing data [36] Improve the effectiveness of traditional ML IDSs on low-frequency attacks in high-dimensional networks [37] Propose a federated-based approach for the detection of botnet attacks, using on-device decentralized traffic data [38] Create an anomaly detector for IoT network communication [39] Create a DL-based botnet attack detector for compromised IoT devices [40] Create a software-defined network (SDN) based security mechanism to detect and mitigate DDoS attacks on IoT networks [41] Detect cyber-attacks based on user behavior [42] Create an anomaly-based DDoS attack detector, using autoencoders (AEs)…”

Section: Refmentioning

confidence: 99%

“…Collaborative Data [32] Random forest [33] OPTICS (Ordering Points to Identify the Clustering Structure) Collaborative Data [34] ARIMA (Autoregressive Integrated Moving Average), MLP (Multilayer Perceptron), LSTM (Long Short-Term Memory)…”

Section: B Algorithmic Complexity and Flowmentioning

confidence: 99%

“…Of those that are publicly available, in some cases the research addresses IoT anomaly or attack detection but uses non-IoT data for evaluation [31]. The data of other datasets was captured in a period of just minutes [34] or hours [20], [32]. Other studies used data which is simulated [36], synthetic [31], or generated in a lab [19], [33], [39], sometimes using Raspberry PIs [53] instead of real IoT devices.…”

Section: Existing Public Datasets For Iot Attack Detectionmentioning

confidence: 99%

See 1 more Smart Citation

CADeSH: Collaborative Anomaly Detection for Smart Homes

Avraham

¹

,

Libhaber

²

,

Shabtai

³

2023

IEEE Internet Things J.

View full text Add to dashboard Cite

Although home IoT (Internet of Things) devices are typically plain and task oriented, the context of their daily use may affect their traffic patterns. That is, a given IoT device will probably not generate the exact same traffic data when operated by different people in different environments and when connected to different networks with different topologies and communication components. For this reason, anomaly-based intrusion detection systems tend to suffer from a high false positive rate (FPR). To overcome this, we propose a two-step collaborative anomaly detection method which first uses an autoencoder to differentiate frequent ('benign') and infrequent (possibly 'malicious') traffic flows. Clustering is then used to analyze only the infrequent flows and classify them as either known ('rare yet benign') or unknown ('malicious'). Our method is collaborative, in that (1) normal behaviors are characterized more robustly, as they take into account a variety of user interactions and network topologies, and (2) several features are computed based on a pool of identical devices rather than just the inspected device.We evaluated our method empirically, using 21 days of real-world traffic data that emanated from eight identical IoT devices deployed on various networks, one of which was located in our controlled lab where we implemented two popular IoT-related cyber-attacks. Our collaborative anomaly detection method achieved a macro-average area under the precision-recall curve of 0.841, an F1 score of 0.929, and an FPR of only 0.014. These promising results were obtained by using labeled traffic data from our lab as the test set, while training the models on the traffic of devices deployed outside the lab, and thus demonstrate a high level of generalizability. In addition to its high generalizability and promising performance, our proposed method also offers benefits such as privacy preservation, resource savings, and model poisoning mitigation. On top of that, as a contribution to the scientific community, our novel dataset is available online.

show abstract

“…IoTrelated Objective [19] Identify DDoS attacks as soon as they are launched from IoT devices that were recruited to a botnet [20] Create an IoT anomaly detection service [29] Create an anomaly detection IoT system for smart cities [30] Review machine learning (ML) and deep learning (DL) based intrusion detection systems (IDSs) used in IoT settings [31] Overcome certain limitations of the Density-Based Spatial Clustering of Applications with Noise (DBSCAN) algorithm [32] Compare several ML algorithms for attack and anomaly detection in IoT systems [33] Create an IDS for low-powered and resource-constrained IoT devices, using unsupervised learning [34] Create a real-time, self-training, easily deployed, anomaly-based DDoS detection system for IoT networks [35] Detect compromised IoT devices without sharing data [36] Improve the effectiveness of traditional ML IDSs on low-frequency attacks in high-dimensional networks [37] Propose a federated-based approach for the detection of botnet attacks, using on-device decentralized traffic data [38] Create an anomaly detector for IoT network communication [39] Create a DL-based botnet attack detector for compromised IoT devices [40] Create a software-defined network (SDN) based security mechanism to detect and mitigate DDoS attacks on IoT networks [41] Detect cyber-attacks based on user behavior [42] Create an anomaly-based DDoS attack detector, using autoencoders (AEs)…”

Section: Refmentioning

confidence: 99%

CADeSH Dataset: Collaborative Anomaly Detection for Smart Homes

Meidan,

Avraham,

Libhaber

et al. 2022

0

View full text Add to dashboard Cite

Although home IoT (Internet of Things) devices are typically plain and task oriented, the context of their daily use may affect their traffic patterns. That is, a given IoT device will probably not generate the exact same traffic data when operated by different people in different environments and when connected to different networks with different topologies and communication components. For this reason, anomaly-based intrusion detection systems tend to suffer from a high false positive rate (FPR). To overcome this, we propose a two-step collaborative anomaly detection method which first uses an autoencoder to differentiate frequent ('benign') and infrequent (possibly 'malicious') traffic flows. Clustering is then used to analyze only the infrequent flows and classify them as either known ('rare yet benign') or unknown ('malicious'). Our method is collaborative, in that (1) normal behaviors are characterized more robustly, as they take into account a variety of user interactions and network topologies, and (2) several features are computed based on a pool of identical devices rather than just the inspected device.We evaluated our method empirically, using 21 days of real-world traffic data that emanated from eight identical IoT devices deployed on various networks, one of which was located in our controlled lab where we implemented two popular IoT-related cyber-attacks. Our collaborative anomaly detection method achieved a macro-average area under the precision-recall curve of 0.841, an F1 score of 0.929, and an FPR of only 0.014. These promising results were obtained by using labeled traffic data from our lab as the test set, while training the models on the traffic of devices deployed outside the lab, and thus demonstrate a high level of generalizability. In addition to its high generalizability and promising performance, our proposed method also offers benefits such as privacy preservation, resource savings, and model poisoning mitigation. On top of that, as a contribution to the scientific community, our novel dataset is available online.

show abstract

“…Firstly, we implemented a Multilayer Perceptron (MLP), which is a feed-forward Neural Network and consists of an input, hidden, and an output layer. It has frequently been used for network anomaly detection [11,[51][52][53][54]. Autoencoders (A.E.)…”

Section: Deep Learning Classifiers For Sequential Datamentioning

confidence: 99%

Models versus Datasets: Reducing Bias through Building a Comprehensive IDS Benchmark

Ahmad

¹

,

Alsmadi

²

,

Al-Hamdani

³

et al. 2021

Future Internet

3

0

View full text Add to dashboard Cite

Today, deep learning approaches are widely used to build Intrusion Detection Systems for securing IoT environments. However, the models’ hidden and complex nature raises various concerns, such as trusting the model output and understanding why the model made certain decisions. Researchers generally publish their proposed model’s settings and performance results based on a specific dataset and a classification model but do not report the proposed model’s output and findings. Similarly, many researchers suggest an IDS solution by focusing only on a single benchmark dataset and classifier. Such solutions are prone to generating inaccurate and biased results. This paper overcomes these limitations in previous work by analyzing various benchmark datasets and various individual and hybrid deep learning classifiers towards finding the best IDS solution for IoT that is efficient, lightweight, and comprehensive in detecting network anomalies. We also showed the model’s localized predictions and analyzed the top contributing features impacting the global performance of deep learning models. This paper aims to extract the aggregate knowledge from various datasets and classifiers and analyze the commonalities to avoid any possible bias in results and increase the trust and transparency of deep learning models. We believe this paper’s findings will help future researchers build a comprehensive IDS based on well-performing classifiers and utilize the aggregated knowledge and the minimum set of significantly contributing features.

show abstract

Rapid: Robust and Adaptive Detection of Distributed Denial-of-Service Traffic from the Internet of Things

Cited by 9 publications

References 26 publications

CADeSH: Collaborative Anomaly Detection for Smart Homes

CADeSH: Collaborative Anomaly Detection for Smart Homes

CADeSH Dataset: Collaborative Anomaly Detection for Smart Homes

Models versus Datasets: Reducing Bias through Building a Comprehensive IDS Benchmark

Contact Info

Product

Resources

About