READ-IoT: Reliable Event and Anomaly Detection Framework for the Internet of Things

Abstract

Internet of Things (IoT) enables a myriad of applications by interconnecting software to physical objects. The objects range from wireless sensors to robots and include surveillance cameras. The applications are often critical (e.g. physical intrusion detection, fire fighting) and latency-sensitive. On the one hand, such applications rely on specific protocols (e.g. MQTT, COAP) and the network to communicate with the objects under very tight timeframe. On the other hand, anomalies (e.g. communication noise, sensors' failures, security attacks) are likely to occur in open IoT systems and can result by sending false alerts or the failure to properly detect critical events. To address that, IoT systems have to be equipped with anomaly detection processing in addition to the required event detection capability. This is a key feature that enables reliability and efficiency in IoT. However, anomaly detection systems can be themselves object of failures and attacks, and then can easily fall short to accomplish their mission. This paper introduces a Reliable Event and Anomaly Detection Framework for the Internet of Things (READ-IoT for short). The designed framework integrates events and anomalies detection into a single and common system that centralizes the management of both concepts. To enforce its reliability, the system relies on a reputationaware provisioning of detection capabilities that takes into account the vulnerability of the deployment hosts. As for validation, READ-IoT was implemented and evaluated using two real life applications, i.e. a fire detection and an unauthorized person detection applications. Several scenarios of anomalies and events were conducted using NSL-KDD public dataset, as well as, generated data to simulate routing attacks. The obtained results and performance measurements show the efficiency of READ-IoT in terms of event detection accuracy and real-time processing.

Monitoring Real Time Security Attacks for IoT Systems Using DevSecOps: A Systematic Literature Review

“…Various public network datasets, for example, KDDCUP99, NSLKDD, and UNSW-NB15, have been generated to evaluate IDSs; however, they do not contain any specific characteristics of IoT systems [72]. The NSL-KDD dataset was built from the KDDCUPP99 datasets [73]. The KDDCUP99 dataset contains a large number of duplicate records that were removed in the NSL-KDD dataset [73].…”

“…The NSL-KDD dataset was built from the KDDCUPP99 datasets [73]. The KDDCUP99 dataset contains a large number of duplicate records that were removed in the NSL-KDD dataset [73]. UNSW-NB15 is different from other datasets such as KDDCUPP99, which has fewer features [74].…”

“…These attacks include backdoors, fuzzers, analysis, exploits, generic, reconnaissance, shellcode, worms, and DoS. KDDCUP99, used in five primary studies, was generated by DARPA [73]. This dataset contains around 5 million samples of network captured packets.…”

The 3-Axis Scalable Service-Cloud Resource Modeling for Burst Prediction Under Smart Campus Scenario

“…The authors in [9] discussed IoT-based smart systems for attendance, lecture quality feedback, and smart classroom management. Some other IoT applications are smart agriculture, smart transport system, smart healthcare system, and many more [10].…”

Efficient Anomaly Detection for Smart Hospital IoT Systems

“…Meanwhile, the sensors, like patients' wearable sensors and environment's temperature sensors, are resource-constrained. From the processing side, SVM (Support Vector Machines) algorithm is used as detection technique for its high detection accuracy and optimized execution time [14,15]. Other algorithms could be used and deployed but finding the best algorithms is out of the scope of this work.…”