SUKRY: Suricata IDS with Enhanced kNN Algorithm on Raspberry Pi for Classifying IoT Botnet Attacks

Abstract

The focus of this research is the application of the k-Nearest Neighbor algorithm in terms of classifying botnet attacks in the IoT environment. The kNN algorithm has several advantages in classification tasks, such as simplicity, effectiveness, and robustness. However, it does not perform well in handling large datasets such as the Bot-IoT dataset, which represents a huge amount of data about botnet attacks on IoT networks. Therefore, improving the kNN performance in classifying IoT botnet attacks is the main concern in this study by applying several feature selection techniques. The whole research process was conducted in the Rapidminer environment using three prebuilt feature selection techniques, namely, Information Gain, Forward Selection, and Backward Elimination. After comparing accuracy, precision, recall, F1 score and processing time, the combination of the kNN algorithm and the Forward Selection technique (kNN-FS) achieves the best results among others, with the highest level of accuracy and the fastest execution time among others. Finally, kNN-FS is used in developing SUKRY, which stands for Suricata IDS with Enhanced kNN Algorithm on Raspberry Pi.

Insights into Modern Intrusion Detection Strategies for Internet of Things Ecosystems

“…• Data characteristics and dimensions: The complexity of managing network traffic data is heightened due to its high-dimensional features and the extensive number of access points within Internet-connected services [26]. In addition, the categorization of botnet intrusions in IoT networks through the KNN algorithm becomes particularly difficult when confronted with voluminous datasets [27]. In the same vein, the prevalence of class imbalance within IoT IDS adversely impacts the efficiency and accuracy of ML models that are developed based on these skewed datasets [28]; • Security vulnerabilities and attacks: Addressing IoT networks' security vulnerabilities and attacks is inherently challenging, especially those that incorporate cloud technologies, as they are prone to various attacks [29].…”

“…Syamsuddin and Barukab [27] improved the KNN algorithm for IoT botnet attack classification by selecting optimal features through a technique named SUKRY, which is part of a Suricata-based IDS. They employed data preprocessing, feature selection, and anomaly classification with KNN.…”

“…BoT-IoT dataset: This dataset was created by simulating a real IoT network in UNSW Canberra's Cyber Range Lab used for testing IoT-focused IDS. It has both normal and botnet traffic with 46 features covering different IoT devices, communication protocols, and attack types such as DDoS, DoS, OS and Service Scan, Keylogging and Data exfiltration [27,28,40,59,67,72,75,92].…”

Cybersecurity: BotNet Threat Detection Across the Seven-Layer ISO-OSI Model Using Machine Learning Techniques

“…The features of its backdoor make it possible for additional instructions and functions to be carried out on a machine that has been hacked. Among these operations include verifying the current condition of the infection, removing the bot from IRC [16], coming up with a random username, sending ping attacks, forcing a bot to join a channel, carrying out SYN flood or DDoS attacks, and a great deal more. In the same year, Agobot revealed the concept of a modular staged attack.…”

An Efficient GNSS Coordinate Classification Strategy with an Adaptive KNN Algorithm for Epidemic Management

“…The classification of geographic areas based on the latitude and longitude coordinates provided by GNSS is a novel research topic [23,24]. KNN represents a conceptual approach to classification (or prediction) that extends into new research areas, as seen in recent studies [32][33][34], which apply KNN in various domains. Our research aligns with this trend.…”