Towards Near-Real-Time Intrusion Detection for IoT Devices using Supervised Learning and Apache Spark

Abstract

In the fields of Internet of Things (IoT) infrastructures, attack and anomaly detection are rising concerns. With the increased use of IoT infrastructure in every domain, threats and attacks in these infrastructures are also growing proportionally. In this paper the performances of several machine learning algorithms in identifying cyber-attacks (namely SYN-DOS attacks) to IoT systems are compared both in terms of application performances, and in training/application times. We use supervised machine learning algorithms included in the MLlib library of Apache Spark, a fast and general engine for big data processing. We show the implementation details and the performance of those algorithms on public datasets using a training set of up to 2 million instances. We adopt a Cloud environment, emphasizing the importance of the scalability and of the elasticity of use. Results show that all the Spark algorithms used result in a very good identification accuracy (>99%). Overall, one of them, Random Forest, achieves an accuracy of 1. We also report a very short training time (23.22 sec for Decision Tree with 2 million rows). The experiments also show a very low application time (0.13 sec for over than 600,000 instances for Random Forest) using Apache Spark in the Cloud. Furthermore, the explicit model generated by Random Forest is very easy-to-implement using high- or low-level programming languages. In light of the results obtained, both in terms of computation times and identification performance, a hybrid approach for the detection of SYN-DOS cyber-attacks on IoT devices is proposed: the application of an explicit Random Forest model, implemented directly on the IoT device, along with a second level analysis (training) performed in the Cloud.

Intrusion Detection System for IOT Botnet Attacks Using Deep Learning

“…Different machine learning algorithms are used for intrusion detection in smart environments [21][22][23]. The authors presented various machine learning algorithms to predict IoT attacks using one of the recent datasets-BoT-IoT.…”

A Novel Hybrid Intrusion Detection System (IDS) for the Detection of Internet of Things (IoT) Network Attacks

“…Near-real-time IDS system IoT networks by using Apache spark and supervised learning was proposed in [18]. In this paper, various machine learning algorithms were discussed identifying the cyber-attacks IoT system and compared these algorithms based on their performance measures.…”

“…The RDTIDS system comprises the various classifier methods based on rules-based concepts and decision tree named as JRip algorithm, REP tree, and Forest PA. Similarly, PCA algorithm is used in [18] where the research introduced the ultrahigh-frequency RFID sensor system for characterization and corrosion detection. The 3-D antenna sensor was used for feature selection.…”

UIP2SOP: A Unique IoT Network applying Single Sign-On and Message Queue Protocol

“…The Internet of Thing (IoT) services/applications grown and play a vital role in our life such services/applications have applied in most fields such as smart cities, healthcare, supply chains, industry, and agriculture. In fact, by 2025, the whole world have approximately 75.44 billion IoT-connected devices [1], [2]. However, these devices is own by the different individuals or organizations, its characteristic (e.g., capacity, communication, compuation ability) is totally different.…”