CoLL-IoT: A Collaborative Intruder Detection System for Internet of Things Devices

Hani Mohammed Alshahrani

doi:10.3390/electronics10070848

Abstract

The Internet of Things (IoT) and its applications are becoming popular among many users nowadays, as it makes their life easier. Because of its popularity, attacks that target these devices have increased dramatically, which might cause the entire system to be unavailable. Some of these attacks are denial of service attack, sybil attack, man in the middle attack, and replay attack. Therefore, as the attacks have increased, the detection solutions to detect malware in the IoT have also increased. Most of the current solutions often have very serious limitations, and malware is becoming more apt in taking advantage of them. Therefore, it is important to develop a tool to overcome the existing limitations of current detection systems. This paper presents CoLL-IoT, a CoLLaborative intruder detection system that detects malicious activities in IoT devices. CoLL-IoT consists of the following four main layers: IoT layer, network layer, fog layer, and cloud layer. All of the layers work collaboratively by monitoring and analyzing all of the network traffic generated and received by IoT devices. CoLL-IoT brings the detection system close to the IoT devices by taking the advantage of edge computing and fog computing paradigms. The proposed system was evaluated on the UNSW-NB15 dataset that has more than 175,000 records and achieved an accuracy of up to 98% with low type II error rate of 0.01. The evaluation results showed that CoLL-IoT outperformed the other existing tools, such as Dendron, which was also evaluated on the UNSW-NB15 dataset.

Highlights

The Internet of Things (IoT) was introduced for the first time by the British scientist Kevin Ashton in 1999, where he described a system that would allow physical objects to be connected to the Internet via many sensors [1]
The lowest accuracy for CoLL-IoT was achieved by the logistic regression (LR) algorithm using the top features that were selected by the chi-square algorithm
Kasongo and Sun [13] evaluated their intrusion detection system on the UNSW-NB15 dataset by using different machine learning algorithms, as follows: support vector machine (SVM), K-nearest neighbors (K-NN), LR, artificial neural network (ANN), and decision tree (DT)

Summary

Introduction

The Internet of Things (IoT) was introduced for the first time by the British scientist Kevin Ashton in 1999, where he described a system that would allow physical objects to be connected to the Internet via many sensors [1]. IoT devices collect data by using some devices, such as sensors and radiofrequency identification (RFID) tags, for a special event or environment to provide an intelligent solution for different challenges. This has become possible because of the rapid development of technologies, such as cloud computing, advanced data analysis algorithms, and wireless communication [1]. The general architecture of the IoT consists of four layers, namely the perception layer, the network layer, the processing layer, and the application layer, as shown in Figure 1 [2]. The top layer in the IoT architecture is the application layer.

Objectives

Methods

Results

Discussion

Conclusion