Edge-IIoTset: A New Comprehensive Realistic Cyber Security Dataset of IoT and IIoT Applications for Centralized and Federated Learning

Federated learning (FL) is a machine learning technique where clients exchange only local model updates with a central server that combines them to create a global model after local training. While FL offers privacy benefits through local training, privacy-preserving strategies are needed since model updates can leak training data information due to various attacks. To enhance privacy and attack robustness, techniques like homomorphic encryption (HE), Secure Multi-Party Computation (SMPC), and the Private Aggregation of Teacher Ensembles (PATE) can be combined with FL. Currently, no study has combined more than two privacy-preserving techniques with FL or comparatively analyzed their combinations. We conducted a comparative study of privacy-preserving techniques in FL, analyzing performance and security. We implemented FL using an artificial neural network (ANN) with a Malware Dataset from Kaggle for malware detection. To enhance privacy, we proposed models combining FL with the PATE, SMPC, and HE. All models were evaluated against poisoning attacks (targeted and untargeted), a backdoor attack, a model inversion attack, and a man in the middle attack. The combined models maintained performance while improving attack robustness. FL_SMPC, FL_CKKS, and FL_CKKS_SMPC improved both their performance and attack resistance. All the combined models outperformed the base FL model against the evaluated attacks. FL_PATE_CKKS_SMPC achieved the lowest backdoor attack success rate (0.0920). FL_CKKS_SMPC best resisted untargeted poisoning attacks (0.0010 success rate). FL_CKKS and FL_CKKS_SMPC best defended against targeted poisoning attacks (0.0020 success rate). FL_PATE_SMPC best resisted model inversion attacks (19.267 MSE). FL_PATE_CKKS_SMPC best defended against man in the middle attacks with the lowest degradation in accuracy (1.68%), precision (1.94%), recall (1.68%), and the F1-score (1.64%).

A Detection and Prevention Technique for Man in the Middle Attack in Fog Computing

Smart home devices, also known as IoT devices, provide significant convenience; however, they also present opportunities for attackers to jeopardize homeowners’ security and privacy. Securing these IoT devices is a formidable challenge because of their limited computational resources. Machine learning-based intrusion detection systems (IDSs) have been implemented on the edge and the cloud; however, IDSs have not been embedded in IoT devices. To address this, we propose a novel machine learning-based two-layered IDS for smart home IoT devices, enhancing accuracy and computational efficiency. The first layer of the proposed IDS is deployed on a microcontroller-based smart thermostat, which uploads the data to a website hosted on a cloud server. The second layer of the IDS is deployed on the cloud side for classification of attacks. The proposed IDS can detect the threats with an accuracy of 99.50% at cloud level (multiclassification). For real-time testing, we implemented the Raspberry Pi 4-based adversary to generate a dataset for man-in-the-middle (MITM) and denial of service (DoS) attacks on smart thermostats. The results show that the XGBoost-based IDS detects MITM and DoS attacks in 3.51 ms on a smart thermostat with an accuracy of 97.59%.

Federated Learning (FL) enables cooperative model training across dispersed edge devices while protecting data privacy and providing localized insights without the need for centralized data aggregation. In the Internet of Things (IoT), federated learning enables cooperative model training among dispersed edge devices while protecting data privacy and providing localized insights without the need for centralized data aggregation. Nevertheless, Federated Learning’s local model sharing approach makes it susceptible to Man-in-the-Middle (MITM) attacks. In FL, attackers have the ability to manipulate local models. As a result, a global model produced from the altered local models may be inaccurate. In this paper, we suggest a blockchain-based FL architecture to prevent intermediaries from readily altering the FL parameters throughout the transmission process. All of the clients' parameters are combined by a cloud server, which is acting as the federated parameter server. By integrating blockchain technology into the overall architecture, we link all cloud and edge servers. This paper uses a PoC algorithm based on the SHA-256 hashing function in order to validate the data. The results and comparison analysis show that the suggested framework has a low false-positive rate and a high accuracy in detecting MITM attacks in their early stages, with a detection rate ranging from 98 to 100%.

Man in the middle (MITM) attacks can dramatically compromise the security of Wi-Fi network where an attacker eavesdrops and intercepts the communication medium over the wireless communication networks. This kind of attack aims to steal sensitive data such as credit card details, login accounts, and other important financial transactions. Even though that many detection techniques have been proposed to mitigate MITM attacks, however, this attack still occurs and causes tremendous damages. In this study, we propose a set of machine learning techniques to detect and identify MITM attacks on a wireless communication network. In addition, we evaluate and validate our approach based on the performance metrics, and compare the performance results with other machine learning techniques.

A cryptographic scheme is as strong as its underlying key exchange algorithm. In this paper we explored NTRU key exchange and found that it is exposed to Man In The Middle (MITM) attack. Similar vulnerability has been found in original Diffie-Hellman key exchange and prevented using Zero Knowledge Proof (ZKP). We applied ZKP scheme to solve the lattice based NTRU key exchange MITM and found that even with ZKP, NTRU scheme is still vulnerable to MITM attacks. Implementation results confirm this vulnerability of MITM attack in NTRU key exchange algorithm with ZKP.

Mobile Ad hoc NETworks (MANET) are a special kind of wireless net- works where there is neither centralized authority nor pre-existing infrastructure. Hence, in such situation, authenticating nodes becomes a challenging task. This is even more true that some nodes may be tempted by spoofing other nodes identity in order to gain some rights and privileges. In such context, a protocol based on keys exchange such as Diffie-Hellman can be used. However, even such protocol is vulnerable to impersonation attack e.g. the Man in the Middle (MIM) attack. The main objective of this work is then, to evaluate the impact of a MIM attack on the context of MANET and to propose a security solution to such situation. This is done by (1) estimating the needed ratio of attackers to achieve a MIM attack in a given MANET and (2) proposing a security process based on the well known Diffie-Helman protocol.

In this paper, an architectural framework for Web Service Security System that secures Web services effectively from message alteration attacks, Man-in-the Middle (MIM) attacks and Denial of Service (DoS) attacks has been proposed and implemented. This proposed system provides intelligent mechanisms for effective detection and preventions of message alteration attacks at message level, man-in-the middle attacks at transport level and denial of service attacks at application level. For this purpose, new approaches have been proposed for intelligent identification of the services requested by the user to the service provider. Moreover, new agents called requester agent and provider agent have been deployed for effective communication between the service requester and the service provider. An encryption mechanism and digital signature generation is incorporated to secure the Simple Object Access Protocol (SOAP) message over communication between the client and the server. The new approach proposed in this research work called Web Service Registration and Routing System and Inter Proxy Web Service that effectively prevents the message alteration attacks, Man-in-the Middle attacks and other types of attacks in order to secure Web service at message level. Also, new agents are such as requester agent and provider agent have been deployed at the client and server side respectively. These two agents are responsible for effective monitoring and controlling of various messages and attacks at the message level. In addition to this, a security token is created for each user request to verify the validity of the service provider and service requester for effective and secured communication. This system also provides a new approach for the intelligent prevention of Man-in-the Middle attack and Denial of Service attack in Web services.

Network security on internet of things (IoT) devices in the IoT development process may open rooms for hackers and other problems if not properly protected, particularly in the addition of internet connectivity to computing device systems that are interrelated in transferring data automatically over the network. This study implements network detection on IoT network security resembles security systems from man in the middle (MITM) attacks on blockchains. Security systems that exist on blockchains are decentralized and have peer to peer characteristics which are categorized into several parts based on the type of architecture that suits their use cases such as blockchain chain based and graph based. This study uses the principal component analysis (PCA) to extract features from the transaction data processing on the blockchain process and produces 9 features before the k-means algorithm with the elbow technique was used for classifying the types of MITM attacks on IoT networks and comparing the types of blockchain chain-based and graph-based architectures in the form of visualizations as well. Experimental results show 97.16% of normal data and 2.84% of MITM attack data were observed.

Secure web sites usually use HTTPS connection to secure transactions such as money transactions, online payment, and e-commerce. The use of HTTPS gives a sense of protection against attacks such as man in the middle (MITM) attack. This paper analyzes HTTPS connections against MITM by simulating real MITM attacks on different HTTPS connections such as Gmail, Yahoo Mail and Bank accounts. It was found that with the use of right tools, HTTPS connections can be broken and passwords can be sniffed and viewed in plain text. To prevent MITM against HTTPS in LAN environment a novel algorithm (DepMAC-IP) is proposed and discussed in detail. DepMAC-IP is expected to secure LAN environment not only against MITM but also against other similar attacks.

Network security on internet of things (IoT) devices in the IoT development process may open rooms for hackers and other problems if not properly protected, particularly in the addition of internet connectivity to computing device systems that are interrelated in transferring data automatically over the network. This study implements network detection on IoT network security resembles security systems from man in the middle (MITM) attacks on blockchains. Security systems that exist on blockchains are decentralized and have peer to peer characteristics which are categorized into several parts based on the type of architecture that suits their use cases such as blockchain chain based and graph based. This study uses the principal component analysis (PCA) to extract features from the transaction data processing on the blockchain process and produces 9 features before the k-means algorithm with the elbow technique was used for classifying the types of MITM attacks on IoT networks and comparing the types of blockchain chain-based and graph-based architectures in the form of visualizations as well. Experimental results show 97.16% of normal data and 2.84% of MITM attack data were observed.

All person wants secure communication of personal information in insecure communication media. A security enhancement is widely spread all over the world. A many modifications and new concepts have been done by the researchers and also left. This is required regular research in this field without any break. So a fast and secure encryption scheme is demanded by the user for stopping attacks. In this paper, the Diffie-Hellman Private ASCII Encryption (DH-PAE) method is introduced as a fast and secure encryption scheme in MANET. The proposed method DH-PAE is combined for achieving authentication and encryption scheme. The ASCII code of the candidate’s information is used in the algorithm to generate an encryption key and key exchange scheme presented by using the Diffie-Hellman method based on Man In The Middle (MITM) attack. The scheme of information hiding DH-PAE is explored in terms of ASCII codes of the candidate’s information, Diffie-Hellman private keys. The comparative effect displayed that DH-PAE is made better than AES, RSA, and 3DES on the bases of avalanche effect, cryptanalysis attacks, encryption time, and complete algorithm running time.

Cyber security of distribution power systems is of an increasing and pressing importance due to the fast modernisation of current systems. Cyber attacks on distribution power systems may aim to operate the system inefficiently, steal private smart meter data or cause intentional false tripping of few or all feeders. In this paper, a Man in The Middle (MiTM) attack on a power factor correction unit is implemented and demonstrated to overload a distribution feeder and cause an intentional false tripping of the entire feeder causing regional blackout. Experimental implementation of the attack is carried out in a laboratory-scale setup using commercial power equipment under different loading conditions to demonstrate the effectiveness of this attack.

The Address Resolution Protocol (ARP) takes the IP address and determines the corresponding MAC address through a broadcast reply mechanism. ARP poisoning can be done though a Man in the Middle (MITM) attack. In this paper, we present a trust based mechanism for addressing the problem of MITBM based ARP poisoning in a WLAN. The problem of ARP poisoning becomes acute in the wireless LAN environment due limited bandwidth, computation and memory, intermittent connectivity of nodes and the shared nature of the wireless broadcast channel. The resource constraints preclude employment of cryptographic primitives for authentication. The volatile connectivity and the possibility of continual arrival and departure from the networks makes manual configuration difficult. The proposed solution allows pairing of an IP address with multiple MAC addresses. This mapping prioritized according to an online trust mechanism. The implementation only requires the devices in the network to update their kernel with the modified ARP scheme. To determine the efficacy of the proposed method, it was implemented in FreeBSD kernel and tested for the successful prevention of MITM based ARP poisoning attack in a WLAN network.

Zero conf protocols date from 1999. They provide plug and play mechanisms to set up networks without having to conFigure DNS or DHCP servers. Almost every device (PCs, printers, scanners, etc.) nowadays “speaks” one of these protocols, sometimes without its owner being even aware of it. The booming IoT ecosystem, in particular, relies heavily on them. Unfortunately, these protocols offer a number of different ways to run, so called, man in the middle attacks (MITM). Some previous publications have mentioned and have taken advantage of one or another of these design flaws. In this paper, we provide a deep dive into the various issues at hand and show the extent of the problem. We consider that the growing reliance of networks on these protocols represent an underestimated and ill covered threat. We have run a number of experiments (300) to test various implementations and discuss our results. We also propose means to detect these attacks thanks to Zeek (aka Bro). We make the attack code as well as the Zeek scripts available to the research community in a format that makes replication of our results possible by researchers while not easy to use by script kiddies.