IoT Attacks Research Articles

Detection IoT attacks using Lasso regression algorithm with ensemble classifier

Purpose Internet of Things (IoT) is a network, which provides the connection with various physical objects such as smart machines, smart home appliance and so on. The physical objects are allocated with a unique internet address, namely, Internet Protocol, which is used to perform the data broadcasting with the external objects using the internet. The sudden increment in the number of attacks generated by intruders, causes security-related problems in IoT devices while performing the communication. The main purpose of this paper is to develop an effective attack detection to enhance the robustness against the attackers in IoT. Design/methodology/approach In this research, the lasso regression algorithm is proposed along with ensemble classifier for identifying the IoT attacks. The lasso algorithm is used for the process of feature selection that modeled fewer parameters for the sparse models. The type of regression is analyzed for showing higher levels when certain parts of model selection is needed for parameter elimination. The lasso regression obtains the subset for predictors to lower the prediction error with respect to the quantitative response variable. The lasso does not impose a constraint for modeling the parameters caused the coefficients with some variables shrink as zero. The selected features are classified by using an ensemble classifier, that is important for linear and nonlinear types of data in the dataset, and the models are combined for handling these data types. Findings The lasso regression with ensemble classifier–based attack classification comprises distributed denial-of-service and Mirai botnet attacks which achieved an improved accuracy of 99.981% than the conventional deep neural network (DNN) methods. Originality/value Here, an efficient lasso regression algorithm is developed for extracting the features to perform the network anomaly detection using ensemble classifier.

D-Score: An expert-based method for assessing the detectability of IoT-related cyber-attacks

IoT devices are known to be vulnerable to various cyber-attacks, such as data exfiltration and the execution of flooding attacks as part of a DDoS attack. When it comes to detecting such attacks using network traffic analysis, it has been shown that some attack scenarios are not always equally easy to detect if they involve different IoT models. That is, when targeted at some IoT models, a given attack can be detected rather accurately, while when targeted at others the same attack may result in too many false alarms. In this research, we attempt to explain this variability of IoT attack detectability and devise a risk assessment method capable of addressing a key question: how easy is it for an anomaly-based network intrusion detection system to detect a given cyber-attack involving a specific IoT model? In the process of addressing this question we (a) investigate the predictability of IoT network traffic, (b) present a novel taxonomy for IoT attack detection which also encapsulates traffic predictability aspects, (c) propose an expert-based attack detectability estimation method which uses this taxonomy to derive a detectability score (termed ‘D-Score’) for a given combination of IoT model and attack scenario, and (d) empirically evaluate our method while comparing it with a data-driven method.

A lightweight IoT firmware vulnerability detection scheme based on homology detection

In recent years, with the rapid development of IoT technology, hundreds of millions of IoT devices have been manufactured and applied, and the subsequent IoT attacks have become more and more severe. The complex and diverse architecture of IoT devices, coupled with the lack of security development specifications by IoT device manufacturers, and the widespread misuse and abuse of code, lead to the proliferation of IoT vulnerabilities. The conventional IoT vulnerability detection scheme is expensive to operate, and the implementation technology is complex, which is difficult to be fully promoted. This paper proposes a lightweight IoT firmware vulnerability detection scheme based on homology detection. The processing is converted into a feature vector, which effectively reduces the platform dependence. Combined with the database technology, the storage and retrieval efficiency is increased, and the same-origin vulnerability detection is realized by calculating the cosine similarity of the vector. The experimental results show that this scheme can effectively identify the vulnerabilities in firmware.

IoT Attack Detection and Mitigation with Optimized Deep Learning Techniques

The high count of IoT device and poorer security are extremely probable to be snatched that resulted in DDOS attacks. By depleting the node battery or disrupting the signal, this assault taints the network’s overall accessibility or the accessibility of specific nodes. This article introduces a DL-oriented approach to recognize such attacks and mitigate them. This article proposes a new, four-stage assault detection system for IOT. Data normalization is initially carried out during pre-processing. Then, “enhanced Recursive Feature Elimination (RFE), and improved second order technical indicator based features (ATR, CMF, CTI, and improved EMA) are extracted,” along with “higher order statistical features (kurtosis, variance, skewness). The best features were also chosen using the CMIHBO method. The existence of attacks is then determined by averaging the outputs of a group of classifiers, including “Recurrent Neural Network (RNN), Bidirectional Gated Recurrent Unit (BI-GRU), and Bidirectional Long Short-Term Memory (BI-LSTM).” With Cat and Mouse Integrated HBO, the Bi-LSTM weights in particular are calibrated to perfection (CMIHBO). “Recommended BAIT focused mitigation” is applied to eliminate the offender nodes from the networks if an incident is discovered. In the end, many measures are established to improve the deployed approach.

Invalidation of tunnelling attacks in ubiquitous IoT & wireless sensor enviroment using ML methods

Wireless sensors are interconnected are is ubiquitous in nature and provides great advantage are normally constituting perfect communication on wireless networks like infrastructure and Ad Hoc. The wireless connected devices environment can also be created using Internet of Things and also it can be adhoc. These wireless sensors are installed in the military campus to collect information movement of people, sound, capturing pictures of their activities. These kinds of sensors can be used in most secured places, where there is a need of remote monitoring of the security. It can be either used in atomic power stations or military camps. Based on the same, Ad Hoc networks attract great attention because data obstruction is made in communication interval. The communication interval helps to improve the mobile node convenience, node mobility, scalability and network cost. Perhaps, due the overload in data packet transmission, the routing makes the packet blockage between the nodes. Mobile nodes are always roaming around the particular region for supervise the external conditions or surroundings characteristics in order to accumulates the selective information about alive nodes and its communication route. On certain occasions these communication routes are vulnerable to various attacks due to functionality and deployment scenario, especially wormhole attack. This is an Ad Hoc assembling of mobile nodes that can randomly alter their route with respect to the constrained resources such as bandwidth, energy, security and resource discovery. Based on the above resources wormhole nodes create the fraudulent route within the network; the fraudulent route can confuse routing mechanisms which creates the tunnel between nodes. In order to invalidate the wormhole attacks in the route within the network, this research article proposed the “Train and Avoiding” process. The train and avoid process is the machine learning algorithm to find the optimal route where there are no attacks in the route. The process trains the routing to perform network traffic analysis. In addition to this, avoiding process helps to restrict the packets modification as well as fake route creation. Proposed Train and Avoiding based route Selection is used to achieve more prominent reliable routing. It improves PDR, average lifetime of network and minimizes communication issues, and average delay.

Effective Internet of Things botnet classification by data upsampling using generative adversarial network and scale fused bidirectional long short term memory attention model

SummaryInternet of Things (IoT) botnet attacks are considered an important risk to information security. This work mainly focusing on botnet attack detection targeting various IoT devices. In this work, feature generation and classification are the two major processes considered for attack detection. Generative adversarial network (GAN) is applied for the feature generation process. GAN has generator and discriminator. Here effective generator network is introduced by applying added convolution layers with batch normalization and rectified linear unit activation function. In this proposed system, a novel network called the data perception network is proposed with scale fused architecture. The data perception network is developed to determine generator's efficiency in generating fake data similar to original data. This perception network is also considered for estimating loss function by analyzing in different scales. Hence, the major strength of this network is that highly reliable data are provided using the synthesized data. An efficient network architecture called scale fused bidirectional long short term memory attention model (SFBAM) is applied for the classification process. The proposed model is evaluated using the IoT‐23 dataset, which can differentiate between benign and malicious data in IoT attacks. Compared to existing models, this proposed model provides effective results by improving accuracy and reducing loss.

Deep Ensemble Model for Detecting Attacks in Industrial IoT

In this research work, a novel IIoT attack detection framework is designed by following four major phases: pre-processing, imbalance processing, feature extraction, and attack detection. The attack detection is carried out using the projected ensemble classification framework. The projected ensemble classification framework encapsulates the recurrent neural network, CNN, and optimized bi-directional long short-term memory (BI-LSTM). The RNN and CNN in the ensemble classification framework is trained with the extracted features. The outcome acquired from RNN and CNN is utilized for training the optimized BI-LSTM model. The final outcome regarding the presence/absence of attacks in the industrial IoT is portrayed by the optimized BI-LSTM model. Therefore, the weight of BI-LSTM model is fine-tuned using the newly projected hybrid optimization model referred as cat mouse updated slime mould algorithm (CMUSMA). The projected hybrids the concepts of both the standard slime mould algorithm (SMA) and cat and mouse-based optimizer(CMBO), respectively.

Using Machine Learning for Dynamic Authentication in Telehealth: A Tutorial.

Telehealth systems have evolved into more prevalent services that can serve people in remote locations and at their homes via smart devices and 5G systems. Protecting the privacy and security of users is crucial in such online systems. Although there are many protocols to provide security through strong authentication systems, sophisticated IoT attacks are becoming more prevalent. Using machine learning to handle biometric information or physical layer features is key to addressing authentication problems for human and IoT devices, respectively. This tutorial discusses machine learning applications to propose robust authentication protocols. Since machine learning methods are trained based on hidden concepts in biometric and physical layer data, these dynamic authentication models can be more reliable than traditional methods. The main advantage of these methods is that the behavioral traits of humans and devices are tough to counterfeit. Furthermore, machine learning facilitates continuous and context-aware authentication.

Comparison of IoT Communication Protocols Using Anomaly Detection with Security Assessments of Smart Devices

The authors implemented an attack scenario that involved simulating attacks to compromise node and sensor data. This research proposes a framework with algorithms that generates automated malicious commands which conform to device protocol standards and bypass compromise detection. The authors performed attack-detection testing with three different home setup simulations and referred to Accuracy of Detection, Ease of Precision, and Attack Recall, with the F1-Score as the parameter. The results obtained for anomaly detection of IoT logs and messages used K-Nearest Neighbor, Multilayer Perceptron, Logistic Regression, Random Forest, and linear Support Vector Classifier models. The attack results presented false-positive responses with and without the proposed framework and false-negative responses for different models. This research calculated Precision, Accuracy, F1-Score, and Recall as attack-detection performance models. Finally, the authors evaluated the performance of the proposed IoT communication protocol attack framework by evaluating a range of anomalies and compared them with the maliciously generated log messages. IoT Home #1 results in which the model involving an IP Camera and NAS device traffic displayed 97.7% Accuracy, 96.54% Precision, 97.29% Recall, and 96.88% F1-Score. This demonstrated that the model classified the Home #1 dataset consistently.

A Trust-Based Model for Secure Routing against RPL Attacks in Internet of Things.

In IoT networks, the de facto Routing Protocol for Low Power and Lossy Networks (RPL) is vulnerable to various attacks. Routing attacks in RPL-based IoT are becoming critical with the increase in the number of IoT applications and devices globally. To address routing attacks in RPL-based IoT, several security solutions have been proposed in literature, such as machine learning techniques, intrusion detection systems, and trust-based approaches. Studies show that trust-based security for IoT is feasible due to its simple integration and resource-constrained nature of smart devices. Existing trust-based solutions have insufficient consideration of nodes’ mobility and are not evaluated for dynamic scenarios to satisfy the requirements of smart applications. This research work addresses the Rank and Blackhole attacks in RPL considering the static as well as mobile nodes in IoT. The proposed Security, Mobility, and Trust-based model (SMTrust) relies on carefully chosen trust factors and metrics, including mobility-based metrics. The evaluation of the proposed model through simulation experiments shows that SMTrust performs better than the existing trust-based methods for securing RPL. The improvisation in terms of topology stability is 46%, reduction in packet loss rate is 45%, and 35% increase in throughput, with only 2.3% increase in average power consumption.

Time- and Amplitude-Controlled Power Noise Generator against SPA Attacks for FPGA-Based IoT Devices

Power noise generation for masking power traces is a powerful countermeasure against Simple Power Analysis (SPA), and it has also been used against Differential Power Analysis (DPA) or Correlation Power Analysis (CPA) in the case of cryptographic circuits. This technique makes use of power consumption generators as basic modules, which are usually based on ring oscillators when implemented on FPGAs. These modules can be used to generate power noise and to also extract digital signatures through the power side channel for Intellectual Property (IP) protection purposes. In this paper, a new power consumption generator, named Xored High Consuming Module (XHCM), is proposed. XHCM improves, when compared to others proposals in the literature, the amount of current consumption per LUT when implemented on FPGAs. Experimental results show that these modules can achieve current increments in the range from 2.4 mA (with only 16 LUTs on Artix-7 devices with a power consumption density of 0.75 mW/LUT when using a single HCM) to 11.1 mA (with 67 LUTs when using 8 XHCMs, with a power consumption density of 0.83 mW/LUT). Moreover, a version controlled by Pulse-Width Modulation (PWM) has been developed, named PWM-XHCM, which is, as XHCM, suitable for power watermarking. In order to build countermeasures against SPA attacks, a multi-level XHCM (ML-XHCM) is also presented, which is capable of generating different power consumption levels with minimal area overhead (27 six-input LUTS for generating 16 different amplitude levels on Artix-7 devices). Finally, a randomized version, named RML-XHCM, has also been developed using two True Random Number Generators (TRNGs) to generate current consumption peaks with random amplitudes at random times. RML-XHCM requires less than 150 LUTs on Artix-7 devices. Taking into account these characteristics, two main contributions have been carried out in this article: first, XHCM and PWM-XHCM provide an efficient power consumption generator for extracting digital signatures through the power side channel, and on the other hand, ML-XHCM and RML-XHCM are powerful tools for the protection of processing units against SPA attacks in IoT devices implemented on FPGAs.

MOCA: A Network Intrusion Monitoring and Classification System

Optimizing the monitoring of network traffic features to detect abnormal traffic is critical. We propose a two-stage monitoring and classification (MOCA) system requiring fewer features to detect and classify malicious network attacks. The first stage monitors abnormal traffic, and the anomalous traffic is forwarded for processing in the second stage. A small subset of features trains both classifiers. We demonstrate MOCA’s effectiveness in identifying attacks in the CICIDS2017 dataset with an accuracy of 99.84% and in the CICDDOS2019 dataset with an accuracy of 93%, which significantly outperforms previous methods. We also found that MOCA can use a pre-trained classifier with one feature to distinguish DDoS and Botnet attacks from normal traffic in four different datasets. Our measurements show that MOCA can distinguish DDoS attacks from normal traffic in the CICDDOS2019 dataset with an accuracy of 96% and DDoS attacks in non-IoT and IoT traffic with an accuracy of 99.94%. The results emphasize the importance of using connection features to discriminate new DDoS and Bot attacks from benign traffic, especially with insufficient training samples.

Detection of Distributed Denial of Service (DDoS) Attacks in IOT Based Monitoring System of Banking Sector Using Machine Learning Models

Cyberattacks can trigger power outages, military equipment problems, and breaches of confidential information, i.e., medical records could be stolen if they get into the wrong hands. Due to the great monetary worth of the data it holds, the banking industry is particularly at risk. As the number of digital footprints of banks grows, so does the attack surface that hackers can exploit. This paper aims to detect distributed denial-of-service (DDOS) attacks on financial organizations using the Banking Dataset. In this research, we have used multiple classification models for the prediction of DDOS attacks. We have added some complexity to the architecture of generic models to enable them to perform well. We have further applied a support vector machine (SVM), K-Nearest Neighbors (KNN) and random forest algorithms (RF). The SVM shows an accuracy of 99.5%, while KNN and RF scored an accuracy of 97.5% and 98.74%, respectively, for the detection of (DDoS) attacks. Upon comparison, it has been concluded that the SVM is more robust as compared to KNN, RF and existing machine learning (ML) and deep learning (DL) approaches.

Development and Evaluation of Ensemble Learning Models for Detection of DDOS Attacks in IoT

Internet of Things that process tremendous confidential data have difficulty performing traditional security algorithms, thus their security is at risk. The security tasks to be added to these devices should be able to operate without disturbing the smooth operation of the system so that the availability of the system will not be impaired. While various attack detection systems can detect attacks with high accuracy rates, it is often impos-sible to integrate them into Internet of Things devices. Therefore, in this work, the new Distributed Denial-of-Service (DDoS) detection models using feature selection and learn-ing algorithms jointly are proposed to detect DDoS attacks, which are the most common type encountered by Internet of Things networks. Additionally, this study evaluates the memory consumption of single-based, bagging, and boosting algorithms on the client-side which has scarce resources. Not only the evaluation of memory consumption but also development of ensemble learning models refer to the novel part of this study. The data set consisting of 79 features in total created for the detection of DDoS attacks was minimized by selecting the two most significant features. Evaluation results confirm that the DDoS attack can be detected with high accuracy and less memory usage by the base models com-pared to complex learning methods such as bagging and boosting models. As a result, the findings demonstrate the feasibility of the base models, for the Internet of Things DDoS detection task, due to their application performance.

Deep Learning Feature Fusion Approach for an Intrusion Detection System in SDN-Based IoT Networks

A survey of the literature shows that the number of IoT attacks are gradually growing over the years due to the growing trend of Internet-enabled devices. Software defined networking (SDN) is a promising advanced computer network technology that supports IoT. A network intrusion detection system is an essential component in the SDN-IoT network environment to detect attacks and classify the attacks into their categories. Following, this work proposes a deep-learning-based approach that detects attacks and classifies them into their attack categories. The model extracts the internal feature representations from the gated recurrent unit (GRU) deep learning layers; further, the optimal features were extracted using kernel principal component analysis (kernel-PCA). Next, features were fused together, and attack detection and its classification is done using the fully connected network. The proposed feature fused GRU network has achieved better performance than the GRU model and other well-known classical machine-learning-based models. The proposed method can be used in real time to effectively monitor the network traffic in the SDN-IoT environment to proactively alert about possible attacks and classify them into their attack categories.

Machine Learning with Data Balancing Technique for IoT Attack and Anomalies Detection

Nowadays the significant concern in IoT infrastructure is anomaly and attack detection from IoT devices. Due to the advanced technology, the attack issues are increasing gradually. There are many attacks like Data Type Probing, Denial of Service, Malicious Operation, Malicious Control, Spying, Scan, and Wrong Setup that cause the failure of the IoT-based system. In this paper, several machine learning model performances have been compared to effectively predict the attack and anomaly. The performance of the models is compared with evaluation matrices (Accuracy) and confusion matrix for the final version of the effective model. Most of the recent studies performed experiments on an unbalanced dataset; that is clear that the model will be biased for such a dataset, so we completed the experiments in two forms, unbalanced and balanced data samples. For the unbalanced dataset, we have achieved the highest accuracy of 98.0% with Generalized Linear Model as well as with Random Forest; Unbalanced dataset means most of the chances are that model is biased, so we have also performed the experiments with Random Under Sampling Technique (Balancing Data) and achieved the highest accuracy of 94.3% with Generalized Linear Model. The confusion matrix in this study also supports the performance of the Generalized Linear Model.

Secure Internet of Things network using light‐weighted trust and blockchain‐powered PoW framework

SUMMARYBlockchain technology comprises security algorithms that work efficiently on battery powered devices. Low energy and delay indicate the effectiveness of any security mechanism. However, it is challenging for the algorithms to achieve low energy and delay because of various attacks. To identify and protect against various kinds of IoT attacks, a light‐weighted trust, and blockchain‐powered PoW framework are proposed in this article. A proof of work (PoW) consensus is utilized on the router side to validate the block before the blockchain accepts it. The flexibility of block design is the main benefit of PoW powered blockchain, so it can modify based on IoT applications. Moreover, trust is one of the major issues in IoT networks. Trust can be established among users during node processing and communication between nodes. This trust is significant for transferring the data from source to destination and the uncertainty of service availability in IoT applications. A trust evaluation between participating nodes and the blockchain mechanism are integrated into this work to cover authorization and authentication. The efficiency of the proposed trust model is evaluated in terms of trust evolution and trustworthy network and compared with the existing trust models. In the experimental analysis, the efficiency of the proposed blockchain‐powered network is analyzed in terms of energy, delay and processing time. The experimental outcomes proved that the proposed lightweight trust and blockchain‐powered PoW are more efficient than other approaches.

Detections of IoT Attacks via Machine Learning-Based Approaches with Cooja

Once hardware becomes "intelligent", it is vulnerable to threats. Therefore, IoT ecosystems are susceptible to a variety of attacks and are considered challenging due to heterogeneity and dynamic ecosystem. In this study, we proposed a method for detecting IoT attacks that are based on ML-based approaches that release the final decision to detect IoT attacks. However, we have implemented three attacks as a sample in the IoT via Contiki OS to generate a real dataset of IoT-based features containing a mix of data from malicious nodes and normal nodes in the IoT network to be utilized in the ML-based models. As a result, the multiclass random decision forest ML-based model achieved 98.9% overall accuracy in detecting IoT attacks for the real novel dataset compared to the decision tree jungle, decision forest tree regression, and boosted decision tree regression, which achieved 87.7%, 93.2%, and 87.1%, respectively. Thus, the decision tree-based approach efficiently manipulates and analyzes the KoÜ-6LoWPAN-IoT dataset, generated via the Cooja simulator, to detect inconsistent behavior and classify malicious activities.

A Comprehensive Review on the Cyber Security Methods in Indian Organisation

Abstract Cyber security, an application that protects and controls the systems, programs, networks, data and devices from cyber-attacks. This cyber security practice used by individuals and small or large organizations for protecting against unusual data access. A powerful cyber security system provides a great security against malware attacks, viruses, ransom ware, cloud attacks, IoT attacks etc. and it designed for accessing, destroying, deleting and altering these attacks and secure the retrieving data from the server and user’s systems. This paper discuss about the importance of cyber security in organizations of India. Surveys of Indian organization’s cyber security measures are taken for the evaluation of the methods and challenges of cyber security. This comprehensive review provides insights about securing the data by employing cyber security frame works, risk assessment models and educating cyber security knowledge among public with help of government public programs. With these information this paper helps for overcoming the cyber threats and attacks and created a pre cautionary thought and also made a pre vision for diminishing theft of data among employees and tracking hacker’s activities before attacking the organizations. Keywords: cyber security, Indian organization, cyber-attacks, cyber security methods, DDoS attack.

Cyber Security : Strategy to Security Challenges A Review

During recent years,the wireless communication and technologies have given rise to many cyber crimes and exploited the cyber security. Cybersecurity is the protection and prevention of internet-connected systems like hardware, software and data from cyberthreats and harms.Cyber security is important for the protection of confidentiality, integrity and availability of information assets. Perhaps the biggest challenge of cyber security is the continuous and immense growth in technology. The paper proposes challenges and issues related to cyber security. Some major challenges are phishing attacks, ransomware attack, IoT attacks and many more. This paper proposes a framework describing cyber terrorism. So there is need to create awareness about cyber security so that there will be safe and secure environment for users.