Detection In Internet Of Things Research Articles

An AI-Driven Model to Enhance Sustainability for the Detection of Cyber Threats in IoT Environments

In the face of constantly changing cyber threats, a variety of actions, tools, and regulations must be considered to safeguard information assets and guarantee the confidentiality, reliability, and availability of digital resources. The purpose of this research is to create an artificial intelligence (AI)-driven system to enhance sustainability for cyber threat detection in Internet of Things (IoT) environments. This study proposes a modern technique named Artificial Fish Swarm-driven Weight-normalized Adaboost (AF-WAdaBoost) for optimizing accuracy and sustainability in identifying attacks, thus contributing to heightening security in IoT environments. CICIDS2017, NSL-KDD, and UNSW-NB15 were used in this study. Min-max normalization is employed to pre-process the obtained raw information. The proposed model AF-WAdaBoost dynamically adjusts classifiers, enhancing accuracy and resilience against evolving threats. Python is used for model implementation. The effectiveness of the suggested AF-WAdaBoost model in identifying different kinds of cyber-threats in IoT systems is examined through evaluation metrics like accuracy (98.69%), F-measure (94.86%), and precision (95.72%). The experimental results unequivocally demonstrate that the recommended model performed better than other traditional approaches, showing essential enhancements in accuracy and strength, particularly in a dynamic environment. Integrating AI-driven detection balances offers sustainability in cybersecurity, ensuring the confidentiality, reliability, and availability of information assets, and also helps in optimizing the accuracy of systems.

Exploring the ALNS method for improved cybersecurity: A deep learning approach for attack detection in IoT and IIoT environments

With the emergence of the Internet of Things (IoT) and the Industrial Internet of Things (IIoT), the flow of data across the world is experiencing a rapid expansion. Unfortunately, this exponential growth is accompanied by a proportional increase in cyber threats, jeopardizing the security and integrity of computer systems. In this context, intrusion detection becomes a necessity to protect networks and systems against potential attacks, ensuring their proper functioning and reliability. In this paper, we propose a deep learning-based model for attack detection. This model utilizes a convolutional neural network to train the datasets, which are first cleaned and preprocessed. The model inputs are selected using an optimization method called adaptive large neighborhood search. The results obtained for the four datasets used - CICIDS2017, Edge-IIoTset, ToN-IoT windows7, and ToN-IoT windows10 - demonstrate the model’s effectiveness for both multi-class and binary classification cases. In the binary case, the accuracy reaches 99.85%, 100%, 99.97%, and 100%, respectively, and in the multi-class case, it stands at 99.81%, 94.98%, 99.92%, and 99.84%, respectively.

Overview of Cyber Attacks Classification and Detection in IoT using CNN-Deep Reinforcement Learning

Millions of digital devices total the Internet of Things (IoT), and this allows very easy interaction from users connecting the devices. IoT is one of the tech sectors that is expanding most rapidly, but it can also be very vulnerable to hazards. Infections and abnormal placement on the Internet of Things (IoT) framework is an increasing threat in the field of technology. In view of the growing IoT foundation usage across all industries, attacks and dangers on these systems have also grown proportional. Leveraging typical machine learning methods, cyber-attack detection plays a critical role in avoiding damage from cyberattacks on IoT devices. IoT Cyber Attacks are Not Detected by ANN Artificial Neural Networks Using Deep Learning Techniques CNN-DRL (Convolutional Neural Networks-Deep Reinforcement Learning) Hybrid Approach: Detects Attacks, including Distributed Denial of Service (DDoS), Zero-day, and Eavesdropping Attacks.

Masked Memory Network for Semi-Supervised Anomaly Detection in Internet of Things

Masked Memory Network for Semi-Supervised Anomaly Detection in Internet of Things

Optimizing Cyber Threat Detection in IoT: A Study of Artificial Bee Colony (ABC)-Based Hyperparameter Tuning for Machine Learning

In the rapidly evolving landscape of the Internet of Things (IoT), cybersecurity remains a critical challenge due to the diverse and complex nature of network traffic and the increasing sophistication of cyber threats. This study investigates the application of the Artificial Bee Colony (ABC) algorithm for hyperparameter optimization (HPO) in machine learning classifiers, specifically focusing on Decision Trees, Support Vector Machines (SVM), and K-Nearest Neighbors (KNN) for IoT network traffic analysis and malware detection. Initially, the basic machine learning models demonstrated accuracies ranging from 69.68% to 99.07%, reflecting their limitations in fully adapting to the varied IoT environments. Through the employment of the ABC algorithm for HPO, significant improvements were achieved, with optimized classifiers reaching up to 100% accuracy, precision, recall, and F1-scores in both training and testing stages. These results highlight the profound impact of HPO in refining model decision boundaries, reducing overfitting, and enhancing generalization capabilities, thereby contributing to the development of more robust and adaptive security frameworks for IoT environments. This study further demonstrates the ABC algorithm’s generalizability across different IoT networks and threats, positioning it as a valuable tool for advancing cybersecurity in increasingly complex IoT ecosystems.

A two stage lightweight approach for intrusion detection in Internet of Things

The prevalence of the Internet of Things (IoT) in people’s life has led to a significant rise in the amounts of breaches against different IoT devices. Given that IoT devices are typically installed in settings with constrained resources and limited processing power, and malicious traffic samples are difficult to collect, resulting in traditional deep learning algorithms that do not handle intrusion detection in IoT network well. In this work, we present a two-stage lightweight intrusion detection model based on self-supervised contrastive learning and self-knowledge distillation to reduce model’s over-reliance on labels, optimize the model’s capacity for generalization and significantly increase the IoT network’s intrusion detection speed while lowering the model’s complexity. The representations of the network traffic are extracted in the first step using self-supervised contrastive learning, and the representations learnt by the teacher model are transferred to the student model in the second stage using self-knowledge distillation. On the benchmark datasets KDD CUP99, NSL-KDD, UNSW-NB15, CIC IDS2017 and BoT-IoT, we carried out in-depth studies, and the experimental results demonstrate that our proposed model outperforms recent state-of-the-art models in addition to achieving superior intrusion detection capabilities. The code will be released at https://github.com/RicardoMLi/CL-SKD.

Development of novel intrusion detection in Internet of Things using improved dart game optimizer‐derived optimal cascaded ensemble learning

AbstractBackground of the StudyInternet of things (IoT) industry has accelerated its development with the support of advanced information technology and economic expansion. A complete industrial foundation includes software, chips, electronic components, IoT services, integrated systems, machinery, and telecom operators, which the gradual improvement in the IoT industry system has formulated. As the exponential growth of IoT devices increases, the attack surface available to cybercriminals enables them to carry out potentially more damaging operations. As a result, the security sector has witnessed a rise in cyberattacks. Hackers use several methods to copy and modify the information in the IoT environment. Machine learning techniques are used by the intrusion detection (ID) model to determine and categorize attacks in IoT networks.ObjectivesThus, this study explores the ID system with the heuristic‐assisted deep learning approaches for effectively detect the attacks in the IoT. At first, the IoT data are garnered in benchmark resources. Then, the gathered data is preprocessed to perform data cleaning. Next, the data is transformed and fed to the feature extraction stage. The feature extraction is performed with the help of one‐dimensional convolutional neural network (1D‐CNN), where the features are extracted from the target‐based pooling layer. Then, these attained deep features are fed to the ID phase, where the cascaded ensemble learning (CEL) approach is adopted for detecting the intrusions. Here, the hyperparameter tuning is done with a new suggested improved darts game optimizer (IDGO) algorithm. Here, the main objective of the developed algorithm helps to maximize accuracy in ID.FindingsThroughout the experimental findings, the developed model provides 86% of accuracy. Thus, the finding of the developed model shows less detecting time and higher detection efficiency.

Malware Detection for Internet of Things Using One-Class Classification.

The increasing usage of interconnected devices within the Internet of Things (IoT) and Industrial IoT (IIoT) has significantly enhanced efficiency and utility in both personal and industrial settings but also heightened cybersecurity vulnerabilities, particularly through IoT malware. This paper explores the use of one-class classification, a method of unsupervised learning, which is especially suitable for unlabeled data, dynamic environments, and malware detection, which is a form of anomaly detection. We introduce the TF-IDF method for transforming nominal features into numerical formats that avoid information loss and manage dimensionality effectively, which is crucial for enhancing pattern recognition when combined with n-grams. Furthermore, we compare the performance of multi-class vs. one-class classification models, including Isolation Forest and deep autoencoder, that are trained with both benign and malicious NetFlow samples vs. trained exclusively on benign NetFlow samples. We achieve 100% recall with precision rates above 80% and 90% across various test datasets using one-class classification. These models show the adaptability of unsupervised learning, especially one-class classification, to the evolving malware threats in the IoT domain, offering insights into enhancing IoT security frameworks and suggesting directions for future research in this critical area.

Abnormal traffic detection for Internet of Things based on an improved Residual Network

Along with the progression of Internet of Things technology, network terminals are becoming continuously more intelligent. IoT has been widely applied in various scenarios, including urban infrastructure, transportation, industry, personal life, and other socio-economic fields. The introduction of deep learning has brought new security challenges, especially the increase in abnormal traffic, which poses a threat to network security. Insufficient feature extraction leads to less accurate classification results. In abnormal traffic detection, the data of network traffic is high-dimensional and complex. This data not only increases the computational burden of model training but also makes information extraction more difficult. To address these issues, this paper proposes an MD-MRD-ResNeXt model for abnormal network traffic detection. To fully utilize the multi-scale information in network traffic, a Multi-scale Dilated Feature Extraction (MD) block is introduced. This module can effectively understand and process information at various scales and uses dilated convolution technology to significantly broaden the model's receptive field. The proposed Max-Feature-Map Residual with Dual-Channel Pooling (MRD) block integrates the maximum feature map with the residual block. This module ensures the model focuses on key information, thereby optimizing computational efficiency and reducing unnecessary information redundancy. Experimental results show that compared to the latest methods, the proposed abnormal traffic detection model improves accuracy by about 2 %.

An extreme gradient boost based classification and regression tree for network intrusion detection in IoT

Nowadays, modern technology includes various devices, networks, and apps from the internet of things (IoT), which consist of both positive and negative impacts on social, economic, and industrial effects. To address these issues, IoT applications and networks require lightweight, quick, and adaptable security solutions. In this sense, solutions based on artificial intelligence and big data analytics can yield positive outcomes in the realm of cyber security. This study presents a method called extreme gradient boost (XGBoost) based classification and regression tree to identify network intrusions in the IoT. This model is ideally suited for application in IoT networks with restricted resource availability because of its distributed structure and builtin higher generalization capabilities. This approach is thoroughly tested using botnet internet of things (BoT-IoT) new-generation IoT security datasets. All trials are conducted in a range of different settings, and a number of performance indicators are used to evaluate the effectiveness of the proposed method. The suggested study's findings provide recommendations and insights for situations involving binary classes and numerous classes. The suggested XGBoost model achieved 99.53% of accuracy in attack detection and 99.51% in precision for binary class and multiclass classifications, respectively.

Innovative IoT Threat Detection: Weighted Variational Autoencoder-Based Hunter Prey Search Algorithm for Strengthening Cybersecurity

Cybersecurity threat detection in the Internet of Things (IoT) identifies and mitigates risks associated with connected devices. The IoT devices are vulnerable to attacks as they do not contain any robust security mechanism. Traditional methods for cybersecurity-based threat detection face significant problems such as scalability, privacy concerns, and resource constraints when applied to the dynamic IoT environment. To tackle these challenges, this paper proposed a novel Weighted Variational Autoencoder-based Hunter Prey Search (WVA-HPS) algorithm for enhancing cybersecurity threat detection in IoT. In this study, a weighted Variational Autoencoder is employed for regulating weight mechanism using weight regularization and the weight average ensemble method. The Hunter Prey Search optimization (HPSO) algorithm is utilized for minimizing overfitting issues to enhance the efficiency of the WVA method. The proposed WVA-HPS model comprises five different stages such as data collection, data preprocessing, threat detection, model evaluation, and output. The study is validated on diverse datasets namely BoT-IoT, MQTTset, and IoT-23. The WVA-HPS method's performance is analyzed using the metrics namely precision, accuracy, specificity, F-measure, and recall and its performance is compared with existing methods. The experimental results illustrate the performance of the WVA-HPS method for cybersecurity threat detection in an IoT environment.

Lightweight, Trust-Managing, and Privacy-Preserving Collaborative Intrusion Detection for Internet of Things

This research introduces a comprehensive collaborative intrusion detection system (CIDS) framework aimed at bolstering the security of Internet of Things (IoT) environments by synergistically integrating lightweight architecture, trust management, and privacy-preserving mechanisms. The proposed hierarchical architecture spans edge, fog, and cloud layers, ensuring efficient and scalable collaborative intrusion detection. Trustworthiness is established through the incorporation of distributed ledger technology (DLT), leveraging blockchain frameworks to enhance the reliability and transparency of communication among IoT devices. Furthermore, the research adopts federated learning (FL) techniques to address privacy concerns, allowing devices to collaboratively learn from decentralized data sources while preserving individual data privacy. Validation of the proposed approach is conducted using the CICIoT2023 dataset, demonstrating its effectiveness in enhancing the security posture of IoT ecosystems. This research contributes to the advancement of secure and resilient IoT infrastructures, addressing the imperative need for lightweight, trust-managing, and privacy-preserving solutions in the face of evolving cybersecurity challenges. According to our experiments, the proposed model achieved an average accuracy of 97.65%, precision of 97.65%, recall of 100%, and F1-score of 98.81% when detecting various attacks on IoT systems with heterogeneous devices and networks. The system is a lightweight system when compared with traditional intrusion detection that uses centralized learning in terms of network latency and memory consumption. The proposed system shows trust and can keep private data in an IoT environment.

Optimized common features selection and deep-autoencoder (OCFSDA) for lightweight intrusion detection in Internet of things

Embedded systems, including the Internet of things (IoT), play a crucial role in the functioning of critical infrastructure. However, these devices face significant challenges such as memory footprint, technical challenges, privacy concerns, performance trade-offs and vulnerability to cyber-attacks. One approach to address these concerns is minimising computational overhead and adopting lightweight intrusion detection techniques. In this study, we propose a highly efficient model called optimized common features selection and deep-autoencoder (OCFSDA) for lightweight intrusion detection in IoT environments. The proposed OCFSDA model incorporates feature selection, data compression, pruning, and deparameterization. We deployed the model on a Raspberry Pi4 using the TFLite interpreter by leveraging optimisation and inferencing with semi-supervised learning. Using the MQTT-IoT-IDS2020 and CIC-IDS2017 datasets, our experimental results demonstrate a remarkable reduction in the computation cost in terms of time and memory use. Notably, the model achieved an overall average accuracies of 99% and 97%, along with comparable performance on other important metrics such as precision, recall, and F1-score. Moreover, the model accomplished the classification tasks within 0.30 and 0.12 s using only 2KB of memory.

Anomalous process detection for Internet of Things based on K-Core

In recent years, Internet of Things security incidents occur frequently, which is often accompanied by malicious events. Therefore, anomaly detection is an important part of Internet of Things security defense. In this paper, we create a process whitelist based on the K-Core decomposition method for detecting anomalous processes in IoT devices. The method first constructs an IoT process network according to the relationships between processes and IoT devices. Subsequently, it creates a whitelist and detect anomalous processes. Our work innovatively transforms process data into a network framework, employing K-Core analysis to identify core processes that signify high popularity. Then, a threshold-based filtering mechanism is applied to formulate the process whitelist. Experimental results show that the unsupervised method proposed in this paper can accurately detect anomalous processes on real-world datasets. Therefore, we believe our algorithm can be widely applied to anomaly process detection, ultimately enhancing the overall security of the IoT.

Enhancing Intrusion Detection through Unsupervised Deep Learning Models

The Internet of Things (IoT) has experienced significant growth since its inception, representing a groundbreaking technological advancement. In essence, IoT involves the seamless integration of devices and data to automate and centralize various processes. This transformative technology is revolutionizing business operations and reshaping society as a whole. As IoT continues to evolve, the importance of detecting vulnerabilities and weaknesses becomes paramount in order to thwart unauthorized access to critical resources and business functions, which could potentially render the entire system unavailable. One prevalent threat in this context is Denial of Service (DoS) and Distributed DoS attacks. In this project, propose an innovative architecture known as Protocol Based Deep Intrusion Detection (PB-DID). To create our dataset, we gathered packets from IoT traffic and compared features from two well-known datasets: UNSWNB15 and Bot-IoT. We focused on flow and Transmission Control Protocol (TCP) characteristics. Our primary objective was to accurately classify network traffic into three categories: non-anomalous, DoS, and DDoS, while addressing issues like data imbalance and overfitting. Utilizing deep learning (DL) techniques, we achieved an impressive classification accuracy of 96.3%. This level of accuracy demonstrates the potential of our PB-DID architecture in effectively identifying and mitigating intrusion attempts in the context of IoT, thereby enhancing the security and reliability of IoT systems. Keywords—: Intrusion detection in IoT, Deep learning for intrusion detection, DoS detection, DDoS detection.

Hybrid Data Augmentation Based Machine Learning Approach for Botnet Attack Detection in IOT Networks

This paper presents a comprehensive approach to botnet detection in Internet of Things (IoT) networks through the development and evaluation of a Generative Adversarial Network (GAN) augmented machine learning model. The methodology encompasses a multi-step process, starting with data collection and pre-processing, including feature extraction, normalization, and handling missing values. To address the challenge of data imbalance, a novel application of GANs is proposed. For classification of network traffic into botnet and legitimate traffic is performed using xgboost. The performance of the proposed model is rigorously evaluated using the N-BaIoT dataset, demonstrating its effectiveness through high accuracy, precision, recall, and F1-score metrics. The results indicate significant improvements over existing models, showcasing the potential of the proposed methodology in enhancing IoT network security against botnet threats.

Empowering anomaly detection algorithm: a review

<span lang="EN-US">Detecting anomalies in a data stream relevant to domains like intrusion detection, fraud detection, security in sensor networks, or event detection in internet of things (IoT) environments is a growing field of research. For instance, the use of surveillance cameras installed everywhere that is usually governed by human experts. However, when many cameras are involved, more human expertise is needed, thus making it expensive. Hence, researchers worldwide are trying to invent the best-automated algorithm to detect abnormal behavior using real-time data. The designed algorithm for this purpose may contain gaps that could differentiate the qualities in specific domains. Therefore, this study presents a review of anomaly detection algorithms, introducing the gap that presents the advantages and disadvantages of these algorithms. Since many works of literature were reviewed in this review, it is expected to aid researchers in closing this gap in the future.</span>

Optimizing IoT intrusion detection system: feature selection versus feature extraction in machine learning

Internet of Things (IoT) devices are widely used but also vulnerable to cyberattacks that can cause security issues. To protect against this, machine learning approaches have been developed for network intrusion detection in IoT. These often use feature reduction techniques like feature selection or extraction before feeding data to models. This helps make detection efficient for real-time needs. This paper thoroughly compares feature extraction and selection for IoT network intrusion detection in machine learning-based attack classification framework. It looks at performance metrics like accuracy, f1-score, and runtime, etc. on the heterogenous IoT dataset named Network TON-IoT using binary and multiclass classification. Overall, feature extraction gives better detection performance than feature selection as the number of features is small. Moreover, extraction shows less feature reduction compared with that of selection, and is less sensitive to changes in the number of features. However, feature selection achieves less model training and inference time compared with its counterpart. Also, more space to improve the accuracy for selection than extraction when the number of features changes. This holds for both binary and multiclass classification. The study provides guidelines for selecting appropriate intrusion detection methods for particular scenarios. Before, the TON-IoT heterogeneous IoT dataset comparison and recommendations were overlooked. Overall, the research presents a thorough comparison of feature reduction techniques for machine learning-driven intrusion detection in IoT networks.

Adaptive Approach to Anomaly Detection in Internet of Things Using Autoencoders and Dynamic Thresholds

The Internet of Things (IoT) represents a vast network of interconnected devices, from simple sensors to intricate machines, which collect and share data across sectors like healthcare, agriculture, and home automation. This interconnectivity has brought convenience and efficiency but also introduced significant security concerns. Many IoT devices, built for specific functions, may lack robust security, making them vulnerable to cyberattacks, especially during device-to-device communications. Traditional security approaches often fall short in the vast and varied IoT landscape, underscoring the need for advanced Anomaly Detection (AD), which identifies unusual data patterns to warn against potential threats. Recently, a range of methods, from statistical to Deep Learning (DL), have been employed for AD. However, they face challenges in the unique IoT environment due to the massive volume of data, its evolving nature, and the limitations of some IoT devices. Addressing these challenges, the proposed research recommends using autoencoders with a dynamic threshold mechanism. This adaptive method continuously recalibrates, ensuring relevant and precise AD. Through extensive testing and comparisons, the study seeks to demonstrate the efficiency and adaptability of this approach in ensuring secure IoT communications.

Deep Learning based DDoS Attack Detection in Internet of Things: An Optimized CNN-BiLSTM Architecture with Transfer Learning and Regularization Techniques

In recent days, with the rapid advancement of technology in informatics systems, the Internet of Things (IoT) becomes crucial in many aspects of daily life. IoT applications have gained popularity due to the availability of various IoT enabler gadgets, such as smartwatches, smartphones, and so on. However, the vulnerability of IoT devices has led to security challenges, including Distributed Denial-of-Service (DDoS) attacks. These limitations result from the dynamic communication between IoT devices due to their limited data storage and processing resources. The primary research challenge is to create a model that can recognize legitimate traffic while effectively protecting the network against various classes of DDoS attacks. This article proposes a CNN-BiLSTM DDoS detection model by combining three deep-learning algorithms. The models are evaluated using the CICIDS2017 dataset against commonly used performance criteria which the models perform well, achieving an accuracy of around 99.76%, except for the CNN model, which achieves an accuracy of 98.82%. The proposed model performs best, achieving an accuracy of 99.9%.