Detection In Internet Of Things Research Articles

Lightweight, Trust-Managing, and Privacy-Preserving Collaborative Intrusion Detection for Internet of Things

This research introduces a comprehensive collaborative intrusion detection system (CIDS) framework aimed at bolstering the security of Internet of Things (IoT) environments by synergistically integrating lightweight architecture, trust management, and privacy-preserving mechanisms. The proposed hierarchical architecture spans edge, fog, and cloud layers, ensuring efficient and scalable collaborative intrusion detection. Trustworthiness is established through the incorporation of distributed ledger technology (DLT), leveraging blockchain frameworks to enhance the reliability and transparency of communication among IoT devices. Furthermore, the research adopts federated learning (FL) techniques to address privacy concerns, allowing devices to collaboratively learn from decentralized data sources while preserving individual data privacy. Validation of the proposed approach is conducted using the CICIoT2023 dataset, demonstrating its effectiveness in enhancing the security posture of IoT ecosystems. This research contributes to the advancement of secure and resilient IoT infrastructures, addressing the imperative need for lightweight, trust-managing, and privacy-preserving solutions in the face of evolving cybersecurity challenges. According to our experiments, the proposed model achieved an average accuracy of 97.65%, precision of 97.65%, recall of 100%, and F1-score of 98.81% when detecting various attacks on IoT systems with heterogeneous devices and networks. The system is a lightweight system when compared with traditional intrusion detection that uses centralized learning in terms of network latency and memory consumption. The proposed system shows trust and can keep private data in an IoT environment.

Optimized common features selection and deep-autoencoder (OCFSDA) for lightweight intrusion detection in Internet of things

AbstractEmbedded systems, including the Internet of things (IoT), play a crucial role in the functioning of critical infrastructure. However, these devices face significant challenges such as memory footprint, technical challenges, privacy concerns, performance trade-offs and vulnerability to cyber-attacks. One approach to address these concerns is minimising computational overhead and adopting lightweight intrusion detection techniques. In this study, we propose a highly efficient model called optimized common features selection and deep-autoencoder (OCFSDA) for lightweight intrusion detection in IoT environments. The proposed OCFSDA model incorporates feature selection, data compression, pruning, and deparameterization. We deployed the model on a Raspberry Pi4 using the TFLite interpreter by leveraging optimisation and inferencing with semi-supervised learning. Using the MQTT-IoT-IDS2020 and CIC-IDS2017 datasets, our experimental results demonstrate a remarkable reduction in the computation cost in terms of time and memory use. Notably, the model achieved an overall average accuracies of 99% and 97%, along with comparable performance on other important metrics such as precision, recall, and F1-score. Moreover, the model accomplished the classification tasks within 0.30 and 0.12 s using only 2KB of memory.

Anomalous process detection for Internet of Things based on K-Core

In recent years, Internet of Things security incidents occur frequently, which is often accompanied by malicious events. Therefore, anomaly detection is an important part of Internet of Things security defense. In this paper, we create a process whitelist based on the K-Core decomposition method for detecting anomalous processes in IoT devices. The method first constructs an IoT process network according to the relationships between processes and IoT devices. Subsequently, it creates a whitelist and detect anomalous processes. Our work innovatively transforms process data into a network framework, employing K-Core analysis to identify core processes that signify high popularity. Then, a threshold-based filtering mechanism is applied to formulate the process whitelist. Experimental results show that the unsupervised method proposed in this paper can accurately detect anomalous processes on real-world datasets. Therefore, we believe our algorithm can be widely applied to anomaly process detection, ultimately enhancing the overall security of the IoT.

Enhancing Intrusion Detection through Unsupervised Deep Learning Models

The Internet of Things (IoT) has experienced significant growth since its inception, representing a groundbreaking technological advancement. In essence, IoT involves the seamless integration of devices and data to automate and centralize various processes. This transformative technology is revolutionizing business operations and reshaping society as a whole. As IoT continues to evolve, the importance of detecting vulnerabilities and weaknesses becomes paramount in order to thwart unauthorized access to critical resources and business functions, which could potentially render the entire system unavailable. One prevalent threat in this context is Denial of Service (DoS) and Distributed DoS attacks. In this project, propose an innovative architecture known as Protocol Based Deep Intrusion Detection (PB-DID). To create our dataset, we gathered packets from IoT traffic and compared features from two well-known datasets: UNSWNB15 and Bot-IoT. We focused on flow and Transmission Control Protocol (TCP) characteristics. Our primary objective was to accurately classify network traffic into three categories: non-anomalous, DoS, and DDoS, while addressing issues like data imbalance and overfitting. Utilizing deep learning (DL) techniques, we achieved an impressive classification accuracy of 96.3%. This level of accuracy demonstrates the potential of our PB-DID architecture in effectively identifying and mitigating intrusion attempts in the context of IoT, thereby enhancing the security and reliability of IoT systems. Keywords—: Intrusion detection in IoT, Deep learning for intrusion detection, DoS detection, DDoS detection.

Hybrid Data Augmentation Based Machine Learning Approach for Botnet Attack Detection in IOT Networks

This paper presents a comprehensive approach to botnet detection in Internet of Things (IoT) networks through the development and evaluation of a Generative Adversarial Network (GAN) augmented machine learning model. The methodology encompasses a multi-step process, starting with data collection and pre-processing, including feature extraction, normalization, and handling missing values. To address the challenge of data imbalance, a novel application of GANs is proposed. For classification of network traffic into botnet and legitimate traffic is performed using xgboost. The performance of the proposed model is rigorously evaluated using the N-BaIoT dataset, demonstrating its effectiveness through high accuracy, precision, recall, and F1-score metrics. The results indicate significant improvements over existing models, showcasing the potential of the proposed methodology in enhancing IoT network security against botnet threats.

Empowering anomaly detection algorithm: a review

<span lang="EN-US">Detecting anomalies in a data stream relevant to domains like intrusion detection, fraud detection, security in sensor networks, or event detection in internet of things (IoT) environments is a growing field of research. For instance, the use of surveillance cameras installed everywhere that is usually governed by human experts. However, when many cameras are involved, more human expertise is needed, thus making it expensive. Hence, researchers worldwide are trying to invent the best-automated algorithm to detect abnormal behavior using real-time data. The designed algorithm for this purpose may contain gaps that could differentiate the qualities in specific domains. Therefore, this study presents a review of anomaly detection algorithms, introducing the gap that presents the advantages and disadvantages of these algorithms. Since many works of literature were reviewed in this review, it is expected to aid researchers in closing this gap in the future.</span>

Optimizing IoT intrusion detection system: feature selection versus feature extraction in machine learning

Internet of Things (IoT) devices are widely used but also vulnerable to cyberattacks that can cause security issues. To protect against this, machine learning approaches have been developed for network intrusion detection in IoT. These often use feature reduction techniques like feature selection or extraction before feeding data to models. This helps make detection efficient for real-time needs. This paper thoroughly compares feature extraction and selection for IoT network intrusion detection in machine learning-based attack classification framework. It looks at performance metrics like accuracy, f1-score, and runtime, etc. on the heterogenous IoT dataset named Network TON-IoT using binary and multiclass classification. Overall, feature extraction gives better detection performance than feature selection as the number of features is small. Moreover, extraction shows less feature reduction compared with that of selection, and is less sensitive to changes in the number of features. However, feature selection achieves less model training and inference time compared with its counterpart. Also, more space to improve the accuracy for selection than extraction when the number of features changes. This holds for both binary and multiclass classification. The study provides guidelines for selecting appropriate intrusion detection methods for particular scenarios. Before, the TON-IoT heterogeneous IoT dataset comparison and recommendations were overlooked. Overall, the research presents a thorough comparison of feature reduction techniques for machine learning-driven intrusion detection in IoT networks.

Adaptive Approach to Anomaly Detection in Internet of Things Using Autoencoders and Dynamic Thresholds

The Internet of Things (IoT) represents a vast network of interconnected devices, from simple sensors to intricate machines, which collect and share data across sectors like healthcare, agriculture, and home automation. This interconnectivity has brought convenience and efficiency but also introduced significant security concerns. Many IoT devices, built for specific functions, may lack robust security, making them vulnerable to cyberattacks, especially during device-to-device communications. Traditional security approaches often fall short in the vast and varied IoT landscape, underscoring the need for advanced Anomaly Detection (AD), which identifies unusual data patterns to warn against potential threats. Recently, a range of methods, from statistical to Deep Learning (DL), have been employed for AD. However, they face challenges in the unique IoT environment due to the massive volume of data, its evolving nature, and the limitations of some IoT devices. Addressing these challenges, the proposed research recommends using autoencoders with a dynamic threshold mechanism. This adaptive method continuously recalibrates, ensuring relevant and precise AD. Through extensive testing and comparisons, the study seeks to demonstrate the efficiency and adaptability of this approach in ensuring secure IoT communications.

Deep Learning based DDoS Attack Detection in Internet of Things: An Optimized CNN-BiLSTM Architecture with Transfer Learning and Regularization Techniques

In recent days, with the rapid advancement of technology in informatics systems, the Internet of Things (IoT) becomes crucial in many aspects of daily life. IoT applications have gained popularity due to the availability of various IoT enabler gadgets, such as smartwatches, smartphones, and so on. However, the vulnerability of IoT devices has led to security challenges, including Distributed Denial-of-Service (DDoS) attacks. These limitations result from the dynamic communication between IoT devices due to their limited data storage and processing resources. The primary research challenge is to create a model that can recognize legitimate traffic while effectively protecting the network against various classes of DDoS attacks. This article proposes a CNN-BiLSTM DDoS detection model by combining three deep-learning algorithms. The models are evaluated using the CICIDS2017 dataset against commonly used performance criteria which the models perform well, achieving an accuracy of around 99.76%, except for the CNN model, which achieves an accuracy of 98.82%. The proposed model performs best, achieving an accuracy of 99.9%.

Automated Network Intrusion Detection for Internet of Things: Security Enhancements

Automated Network Intrusion Detection for Internet of Things: Security Enhancements

A Survey of Deep Learning Technologies for Intrusion Detection in Internet of Things

A Survey of Deep Learning Technologies for Intrusion Detection in Internet of Things

Blockchain based federated learning for intrusion detection for Internet of Things

Blockchain based federated learning for intrusion detection for Internet of Things

Bi-Level Intrusion Detection in IoT Networks Using Ensemble Method and A-GRU-RNN Classifier

For minimizing security vulnerabilities and attacks, which affect Internet of Things (IoT) applications’ performance, it is essential to design an efficient authentication protocol owing to the rapid deployment of IoT. This paper proposes a bi-level Intrusion Detection (ID) in IoT using an ensemble and Arctan-based Gated Recurrent Unit-Recurrent Neural Network (A-GRU-RNN) classifier. This work mainly concentrates on both major and minor attacks. Allowing the trusted nodes to join the network is the other motive of this work. Here, the nodes are registered to the network and then initialized. Then, to verify the trust levels of the nodes, test packet transmission is performed. By employing the Deterministic Initialization Method-centric K-Means algorithm (DIM-K-Means) algorithm, the trusted nodes are formed into the cluster. Next, the respective CH is selected by Multiplex-Valued Encoding Sea Lion Optimization (MVE-SLO). Afterwards, by employing Multi-Point Relays-Optimized Link State Routing (MPR-OLSR), routing is taken place. The steps, namely preprocessing, attribute extraction, attribute reduction, and classification are taken to detect the confidentiality of the sensed data. The classification phase significantly determines whether the data is attacked or not. If the data is attacked, then it detects the attack type. Here, the publicly available dataset is used. As per the experimental outcome, the proposed method withstands high-security levels when analogized to the prevailing methodologies.

A Fully Privacy-Preserving Solution for Anomaly Detection in IoT using Federated Learning and Homomorphic Encryption

AbstractAnomaly detection for the Internet of Things (IoT) is a very important topic in the context of cyber-security. Indeed, as the pervasiveness of this technology is increasing, so is the number of threats and attacks targeting smart objects and their interactions. Behavioral fingerprinting has gained attention from researchers in this domain as it represents a novel strategy to model object interactions and assess their correctness and honesty. Still, there exist challenges in terms of the performance of such AI-based solutions. The main reasons can be alleged to scalability, privacy, and limitations on adopted Machine Learning algorithms. Indeed, in classical distributed fingerprinting approaches, an object models the behavior of a target contact by exploiting only the information coming from the direct interaction with it, which represents a very limited view of the target because it does not consider services and messages exchanged with other neighbors. On the other hand, building a global model of a target node behavior leveraging the information coming from the interactions with its neighbors, may lead to critical privacy concerns. To face this issue, the strategy proposed in this paper exploits Federated Learning to compute a global behavioral fingerprinting model for a target object, by analyzing its interactions with different peers in the network. Our solution allows the training of such models in a distributed way by relying also on a secure delegation strategy to involve less capable nodes in IoT. Moreover, through homomorphic encryption and Blockchain technology, our approach guarantees the privacy of both the target object and the different workers, as well as the robustness of the strategy in the presence of attacks. All these features lead to a secure fully privacy-preserving solution whose robustness, correctness, and performance are evaluated in this paper using a detailed security analysis and an extensive experimental campaign. Finally, the performance of our model is very satisfactory, as it consistently discriminates between normal and anomalous behaviors across all evaluated test sets, achieving an average accuracy value of 0.85.

Billiard based optimization with deep learning driven anomaly detection in internet of things assisted sustainable smart cities

Internet of Things (IoT) technology involves a network of interconnected devices and sensors that gather and exchange information. In smart cities, IoT devices were utilized in several fields including energy, transportation, waste management, healthcare, etc., to improve the overall quality of life and sustainability of the populace. But, as the usage of IoT increases, the cybersecurity and data privacy become a concern of safety. An anomaly detection system helps to identify possible data breaches or cyber-attacks by identifying abnormal data patterns. Deep learning (DL) driven anomaly detection has emerged as an effective and powerful method for identifying abnormal behaviours or patterns in the data domain. This technique leverages the abilities of a deep neural network for automated learning of complex patterns and representations from data, which make it better for anomaly detection task where irregularities cannot be easily defined by handcrafted rules. This paper establishes a new Billiard Based Optimization with Deep Learning Driven Anomaly Detection and Classification (BBODL-ADC) technique in IoT-assisted Sustainable Smart Cities. The goal of the BBODL-ADC technique lies in the proper recognition and classification of anomalies in the IoT-assisted smart city. To obtain that, the BBODL-ADC system applies a binary pigeon optimization algorithm (BPEO) algorithm for the effectual selection of features. Besides, the BBODL-ADC technique utilizes Elman recurrent neural network (ERNN) approach for the recognition and classification of anomalies. Moreover, the BBO system can be used for better parameters chosen by the ERNN algorithm. The stimulation value of the BBODL-ADC algorithm can be executed benchmark database. The achieved outcomes demonstrate the remarkable outcome of the BBODL-ADC methodology of 95.69% and 99.21% compared to existing models under dataset-1 and dataset-2.

A federated and explainable approach for insider threat detection in IoT

An insider threat is a malicious action launched by authorized personnel inside the organization. Since insider actions may only leave a small digital footprint in the system, it is considered a major cybersecurity challenge in different applications. Along with the rapid growth of the Internet of Things (IoT) and the extensive attack surface in this technology, many concerns have been raised regarding the potential insider threats in IoT environments. Several studies have been conducted on Machine Learning (ML)-based insider threat detection solutions which are focused on the models’ performance while the trustability of these models is neglected. Trustworthy Learning refers to a new trend in ML that focuses on ways to ensure that the data collection and data analysis procedures in ML techniques follow ethical applications and are trustable to human users. This approach enforces the acceptance and successful adoption of ML-based solutions. This study aims to propose an improved trustworthy insider threat detection method that ensures two of the trustworthy learning requirements: Privacy and Explainability. The proposed solution protects the privacy of the utilized data and is capable of explaining why certain behaviors are detected as a threat. The proposed solution also leverages data collaboration between different data owners to increase the volume of data used in the training process and enhance the performance of the ML model. Experimental results show the proposed solution outperforms the learning models trained by individual data holders.

A multi-objective mutation-based dynamic Harris Hawks optimization for botnet detection in IoT

The increasing trend toward using the Internet of Things (IoT) increased the number of intrusions and intruders annually. Hence, the integration, confidentiality, and access to digital resources would be threatened continually. The significance of security implementation in digital platforms and the need to design defensive systems to discover different intrusions made the researchers study updated and effective methods, such as Botnet Detection for IoT systems. Many problem space features and network behavior unpredictability made the Intrusion Detection System (IDS) the main problem in maintaining computer networks' security. Furthermore, many insignificant features have turned the feature selection (FS) problem into a vast IDS aspect. This paper introduces a novel binary multi-objective dynamic Harris Hawks Optimization (HHO) enhanced with mutation operator (MODHHO) and applies it to Botnet Detection in IoT. Afterward, the Feature Selection (FS) is undertaken, and the K-Nearest Neighbor (KNN), Support Vector Machine (SVM), Multilayer Perceptron (MLP), and Decision Tree (DT) classifiers are used to estimate the potential of the selected features in the precise detection of intrusions. The simulation results illustrated that the MODHHO algorithm performs well in Botnet Detection in IoT and is preferred to other approaches in its performance metrics. Besides, the computational complexity analysis results suggest that the MODHHO algorithm's overhead is more optimal than similar approaches. The MODHHO algorithm has performed better in comparison with other compared algorithms in all 5 data sets. In contrast with the machine learning methods of the proposed model in all five data sets, it has had a better error rate according to the AUC, G-mean, and TPR criteria. And according to the comparison made with filter-based methods, it has performed almost better in three datasets.

SIDS: A federated learning approach for intrusion detection in IoT using Social Internet of Things

The Internet of Things (IoT) ecosystem needs Intrusion Detection Systems (IDS) to mitigate cyberattacks and exploit security vulnerabilities. Over the past years, utilizing machine learning in IDSs has gained a lot of attention. However, in many current works, the training data from different locations should be collected in a central server to be used in the learning process. This data-sharing procedure increases concerns regarding data privacy and decreases the data holders’ motivation to participate in the learning process. The use of distributed learning models has been considered a solution to overcome concerns related to privacy. However, these distributed learning models are vulnerable in the presence of untrusted nodes that can participate in the learning process and deteriorate performance. In this paper, we propose SIDS (Social Intrusion Detection System), a trust-oriented federated learning approach for intrusion detection in IoT that utilizes the Social Internet of Things (SIoT). The proposed approach leverages the social relationships among the objects in a system to provide a privacy-preserving collaborative mechanism for detecting intrusions in IoT environments. The experimental results show the proposed solution outperforms the learning models on individual servers while providing a privacy-preserving and trustable environment for collaboration.

Deep Reinforcement Learning for intrusion detection in Internet of Things: Best practices, lessons learnt, and open challenges

The Internet of Things (IoT) scenario places important challenges even for deep learning-based intrusion detection systems. IoTs are highly heterogeneous networks in which multiple types of nodes and connections between them proliferate at a fast pace. From a deep learning perspective, such complexity translates into dynamic feature spaces where the extraction of semantic patterns and correlations among features may require sophisticated inductive biases to be learnt by gradient-based techniques. The research community has recently suggested using Deep Reinforcement Learning (DRL) as a potent approach to effectively identify cyber-threat attempts in IoTs.DRL consists of a Markov Decision Process-based meta-model that permits solving high-dimensional combinatorial optimization problems where differentiable supervisory signals may be absent. For this reason, multiple intelligent intrusion detection systems have been proposed for the IoT environment where high-level requirements are been pursued alongside the detection accuracy. These goals are related to optimizing the computational overhead, reducing power consumption at the edge, and preserving the privacy of sensitive information, among others.This survey offers a clear bird’s eye view of the most recent design choices for DRL-based intrusion detection systems with a focus on the specific context of IoT. Our aim is not only to offer an exhaustive taxonomy of design alternatives made by DRL practitioners in the field of Intrusion detection, but also to discuss the advantages and the effective deployment of each setting concerning real IoT environments. We hope this work would guide the researchers interested in Intrusion Detection for IoTs to establish solid criteria for the most effective usage of Deep Reinforcement Learning in their future work.

A blockchain and stacked machine learning approach for malicious nodes’ detection in internet of things

A blockchain and stacked machine learning approach for malicious nodes’ detection in internet of things