Attacks In Internet Of Things Research Articles

Securing IoT Attacks: A Machine Learning Approach for Developing Lightweight Trust-Based Intrusion Detection System

The routing process in the Internet of Things (IoT) presents challenges in industrial applications due to its complexity, involving multiple devices, critical decision-making, and accurate data transmission. The complexity further increases with dynamic IoT devices, which creates opportunities for potential intruders to disrupt routing. Traditional security measures are inadequate for IoT devices with limited battery capabilities. Although RPL (Routing Protocol for Low Energy and Lossy Networks) is commonly used for IoT routing, it remains vulnerable to security threats. This study aims to detect and isolate three routing attacks on RPL: Rank, Sybil, and Wormhole. To achieve this, a lightweight trust-based secured routing system is proposed, utilizing machine learning techniques to derive values for devices in new networks, where initial trust values are unavailable. The system demonstrates successful detection and isolation of attacks, achieving an accuracy of 98.59%, precision of 98%, recall of 99%, and f-score of 98%, thereby reinforcing its effectiveness. Attacker nodes are identified and promptly disabled, ensuring a secure routing environment. Validation on a generated dataset further confirms the reliability of the system.

Demystifying machine learning models of massive IoT attack detection with Explainable AI for sustainable and secure future smart cities

Smart cities rely heavily on Internet of Things (IoT) technology, which enables automation services through interconnected IoT devices. However, the widespread use of IoT applications in smart cities has resulted in security and privacy concerns that must be addressed to protect sensitive data. To safeguard smart cities from cyber attacks, learning theory-based automated attack-detection methods must be adopted. Various techniques have been proposed in the literature to create effective models for identifying IoT attacks. However, the majority of IoT detection algorithms have focused on only a few types of IoT attacks, and most IoT threat detection systems have used black-box deep learning models that lack interpretability to support their forecasts. This research aims to detect several types of large-scale attacks on IoT devices using the Extreme Gradient Boosting (XG-Boost) classifier and Explainable Artificial Intelligence (XAI) approaches. The proposed method not only improves the model’s performance but also increases trust in the model. The results of the experimental study on the IOTD20 dataset and XAI evaluation of each feature’s contribution to the model demonstrate that the proposed model can efficiently identify malicious attacks and threats, reducing IoT cybersecurity threats in smart cities.

Approach for Detecting Attacks on IoT Networks Based on Ensemble Feature Selection and Deep Learning Models.

The Internet of Things (IoT) has transformed our interaction with technology and introduced security challenges. The growing number of IoT attacks poses a significant threat to organizations and individuals. This paper proposes an approach for detecting attacks on IoT networks using ensemble feature selection and deep learning models. Ensemble feature selection combines filter techniques such as variance threshold, mutual information, Chi-square, ANOVA, and L1-based methods. By leveraging the strengths of each technique, the ensemble is formed by the union of selected features. However, this union operation may overlook redundancy and irrelevance, potentially leading to a larger feature set. To address this, a wrapper algorithm called Recursive Feature Elimination (RFE) is applied to refine the feature selection. The impact of the selected feature set on the performance of Deep Learning (DL) models (CNN, RNN, GRU, and LSTM) is evaluated using the IoT-Botnet 2020 dataset, considering detection accuracy, precision, recall, F1-measure, and False Positive Rate (FPR). All DL models achieved the highest detection accuracy, precision, recall, and F1 measure values, ranging from 97.05% to 97.87%, 96.99% to 97.95%, 99.80% to 99.95%, and 98.45% to 98.87%, respectively.

CNN-CNN: Dual Convolutional Neural Network Approach for Feature Selection and Attack Detection on Internet of Things Networks.

The Internet of Things (IoT) has brought significant advancements that have connected our world more closely than ever before. However, the growing number of connected devices has also increased the vulnerability of IoT networks to several types of attacks. In this paper, we present an approach for detecting attacks on IoT networks using a combination of two convolutional neural networks (CNN-CNN). The first CNN model is leveraged to select the significant features that contribute to IoT attack detection from the raw data on network traffic. The second CNN utilizes the features identified by the first CNN to build a robust detection model that accurately detects IoT attacks. The proposed approach is evaluated using the BoT IoT 2020 dataset. The results reveal that the proposed approach achieves 98.04% detection accuracy, 98.09% precision, 99.85% recall, 98.96% recall, and a 1.93% false positive rate (FPR). Furthermore, the proposed approach is compared with other deep learning algorithms and feature selection methods; the results show that it outperforms these algorithms.

Code Injection Attacks in Wireless-Based Internet of Things (IoT): A Comprehensive Review and Practical Implementations.

The Internet of Things (IoT) has transformed various domains in our lives by enabling seamless communication and data exchange between interconnected devices, necessitating robust networking infrastructure. This paper presents a comprehensive analysis of code injection attacks in IoT, focusing on the wireless domain. Code injection attacks exploit security weaknesses in applications or software and can have severe consequences, such as data breaches, financial losses, and denial of service. This paper discusses vulnerabilities in IoT systems and examines how wireless frames in state-of-the-art wireless technologies, which serve IoT applications, are exposed to such attacks. To demonstrate the severity of these threats, we introduce a comprehensive framework illustrating code injection attacks in the wireless domain. Several code injection attacks are performed on Wireless Fidelity (Wi-Fi) devices operating on an embedded system commonly used in IoT applications. Our proof of concept reveals that the victims' devices become further exposed to a full range of cyber-attacks following a successful severe code injection attack. We also demonstrate three scenarios where malicious codes had been detected inside the firmware of wireless devices used in IoT applications by performing reverse engineering techniques. Criticality analysis is conducted for the implemented and demonstrated attacks using Intrusion Modes and Criticality Analysis (IMECA). By understanding the vulnerabilities and potential consequences of code injection attacks on IoT networks and devices, researchers and practitioners can develop more secure IoT systems and better protect against these emerging threats.

CICIoT2023: A Real-Time Dataset and Benchmark for Large-Scale Attacks in IoT Environment.

Nowadays, the Internet of Things (IoT) concept plays a pivotal role in society and brings new capabilities to different industries. The number of IoT solutions in areas such as transportation and healthcare is increasing and new services are under development. In the last decade, society has experienced a drastic increase in IoT connections. In fact, IoT connections will increase in the next few years across different areas. Conversely, several challenges still need to be faced to enable efficient and secure operations (e.g., interoperability, security, and standards). Furthermore, although efforts have been made to produce datasets composed of attacks against IoT devices, several possible attacks are not considered. Most existing efforts do not consider an extensive network topology with real IoT devices. The main goal of this research is to propose a novel and extensive IoT attack dataset to foster the development of security analytics applications in real IoT operations. To accomplish this, 33 attacks are executed in an IoT topology composed of 105 devices. These attacks are classified into seven categories, namely DDoS, DoS, Recon, Web-based, brute force, spoofing, and Mirai. Finally, all attacks are executed by malicious IoT devices targeting other IoT devices. The dataset is available on the CIC Dataset website.

IoT Anomaly Detection with 1D CNN Using P4 Capabilities

Abstract Although the Internet of Things (IoT) is a rapidly developing technology, it also brings a number of security challenges, such as IoT attacks. Currently, research on IoT anomaly detection in Software-Defined Networking (SDN) relies only on the control plane. In this study, we aim to detect IoT anomalies by covering the advantages of the control and data plane. First, we collected real-time network telemetry data from the data plane based on the capabilities of the P4. Then, using this telemetry data, we built different anomaly detection models and compared their performance. Among them, the one-Dimensional Convolutional Neural Network (1D CNN) model classified our data best and showed the highest performance, so we proposed this model for IoT anomaly detection on the control plane. To our knowledge, our approach is the first solution that integrates the control plane and data plane for IoT anomaly detection. Finally, when evaluating the performance of our proposed 1D CNN model, the accuracy, F1 score, and Matthews correlation coefficient (MCC) are the same or better than existing studies.

Entropy-Based Feature Selection using Extra Tree Classifier for IoT Security

The Internet of Things (IoT) is a network of devices used for interconnection and data transfer. There is a dramatic increase in IoT attacks due to the lack of security mechanisms. The security mechanisms can be enhanced through the analysis and classification of these attacks. The multi-class classification of IoT botnet attacks (IBA) applied here uses a high-dimensional data set. The high-dimensional data set is a challenge in the classification process due to the requirements of a high number of computational resources. Dimensionality reduction (DR) discards irrelevant information while retaining the imperative bits from this high-dimensional data set. The DR technique proposed here is a classifier-based feature selection using an extra tree classifier (EXT). The entropy values of features are used for the construction of trees in EXT, which is to build a lower-dimensional space. Linear discriminant analysis (LDA), K-nearest neighbor classifier (KNN), decision tree classifier (DTC), and random forest classifier (RFC) empirically evaluate the proposed feature selection mechanism. EXT is compared with other DR techniques like RFC and principal component analysis (PCA). The performance metrics of the classifiers are used to evaluate the proposed work.

Few-shot IoT attack detection based on SSDSAE and adaptive loss weighted meta residual network

The Internet of Things (IoT) is an open and comprehensive network of smart objects. Unfortunately, it is also becoming increasingly vulnerable to security attacks during the increasing popularity of the IoT. It can lead traditional antivirus software to be less likely to prevent this threat. Therefore, it is necessary to design a model for the IoT attack detection. Current detection models are trained using massive big data samples. However, the distribution of traffic samples is few in specific scenarios. Also, existing models are also susceptible to noise interference in IoT environments, lowering detection efficiency and accuracy. In this work, we propose a few-shot IoT attack detection approach using a semi-supervised deep sparse autoencoder (SSDSAE) and an adaptive loss weighted meta residual network (ALWM-ResNet). First, an SSDSAE feature extraction model for local graph embedding is designed using local and non-local graph embedding constraints. Then, we design an ALWM-ResNet model to achieve IoT attack detection with few-shot samples under noise labels. A weighted function map is established using a weighted network and a meta-model, and weights are adaptively learned from the noise labels. Finally, we validate our approach using four IoT datasets. Several experimental results demonstrate the superior performance of our approach in IoT attack detection under few-shot samples.

Performance analysis of entropy variation-based detection of DDoS attacks in IoT

Internet of Things (IoT) comprises of connected devices that collaborate to perform numerous tasks individually and collectively to facilitate services to the users. Distributed denial of service attacks aim to exhaust the resources of the target by sending enormous inessential traffic from numerous sources. IoT systems, generally being a resource-constrained network, are highly vulnerable to DDoS attacks. We aim to achieve the detection of DDoS attacks by rule-based detection method using information theory metrics. Variation in entropy of traffic features beyond a threshold is an indicator of change in density of traffic to a network. In this paper, we present a performance analysis of different parameters associated with entropy variation-based detection of DDoS attacks. Three feature sets were used for studying the impact of entropy variation in detection. Further, we have analysed the three kinds of entropies used for the detection namely, Shannon entropy, generalized entropy, and ϕ-entropy. Along with that, threshold determination for entropy values have been done in two ways, i.e. [average−standarddeviation,average+standarddeviation] and [lower quartile, upper quartile]. We found that quartile-based threshold has generally given better recall and accuracy and more consistent results with respect to the window sizes. It is also found that ϕ-entropy has given overall better results as compared to the Shannon entropy and Generalized entropy. Therefore, a combination of ϕ-entropy and quartile-based threshold is found to be the best parameters to identify the DDoS attacks.

An Intelligent Intrusion Detection System for Internet of Things Attack Detection and Identification Using Machine Learning

The usability and scalability of Internet of things (IoT) technology are expanding in such a way that they facilitate human living standards. However, they increase the vulnerabilities and attack vectors over IoT networks as well. Thus, more security challenges could be expected and encountered, and more security services and solutions should be provided. Although many security techniques propose and promise good solutions for that intrusion detection systems IDSs still considered the best. Many works proposed machine learning (ML)-based IDSs for IoT attack detection and classification. Nevertheless, they suffer from two main gaps. First, few of the works utilized or could analyze an up-to-date version of IoT-based attack behaviors. Second, few of the works can be considered as multi-class attack detection and classification. Therefore, this work proposes an intelligent IDS (IIDS) by exploiting the ability of ML algorithms to classify and identify malicious from benign behaviors among IoT network packets. Three ML classifier algorithms are investigated, which are K-Nearest Neighbor, support vector machine, and artificial neural network. The developed models have been trained and tested as binary and multi-class classifiers against 15 types of attacks and benign. This work employs an up-to-date dataset known as IoT23, which covers millions of malicious and benign behaviors of IoT-connected devices. The process of developing the proposed IIDSs goes under different preprocessing phases and methods, such as null value solving, SMOTE method for the imbalanced datasets, data normalization, and feature selections. The results present IIDSs as good binary and multi-class classifiers even for zero-day attacks.

Cyber Security & IoT Vulnerabilities Threats Intruders and Attacks Research Review

The Internet of Things (IoT) is a system of various systems of hardware and software that is mostly dependent on online services and a variety of cutting-edge communication and sensing innovations. The introduction of 5G networks will see an increase in the global expansion of IoT, however security problems related to IoT innovation will additionally necessitate comprehensive analyses. This study will provide a comprehensive overview of the security difficulties in an Iot infrastructure, as well as current incidents of IoT technology assaults, interoperability used in IoT systems. For the inaugural study, all of the key aspects of IoT security are analysed and defined collectively. This study would be a great asset for prospective studies focusing on the creation of more secure IoT transmission methods for dealing with security and privacy in IoT.

A big data analytics for DDOS attack detection using optimized ensemble framework in Internet of Things

Internet of Things (IoT) devices significantly threaten tech-dependant businesses and communities. With the rapid integration of IoT devices into local networks, a system to identify and prevent malicious activity on these devices is essential. These devices' inherent mobility, nature, and intelligence highlight the importance of establishing secure boundaries to safeguard against potential threats. Along with expanding the Internet's ability to handle traffic, the number of IoT devices linked to the Internet has also grown. Due to this modification, conventional methodologies and outdated data processing methods are no longer adequate for attack detection. Due to the growth in network traffic, it is more challenging to identify IoT attacks and malicious data in their early phases. This paper proposes a paradigm for identifying malicious network traffic. The framework uses two well-known classification-based techniques for detecting malicious network traffic, including a Support Vector Machine (SVM) and deep neural network model, i.e., a Convolutional Neural Network (CNN) embedded with a Gated Recurrent Unit (GRU), which is tuned using a Slime Mould Algorithm (SMA) for improved accuracy of 98.45% and 94.84%. The proposed technique is used to analyse the KDD dataset, and the results are assessed in terms of specificity, prediction time, training, and accuracy. The experimental findings suggest that our proposed model can detect DDoS attacks in less time than current solutions.

An automatic complex event processing rules generation system for the recognition of real-time IoT attack patterns

The Internet of Things (IoT) has grown rapidly to become the core of many areas of application, leading to the integration of sensors, with IoT devices. However, the number of attacks against these types of devices has grown as fast as the paradigm itself. Certain inherent characteristics of the paradigm, as well as the limited computational capabilities of the devices involved, make it difficult to deploy security measures. This is why it is necessary to design, implement and study new solutions in the field of cybersecurity. In this paper, we propose an architecture that is capable of generating Complex Event Processing (CEP) rules automatically by integrating them with machine learning technologies. While the former is used to automatically detect attack patterns in real time, the latter, through the use of the Principal Component Analysis (PCA) algorithm, allows the characterization of events and the recognition of anomalies. This combination makes it possible to achieve efficient CEP rules at the computational level, with the results showing that the CEP rules obtained using our approach substantially improve upon the performance of the standard CEP rules, which are rules that are not generated by our proposal but can be defined independently by an expert in the field. Our proposal has achieved an F1-score of 0.98 on average, a 76 percent improvement in throughput over standard CEP rules, and a reduction in the network overhead of 86 percent over standard simple events, which are the simple events that are generated when our proposal is not used.

Guidance Framework for Developing IoT-Enabled Systems' Cybersecurity.

Internet of Things (IoT) faces security concerns different from existing challenges in conventional information systems connected through the Internet because of their limited resources and heterogeneous network setups. This work proposes a novel framework for securing IoT objects, the key objective of which is to assign different Security Level Certificates (SLC) for IoT objects according to their hardware capabilities and protection measures implemented. Objects with SLCs, therefore, will be able to communicate with each other or with the Internet in a secure manner. The proposed framework is composed of five phases, namely: classification, mitigation guidelines, SLC assignment, communication plan, and legacy integration. The groundwork relies on the identification of a set of security attributes, termed security goals. By performing an analysis on common IoT attacks, we identify which of these security goals are violated for specific types of IoT. The feasibility and application of the proposed framework is illustrated at each phase using the smart home as a case study. We also provide qualitative arguments to demonstrate how the deployment of our framework solves IoT specific security challenges.

Cryptography Algorithms for Enhancing IoT Security

In today's fast-paced world, a new technology paradigm known as the Internet of Things (IoT) is advancing every business. It provides communication between the digital and physical worlds, transforming the way people do business quickly. The IoT is a network of physical objects (things) equipped with sensors, intelligent networking, radio-frequency identification (RFID), and other technologies that communicate and exchange data with other systems and devices online. IoT applications are now significantly more prevalent worldwide. IoT is driving the real world to become more intelligent in several industries, including smart grids for electricity, intelligent traffic, and smart homes and buildings. As a result, predictions and research point to over 50 billion connected devices by 2020. It will be required to safeguard this growing volume of data during exchange because the amount of data being transmitted will be quite enormous. Data security is represented by cryptography, an essential tool (algorithms) in security, which is why many researchers are developing cryptographic algorithms to improve the Security of IoT. This survey paper introduced an overview of IoT technology, architecture, and applications and a detailed analysis comparing all cryptographic algorithms and their use in day-to-day life activities. This paper discusses lightweight block ciphers, stream ciphers, and hybrid ciphers. The report evaluates security algorithms, comparing performance and robustness with the computational complexity of these techniques. Finally, the survey presents IoT security challenges, threats, and attacks with their mitigation techniques.

A MEC-Based Architecture to Secure IoT Applications using Federated Deep Learning

Internet of Things (IoT) is a promising paradigm that is considered as major enabler of smart cities. However, with the emergence of IoT botnets, the number of unsecured IoT devices is increasing rapidly. This can give attackers more advanced tools to carry out large scale damaging IoT attacks. Advanced Machine Learning (ML) techniques can help enhance the effectiveness of conventional intrusion detection systems (IDS) to accurately detect IoT attacks. But there are ongoing challenges with centralized learning as well as the lack of up-to-date/ new datasets, covering key IoT attacks. In this context, we design a novel Multiple access Edge Computing (MEC) architecture to secure IoT applications with Federated Learning (FL). In particular, we propose a promising eDge-based architEcTure to sEcure IoT appliCations using FL, called DETECT. DETECT allows multiple MEC domains to collaboratively and securely mitigate IoT attacks, while ensuring the privacy of the MEC collaborator and consequently the privacy of IoT devices. The in-depth experiments results with well- known IoT attack using, the Edge-IIoTset and NSL-KDD datastets, show the significant accuracy of DETECT in terms of Accuracy (86 percent in NSL-KDD and 99 percent in Edge-IIoTset) and F1 score (87 percent in NSL-KDD and 99 percent in Edge-IIoTset).

Fog-cloud based intrusion detection system using Recurrent Neural Networks and feature selection for IoT networks

Deep learning (DL) techniques are being widely researched for their effectiveness in detecting cyber intrusions against the Internet of Things (IoT). Time sensitive Critical Infrastructures (CIs) that rely on IoT require rapid detection of cyber intrusions close to the constrained devices in order to prevent service delays. Deep learning techniques perform better in detecting attacks compared to shallow machine learning algorithms and can be used for intrusion detection. However, communication overheads due to large volume of IoT data and computation requirements for deep learning models prevents effective application of deep learning models closer to the constrained devices. Existing IDS techniques are either based on shallow learning algorithms or not trained on relevant IoT datasets and furthermore not designed for distributed fog-cloud deployment. To counter these issues, we propose a novel fog-cloud based IoT intrusion detection framework which incorporates a distributed processing by splitting the dataset according to attack class and a feature selection step on time-series IoT data. This is followed by a deep learning Recurrent Neural Network (SimpleRNN and Bi-directional Long Short-Term Memory (LSTM)) for attack detection. The effectiveness of the proposed approach was evaluated using the high-dimensional BoT-IoT dataset which contains large volumes of realistic IoT attack traffic. Results show that feature selection methods significantly reduced the dataset size by 90% under the computation requirements without compromising on the attack detection ability. The models built on reduced dataset achieved higher recall rate compared to models trained on full feature set without loosing class differentiation ability. The SimpleRNN and Bi-LSTM models also did not suffer any underfitting or overfitting with the reduced feature space. The proposed deep learning based IoT intrusion detection framework is suitable for fog-cloud based deployment and can scale well even with large volumes of IoT data.

A hybrid logistic DNA-based encryption system for securing the Internet of Things patient monitoring systems

The Internet of Things (IoT) plays a major role in healthcare, and high-end encryption schemes are needed to ensure data integrity and privacy in this industry. The security procedures and methodologies in the healthcare industry must be improved to combat various security breaches brought on by the IoT. The methodologies such as Advanced Encryption Systems (AES), Elliptic Curve Cryptography (ECC), and Data Encryption Schemes (DES) are used in IoT devices to ensure high-end security against counterfeit IoT attacks. The existing procedures and methodologies need brighter light of improvisation when transmitting medical data over the network. This study proposes a novel hybrid chaotic DNA and AES encryption methodology that combines the powerful features of 3D logistic chaotic maps and employs DNA operations in an AES system to provide more security against IoT attacks. Extensive experimentation is carried out using National Institute of Standard Technology (NIST) tests, and metrics tests such as Discrete Fourier Tests (DFT), Run length tests, and Frequency Monobit Tests are conducted and evaluated to determine the high randomness of the data and ensure high-security transmission. We show the suggested encryption technique outperforms the competing methods and is better suited for establishing high-level security for medical data transmission.

Anomaly based network intrusion detection for IoT attacks using deep learning technique

Internet of Things (IoT) applications are growing in popularity for being widely used in many real-world services. In an IoT ecosystem, many devices are connected with each other via internet, making IoT networks more vulnerable to various types of cyber attacks, thus a major concern in its deployment is network security and user privacy. To protect IoT networks against various attacks, an efficient and practical Intrusion Detection System (IDS) could be an effective solution. In this paper, a novel anomaly-based IDS system for IoT networks is proposed using Deep Learning technique. Particularly, a filter-based feature selection Deep Neural Network (DNN) model where highly correlated features are dropped has been presented. Further, the model is tuned with various parameters and hyper parameters. The UNSW-NB15 dataset comprising of four attack classes is utilized for this purpose. The proposed model achieved an accuracy of 84%. Generative Adversarial Networks (GANs) were used to generate synthetic data of minority attacks to resolve class imbalance issues in the dataset and achieved 91% accuracy with balanced class dataset.