Internet Of Things Datasets Research Articles

Anomaly Detection in IoT Networks: Machine Learning Approaches for Intrusion Detection

The proliferation of Internet of Things (IoT) devices has ushered in an era of unprecedented connectivity and innovation. However, this interconnected landscape also presents unique security challenges, necessitating robust intrusion detection mechanisms. In this research, we present a comprehensive study of anomaly detection in IoT networks, leveraging advanced machine learning techniques. Specifically, we employ the Gated Recurrent Unit (GRU) architecture as the backbone network to capture temporal dependencies within IoT traffic. Furthermore, our approach embraces hierarchical federated training to ensure scalability and privacy preservation across distributed IoT devices. Our experimental design encompasses public IoT datasets, facilitating rigorous evaluation of the model's performance and adaptability. Results indicate that our GRU-based model excels in identifying a spectrum of attacks, from Distributed Denial of Service (DDoS) incursions to SQL injection attempts. Visualizations of learning curves, Receiver Operating Characteristic (ROC) curves, and confusion matrices offer insights into the model's learning process, discriminatory power, and classification performance. Our findings contribute to the evolving landscape of IoT security, offering a roadmap for enhancing the resilience of interconnected systems in an era of increasing connectivity.

Network Intrusion Detection in Internet of Blended Environment Using Ensemble of Heterogeneous Autoencoders (E-HAE)

Contemporary attackers, mainly motivated by financial gain, consistently devise sophisticated penetration techniques to access important information or data. The growing use of Internet of Things (IoT) technology in the contemporary convergence environment to connect to corporate networks and cloud-based applications only worsens this situation, as it facilitates multiple new attack vectors to emerge effortlessly. As such, existing intrusion detection systems suffer from performance degradation mainly because of insufficient considerations and poorly modeled detection systems. To address this problem, we designed a blended threat detection approach, considering the possible impact and dimensionality of new attack surfaces due to the aforementioned convergence. We collectively refer to the convergence of different technology sectors as the internet of blended environment. The proposed approach encompasses an ensemble of heterogeneous probabilistic autoencoders that leverage the corresponding advantages of a convolutional variational autoencoder and long short-term memory variational autoencoder. An extensive experimental analysis conducted on the TON_IoT dataset demonstrated 96.02% detection accuracy. Furthermore, performance of the proposed approach was compared with various single model (autoencoder)-based network intrusion detection approaches: autoencoder, variational autoencoder, convolutional variational autoencoder, and long short-term memory variational autoencoder. The proposed model outperformed all compared models, demonstrating F1-score improvements of 4.99%, 2.25%, 1.92%, and 3.69%, respectively.

Explainable Intrusion Detection for Cyber Defences in the Internet of Things: Opportunities and Solutions

The field of Explainable Artificial Intelligence (XAI) has garnered considerable research attention in recent years, aiming to provide interpretability and confidence to the inner workings of state-of-the-art deep learning models. However, XAI-enhanced cybersecurity measures in the Internet of Things (IoT) and its sub-domains, require further investigation to provide effective discovery of attack surfaces, their corresponding vectors, and interpretable justification of model outputs. Cyber defence involves operations conducted in the cybersecurity field supporting mission objectives to identify and prevent cyberattacks using various tools and techniques, including intrusion detection systems (IDS), threat intelligence and hunting, and intrusion prevention. In cyber defence, especially anomaly-based IDS, the emerging applications of deep learning models require the interpretation of the models’ architecture and the explanation of models’ prediction to examine how cyberattacks would occur. This paper presents a comprehensive review of XAI techniques for anomaly-based intrusion detection in IoT networks. Firstly, we review IDSs focusing on anomaly-based detection techniques in IoT and how XAI models can augment them to provide trust and confidence in their detections. Secondly, we review AI models, including machine learning (ML) and deep learning (DL), for anomaly detection applications and IoT ecosystems. Moreover, we discuss DL’s ability to effectively learn from large-scale IoT datasets, accomplishing high performances in discovering and interpreting security events. Thirdly, we demonstrate recent research on the intersection of XAI, anomaly-based IDS and IoT. Finally, we discuss the current challenges and solutions of XAI for security applications in the cyber defence perspective of IoT networks, revealing future research directions. By analysing our findings, new cybersecurity applications that require XAI models emerge, assisting decision-makers in understanding and explaining security events in compromised IoT networks.

Deep learning-enabled anomaly detection for IoT systems

Internet of Things (IoT) systems have become an intrinsic technology in various industries and government services. Unfortunately, IoT devices and networks are known to be highly vulnerable to security attacks that target data integrity and service availability. Moreover, the heterogeneity of the data collected from various IoT devices, together with the disturbances incurred within the IoT system, render the detection of anomalous behavior and compromised nodes more challenging compared to traditional Information Technology (IT) networks. As a result, there is a pressing need for effective and reliable anomaly detection to identify malicious data to guarantee that they will not be used in IoT-driven decision support systems. In this paper, we propose a deep learning-powered anomaly detection for IoT that can learn and capture robust and useful features, which cannot be significantly affected by unstable environments. These features are then used by the classifier to enhance the accuracy of detecting malicious IoT data. More specifically, the proposed deep learning model is designed based on a denoising autoencoder, which is adopted to obtain features that are robust against the heterogeneous environment of IoT. Experimental results based on real-life IoT datasets show the effectiveness of the proposed framework in terms of enhancing the accuracy of detecting malicious data compared to the state-of-the-art IoT-based anomaly detection models.

An Intelligent Detection of Malicious Intrusions in IoT Based on Machine Learning and Deep Learning Techniques

The devices of the Internet of Things (IoT) are facing various types of attacks, and IoT applications present unique and new protection challenges. These security challenges in IoT must be addressed to avoid any potential attacks. Malicious intrusions in IoT devices are considered one of the most aspects required for IoT users in modern applications. Machine learning techniques are widely used for intelligent detection of malicious intrusions in IoT. This paper proposes an intelligent detection method of malicious intrusions in IoT systems that leverages effective classification of benign and malicious attacks. An ensemble approach combined with various machine learning algorithms and a deep learning technique, is used to detect anomalies and other malicious activities in IoT. For the consideration of the detection of malicious intrusions and anomalies in IoT devices, UNSW-NB15 dataset is used as one of the latest IoT datasets. In this research, malicious and normal intrusions in IoT devices are classified with the use of various models. %Moreover, improved results are provided and compared with CorrAuc [1] for training accuracies, cross-validation accuracies, execution time, precision, recall and F1 score.

An intelligent edge-enabled distributed multi-task learning architecture for large-scale IoT-based cyber–physical systems

Internet-of-Things (IoT)-based cyber–physical systems are increasingly being adopted because of the recent technological advancements in sensor technology, edge computing, machine learning, and big data. Integrating machine learning into designing IoT-based cyber–physical systems is essential. However, it is considered a challenging problem. This stems from the fact that IoT devices generate extensive data that requires extensive processing to achieve adequate learning. Relying on local learning by each IoT device is not feasible in most cases due to its limited resources. On the contrary, relying on all cloud-based learning requires transmitting a large amount of data to the cloud to perform the learning process, which is inefficient in large-scale IoT deployments. Therefore, this paper proposes a novel edge-computing architecture that employs the concept of distributed multi-task learning over EC networks in large-scale IoT-based cyber–physical systems. The architecture develops multiple distributed learning algorithms, a data placement architecture, task allocation algorithms, and a network protocol. In addition, it considers the problem of learning model parameters from IoT data distributed over different edge nodes in a large geographical area without sending raw data to the cloud. The architecture supports several distributed machine models that are trained using a combination of machine learning algorithms and population-based search algorithms to optimize the learning process. Population-based search algorithms allow for maintaining a set of candidate solutions, with each solution corresponding to a unique point in the search space for an optimal solution. Having the dataset distributed over several edge nodes, with each node having its own unique set of candidate solutions, increases the chance of finding a solution that generalizes well for the overall dataset combined. Simulation experiments with real IoT datasets are conducted to evaluate the accuracy of the proposed learning models. Results show the ability to achieve high-accuracy results that are close to single-machine models but with significantly efficient edge computing resource utilization.

An Internet of Things Botnet Detection Model Using Regression Analysis and Linear Discrimination Analysis

The Internet of Things (IoT) has become a hot area of research in recent years due to the significant advancements in the semiconductor industry, wireless communication technologies, and the realization of its ability in numerous applications such as smart homes, health care, control systems, and military. Furthermore, IoT devices inefficient security has led to an increase cybersecurity risks such as IoT botnets, which have become a serious threat. To counter this threat there is a need to develop a model for detecting IoT botnets. This paper's contribution is to formulate the IoT botnet detection problem and introduce multiple linear regression (MLR) for modelling IoT botnet features with discriminating capability and alleviating the challenges of IoT detection. In addition, a linear discrimination analysis (LDA) model for distinguishing between normal activities and IoT botnets was developed. Network-based detection of IoT (N-BaIoT) dataset was used to evaluate the performance of the proposed IoT botnet detection model in terms of accuracy, precision, and detection rate. Experimental results revealed that the proposed IoT botnet detection model provides a relevant feature subset and preserves high accuracy when compared with state-of-the-art and baseline methods, particularly LDA.

A novel fully convolutional neural network approach for detection and classification of attacks on industrial IoT devices in smart manufacturing systems

Recently, Internet of things (IoT) devices have been widely implemented and technologically advanced in manufacturing settings to monitor, collect, exchange, analyze, and deliver data. However, this transition has increased the risk of cyber-attacks, exponentially. Subsequently, developing effective intrusion detection systems based on deep learning algorithms has proven to become a reliable intelligence tool to protect Industrial IoT devices against cyber threats. This paper presents the implementation of two different classifications and detection utilizing the long short-term memory (LSTM) architecture to address cybersecurity concerns on three benchmark industrial IoT datasets (BoT-IoT, UNSW-NB15, and TON-IoT) which take advantage of various deep learning algorithms. An overall analysis of the performance of the proposed models is provided. Augmenting the LSTM with convolutional neural network (CNN) and fully convolutional neural network (FCN) achieves state-of-the-art performance in detecting cybersecurity threats.

Metaheuristics with federated learning enabled intrusion detection system in Internet of Things environment

AbstractBecause of increased applications of Internet of Things (IoT) environment in real‐time environment, confidential data gathered by the IoT devices are being communicated to the cloud environment to train the machine learning (ML) models in understanding the patterns that exist in the data. At the same time, the sensitive nature of the IoT data attracts malicious users into hacking efforts. An intrusion detection system (IDS) can be applied to ensure security in the IoT environment. In order to improve security, the ML models can be executed at the data source instead of centralized cloud server. Federated learning (FL) is a recent progression of ML model which enables the ML models to move into the data source rather than moving the data to centralized cloud and thereby resolves cybersecurity problems in the IoT environment. In this view, this study introduces an FL based IDS using bird swarm algorithm based feature selection with classification (FLIDS‐BSAFSC) model in IoT environment. The presented FLIDS‐BSAFSC model undergoes training on multiple aspects of IoT dataset in a decentralized format to classify, detect, and defend against attacks. The proposed FLIDS‐BSAFSC model initially applies min–max normalization technique to pre‐process the IoT data. Besides, BSA based feature selection (BSA‐FS) technique is designed to elect feature subsets. Finally, social group optimization algorithm with kernel extreme learning machine model is employed for identifying various kinds of classes. In the view of FL where the IoT dataset is not distributed to the server carries out profile aggregation competently with the advantage of peer learning. The experimental validation of the FLIDS‐BSAFSC model is tested using benchmark datasets and the results are inspected under several aspects. The experimental values highlighted the better performance of the FLIDS‐BSAFSC model over recent approaches.

HBFL: A hierarchical blockchain-based federated learning framework for collaborative IoT intrusion detection

The continuous strengthening of the security posture of Internet of Things (IoT) ecosystems is vital due to the increasing number of interconnected devices and the volume of sensitive data shared. Using Machine Learning (ML) capabilities to defend against IoT cyber attacks has many potential benefits. However, the currently proposed frameworks do not consider data privacy, secure architectures, and scalable deployments of IoT ecosystems. This paper proposes a hierarchical blockchain-based federated learning framework to enable secure and privacy-preserved collaborative IoT intrusion detection. We highlight and demonstrate the importance of sharing cyber threat intelligence among inter-organisational IoT networks to improve the model’s detection capabilities. The proposed ML-based intrusion detection framework follows a hierarchical federated learning architecture to ensure the privacy of the learning process and organisational data. The transactions (model updates) and processes will run on a secure blockchain, and the smart contract will verify the conformance of executed tasks. We have tested our solution and demonstrated its feasibility by implementing it and evaluating the intrusion detection performance using a key IoT data set. The outcome is a securely designed ML-based intrusion detection system capable of detecting a wide range of malicious activities while preserving data privacy.

IoT malware detection architecture using a novel channel boosted and squeezed CNN

Interaction between devices, people, and the Internet has given birth to a new digital communication model, the internet of things (IoT). The integration of smart devices to constitute a network introduces many security challenges. These connected devices have created a security blind spot, where cybercriminals can easily launch attacks to compromise the devices using malware proliferation techniques. Therefore, malware detection is a lifeline for securing IoT devices against cyberattacks. This study addresses the challenge of malware detection in IoT devices by proposing a new CNN-based IoT malware detection architecture (iMDA). The proposed iMDA is modular in design that incorporates multiple feature learning schemes in blocks including (1) edge exploration and smoothing, (2) multi-path dilated convolutional operations, and (3) channel squeezing and boosting in CNN to learn a diverse set of features. The local structural variations within malware classes are learned by Edge and smoothing operations implemented in the split-transform-merge (STM) block. The multi-path dilated convolutional operation is used to recognize the global structure of malware patterns. At the same time, channel squeezing and merging helped to regulate complexity and get diverse feature maps. The performance of the proposed iMDA is evaluated on a benchmark IoT dataset and compared with several state-of-the CNN architectures. The proposed iMDA shows promising malware detection capacity by achieving accuracy: 97.93%, F1-Score: 0.9394, precision: 0.9864, MCC: 0. 8796, recall: 0.8873, AUC-PR: 0.9689 and AUC-ROC: 0.9938. The strong discrimination capacity suggests that iMDA may be extended for the android-based malware detection and IoT Elf files compositely in the future.

Multigranulation-Based Granularity Selection for Intuitionistic Fuzzy Weighted Neighborhood IoT Data

Granular computing is to represent, construct, and process information granules formalized in many different approaches, and different formal approaches emphasize the same fundamental facet in different ways. In this paper, we present the multigranulation rough set models in the intuitionistic fuzzy neighborhood information system generated by Internet of Things (IoT) data with weighted features and develop the basic properties of the proposed models. Moreover, the multigranulation-based optimal granularity selection approach is established by introducing the concept of granularity significance. The experimental results on eight IoT datasets demonstrate that the proposed methods exhibit better efficiency by comparing three classical methods under the intuitionistic fuzzy weighted neighborhood information system.

When explainable AI meets IoT applications for supervised learning

This paper introduces a novel and complete framework for solving different Internet of Things (IoT) applications, which explores eXplainable AI (XAI), deep learning, and evolutionary computation. The IoT data coming from different sensors is first converted into an image database using the Gamian angular field. The images are trained using VGG16, where XAI technology and hyper-parameter optimization are introduced. Thus, analyzing the impact of the different input values in the output and understanding the different weights of a deep learning model used in the learning process helps us to increase interpretation of the overall process of IoT systems. Extensive testing was conducted to demonstrate the performance of our developed model on two separate IoT datasets. Results show the efficiency of the proposed approach compared to the baseline approaches in terms of both runtime and accuracy.

SETTI: A S elf-supervised Adv E rsarial Malware De T ection Archi T ecture in an I oT Environment

In recent years, malware detection has become an active research topic in the area of Internet of Things (IoT) security. The principle is to exploit knowledge from large quantities of continuously generated malware. Existing algorithms practise available malware features for IoT devices and lack real-time prediction behaviours. More research is thus required on malware detection to cope with real-time misclassification of the input IoT data. Motivated by this, in this article, we propose an adversarial self-supervised architecture for detecting malware in IoT networks, SETTI, considering samples of IoT network traffic that may not be labeled. In the SETTI architecture, we design three self-supervised attack techniques, namely, Self-MDS , GSelf-MDS, and ASelf-MDS . The Self-MDS method considers the IoT input data and the adversarial sample generation in real-time. The GSelf-MDS builds a generative adversarial network model to generate adversarial samples in the self-supervised structure. Finally, ASelf-MDS utilises three well-known perturbation sample techniques to develop adversarial malware and inject it over the self-supervised architecture. Also, we apply a defence method to mitigate these attacks, namely, adversarial self-supervised training, to protect the malware detection architecture against injecting the malicious samples. To validate the attack and defence algorithms, we conduct experiments on two recent IoT datasets: IoT23 and NBIoT. Comparison of the results shows that in the IoT23 dataset, the Self-MDS method has the most damaging consequences from the attacker’s point of view by reducing the accuracy rate from 98% to 74%. In the NBIoT dataset, the ASelf-MDS method is the most devastating algorithm that can plunge the accuracy rate from 98% to 77%.

A Generative Clustering Ensemble Model and Its Application in IoT Data Analysis

Data analysis is the foundation of Internet of Things (IoT) based applications, and clustering is an effective technology of data analysis. Clustering ensemble integrates multiple base clustering results to obtain a consensus result and thus improves the clustering performance in stability and robustness. However, it is difficult for existing clustering ensemble algorithms to achieve a satisfying ensemble result, when the base clustering results are unreliable. Concerning this problem, we develop a new clustering ensemble model in this paper, which has several advantages compared with traditional algorithms: (i) structure information about the data is effectively extracted from the base clusterings; (ii) data characteristics and structure information are integrated in an elegant fashion, in the production of the consensus clustering result; and (iii) our model has the generative ability that makes the model achieve outstanding performance when training samples are insufficient. In our model, the structural information is extracted by explicating the coupling relationships between base clusterings and between samples in clustering members. Then, data characteristics and structure information are combined in a generative graph representation learning framework. And the objectives of representation learning and consensus clustering are integrated into a unified optimization model, in which the prior distribution of the data is approximated by a Gaussian mixture model (GMM). Extensive experiments are conducted on multiple IoT datasets; the results prove that our model not only performs better than the conventional clustering ensemble algorithms but also outperforms the state-of-the-art deep clustering methods.

Dynamic graph embedding‐based anomaly detection on internet of things time series

AbstractAnomaly detection is critical in the internet of things (IoT) environment. To this issue, this study provides a novel approach for detecting anomalies in multivariate IoT time series. The proposed approach identified relationships between IoT time series to establish a dynamic graph and estimated the graph entropy to detect anomalies. The presented approach was applied to industrial IoT datasets. The results have shown that the presented method outperformed other models by 0.21 with respect to F1‐score. In addition, we used three distinct algorithms to detect the anomalies from the multivariate IoT time series. According to the results, the local outlier factor approach outperformed the others by 0.18 with respect to F1‐score.

Enhancing IoT anomaly detection performance for federated learning

Federated Learning (FL) with mobile computing and the Internet of Things (IoT) is an effective cooperative learning approach. However, several technical challenges still need to be addressed. For instance, dividing the training process among several devices may impact the performance of Machine Learning (ML) algorithms, often significantly degrading prediction accuracy compared to centralized learning. One of the primary reasons for such performance degradation is that each device can access only a small fraction of data (that it generates), which limits the efficacy of the local ML model constructed on that device. The performance degradation could be exacerbated when the participating devices produce different classes of events, which is known as the class balance problem. Moreover, if the participating devices are of different types, each device may never observe the same types of events, which leads to the device heterogeneity problem. In this study, we investigate how data augmentation can be applied to address these challenges and improving detection performance in an anomaly detection task using IoT datasets. Our extensive experimental results with three publicly accessible IoT datasets show the performance improvement of up to 22.9% with the approach of data augmentation, compared to the baseline (without relying on data augmentation). In particular, stratified random sampling and uniform random sampling show the best improvement in detection performance with only a modest increase in computation time, whereas the data augmentation scheme using Generative Adversarial Networks is the most time-consuming with limited performance benefits.

Different analytical frameworks and bigdata model for internet of things

Sensor devices used in internet of things (IoT) enabled environment produce large amount of data. This data plays a major role in bigdata landscape. In recent years, correlation, and implementation of bigdata and IoT is being extrapolated. Nowadays, predictive analytics is gaining attention of many researchers for big IoT data analytics. This paper summarizes different sort of IoT analytical platforms which consist in-built features for further use in machine learning, MATLAB, and data security. It emphasizes on different machine learning algorithms that plays important role in big IoT data analytics. Besides different analytical frameworks, this paper highlights the proposed model for bigdata in IoT domain and elaborates different forms of data analytical methods. Proposed model comprises different phases i.e., data storing, data cleaning, data analytics, and data visualization. These phases cover the basic characteristics of bigdata V’s model and most important phase is data analytics or big IoT analytics. This model is implemented using an IoT dataset and results are presented in graphical and tabular form using different machine learning techniques. This study enhances researchers’ knowledge about various IoT analytical platforms and usability of these platforms in their respective problem domains.

Data analytics of social media 3.0: Privacy protection perspectives for integrating social media and Internet of Things (SM-IoT) systems

With the rapid evolution of web technologies, Web 3.0 aims to expand on current and emerging social media platforms such as Facebook, Twitter, and TikTok, and integrate emerging computing paradigms, including the Internet of Things (IoT), named social media 3.0. The combinations of these platforms in Web 3.0 promises consumers greater integration, interaction, and more seamless movement between physical spaces. However, ensuring the privacy of data across such systems is a potential challenge in this space. In this study, we propose a new privacy-preserving social media 3.0 framework that illustrates the interaction of SM and IoT services and estimates how this interaction could impact users’ behaviors. The framework consists of three main components. First, a new relational dataset, named SM-IoT, is designed to dynamically connect users with their IoT services and assist in processing data heterogeneity. Second, a data pre-processing module is employed for filtering heterogeneous data and providing a certain level of privacy preservation on the data. Third, data analytics using different statistical and machine/deep learning methods are applied to examine data complexity and identify users’ behaviors. The results revealed that our proposed framework can efficiently identify users’ behaviors from social media 3.0 data sources. The outcomes of comparing our SM-IoT dataset with two other well-known SM datasets, namely Pokec and Renren, as well as Activity Recognition with Ambient Sensing (ARAS) IoT dataset reveals the fidelity of our dataset to be used for future evaluations of privacy-preserving and machine learning-based decision-making techniques.

A Lightweight Flow Feature-Based IoT Device Identification Scheme

Internet of Things (IoT) device identification is a key step in the management of IoT devices. The devices connected to the network must be controlled by the manager. For this purpose, many schemes are proposed to identify IoT devices, especially the schemes working on the gateway. However, almost all researchers do not pay close attention to the cost. Thus, considering the gateway’s limited storage and computational resources, a new lightweight IoT device identification scheme is proposed. First, the DFI (deep/dynamic flow inspection) technology is utilized to efficiently extract flow-related statistical features based on in-depth studies. Then, combined with symmetric uncertainty and correlation coefficient, we proposed a novel filter feature selection method based on NSGA-III to select effective features for IoT device identification. We evaluate our proposed method by using a real smart home IoT data set and three different ML algorithms. The experimental results showed that our proposed method is lightweight and the feature selection algorithm is also effective, only using 6 features can achieve 99.5% accuracy with a 3-minute time interval.