Lightweight Intrusion Detection Research Articles

A Generalized Lightweight Intrusion Detection Model With Unified Feature Selection for Internet of Things Networks

ABSTRACTThe applicability of the Internet of Things (IoT) cutting across different domains has resulted in newer “things” acquiring IP connectivity. These things, technically known as IoT devices, are vulnerable to diverse security threats. Consequently, there has been an exponential increase in IoT malware over the past 5 years, and securing IoT devices from such attacks is a pressing concern in the current era. However, the traditional peripheral security measures do not comply with the lightweight security requirements of the IoT ecosystem. Considering this, we propose a lightweight intrusion detection model for IoT networks (LIDM‐IoT) that demonstrates similar efficiency in exposing malicious activities compared with the existing computationally expensive methods. The crux of the proposed model is that it provides efficient attack detection with lower computational requirements in IoT networks. LIDM‐IoT achieves the feat through a novel unified feature selection strategy that unifies filter‐based and embedded feature selection methods. The proposed feature selection strategy reduces the feature space by 94%. Also, we use only the records of a single attack type to build the model using the XGBoost algorithm. We have tested LIDM‐IoT with unseen attack types to ensure its generalized behavior. The results indicate that the proposed model exhibits efficient attack detection, with a reduced feature set, in IoT networks compared with the state‐of‐the‐art models.

Optimized common features selection and deep-autoencoder (OCFSDA) for lightweight intrusion detection in Internet of things

Embedded systems, including the Internet of things (IoT), play a crucial role in the functioning of critical infrastructure. However, these devices face significant challenges such as memory footprint, technical challenges, privacy concerns, performance trade-offs and vulnerability to cyber-attacks. One approach to address these concerns is minimising computational overhead and adopting lightweight intrusion detection techniques. In this study, we propose a highly efficient model called optimized common features selection and deep-autoencoder (OCFSDA) for lightweight intrusion detection in IoT environments. The proposed OCFSDA model incorporates feature selection, data compression, pruning, and deparameterization. We deployed the model on a Raspberry Pi4 using the TFLite interpreter by leveraging optimisation and inferencing with semi-supervised learning. Using the MQTT-IoT-IDS2020 and CIC-IDS2017 datasets, our experimental results demonstrate a remarkable reduction in the computation cost in terms of time and memory use. Notably, the model achieved an overall average accuracies of 99% and 97%, along with comparable performance on other important metrics such as precision, recall, and F1-score. Moreover, the model accomplished the classification tasks within 0.30 and 0.12 s using only 2KB of memory.

A lightweight Intrusion Detection for Internet of Things‐based smart buildings

AbstractThe integration of Internet of Things (IoT) devices into commercial or industrial buildings to create smart environments, such as Smart Buildings (SBs), has enabled real‐time data collection and processing to effectively manage building operations. Due to poor security design and implementation in IoT devices, SB networks face an array of security challenges and threats (e.g., botnet malware) that leverage IoT devices to conduct Distributed Denial of Service (DDoS) attacks on the Internet infrastructure. Machine Learning (ML)‐based traffic classification systems aim to automatically detect such attacks by effectively differentiating attacks from benign traffic patterns in IoT networks. However, there is an inherent accuracy‐efficiency tradeoff in network traffic classification tasks. To balance this tradeoff, we develop an accurate yet lightweight device‐specific traffic classification model. This model classifies SB traffic flows into four types of coarse‐grained flows, based on the locations of traffic sources and the directions of traffic transmissions. Through these four types of coarse‐grained flows, the model can extract simple yet effective flow rate features to conduct learning and predictions. Our experiments find the model to achieve an overall accuracy of 96%, with only 32 features to be learned by the ML model.

M-RL: A mobility and impersonation-aware IDS for DDoS UDP flooding attacks in IoT-Fog networks

The Internet of Things (IoT) has recently received a lot of attention from the information and communication technology community. It has turned out to be a crucial development for harnessing the incredible power of wireless media in the real world. The nature of IoT-Fog networks requires the use of defense techniques who are light and mobile-aware. The edge resources in such a distributed environment are open to various safety hazards. DDoS UDP flooding attacks are the most frequent threats to edge resources in IoT-Fog networks. It is crucial for sabotaging fog gateways and can overcome traditional data filtering techniques. This paper introduces M-RL, a lightweight intrusion detection system with mobility awareness that can detect DDoS UDP flooding attacks while taking into account adversarial IoT devices that engage in IP spoofing. To this end, this paper analyzes the malicious behaviors that result in anonymity against Rate Limiting and Received Signal Strength (RSS)-based approaches, combines their advantages, and addresses their vulnerabilities. We test our method in different contexts to achieve that goal, and we find that it may decrease the accuracy of the RL, RSS, and RSS-RL methods to 70%, 48.9%, and 64.3%, respectively. The outcomes demonstrate the proposed approach's resistance to software-based source address forgery, impersonation, and signal modification. It offers more than 99% accuracy and supports node mobility. In this case, the best possible accuracy of the previous methods is 77%.

Lightweight Intrusion Detection Using Reservoir Computing

Lightweight Intrusion Detection Using Reservoir Computing

A Lightweight Intrusion Detection System Using a Finite Dirichlet Mixture Model With Extended Stochastic Variational Inference

A Lightweight Intrusion Detection System Using a Finite Dirichlet Mixture Model With Extended Stochastic Variational Inference

Lightweight Intrusion Detection Method of Vehicle CAN Bus under Computational Resource Constraints

In order to improve the security protection performance of the vehicle Controller Area Network (CAN) bus, the research builds an adaptive lightweight intrusion detection algorithm based on the limited computing and storage resources of the on-board ECU environment and the message cycle characteristics to supervise and detect the vehicle CAN bus intrusion. The results showed that the message cycle-based adaptive intrusion detection algorithm had high accuracy and recall rate, and fast computational search efficiency, with a stable detection time of less than 3 seconds. The intrusion detection capability is continuously optimized as the training time increases, and after stabilization, the resource utilization rate reaches over 95% with a throughput of 100Mb/s. The algorithm has strong protection capabilities. The average vehicle CPU usage of the algorithm is only 4.76%, which is 10.17% lower than the intrusion detection algorithm based on support vector machines. It can effectively prevent interference with the normal operation of the vehicle CAN bus. The algorithm has high detection accuracy for interrupt type attacks, and there are no false positives or missed alarms. For injection type attacks, the probability of missed alarms is less than 1%. The intrusion detection of vehicle CAN bus based on the message cycle characteristics provides technical reference for the safety and stability of the vehicle network, and has important practical value for the intelligent and networked development of the automobile industry.

Designing accurate lightweight intrusion detection systems for IoT networks using fine-tuned linear SVM and feature selectors

Intrusion detection systems (IDSs) play a crucial role in ensuring the security and integrity of Internet of Things (IoT) networks by blocking unwanted packets and facilitating secure traffic flow. However, traditional IDSs based on data mining, fuzzy logic, heuristics, rough sets, or conventional machine learning (ML) techniques often lack accuracy and are not energy efficient, primarily due to inappropriate feature selection or the use of all features in datasets. To address these challenges, this study proposes a lightweight, accurate, and high-performance IDSs for IoT networks using fine-tuned Linear Support Vector Machines (LSVMs) and feature selection methods. Four feature selectors, including Importance Coefficient-, Forward- and Backward-Sequential-, and Correlation Coefficient-based approaches, were applied to identify the most important and efficient features from three datasets: KDD Cup-1999, BotIoT-2018, and N-BaIoT-2021. The fine-tuned LSVMs algorithm was then trained on subsets of the selected and full features of the datasets to detect various IoT botnet attacks. Evaluation results show that the IDS models trained with subsets of relevant features outperform those trained with the full feature sets of the datasets in terms of training and test performance and accuracy. The study concludes that it is possible to develop lightweight IDSs by training them with a reduced number of features (6) instead of using the full features (40, 15, 115) in KDD Cup-1999, BotIoT-2018, and N-BaIoT-2021, respectively. The findings highlight a potential for significantly improving the efficiency and accuracy of IDSs on IoT networks using the fine-tuned feature selectors and LSVMs.

Intrusion Detection Based on Feature Reduction and Model Pruning in Electricity Trading Network

<p>The electricity trading network increases network flexibility and lowers trading costs with the aid of 5G and IOT technology. While it has improved trading efficiency and enhanced system intelligence, its security vulnerabilities pose significant challenges. In this study, we propose an intrusion detection method that focuses on feature reduction and model pruning in electricity trading network. The method effectively addresses the imbalance issue of the IDS2017 dataset by employing the SMOTE algorithm, reduces feature size and computational complexity through the application of PCA, autoencoder, and random forest techniques, and develops a lightweight intrusion detection model specifically designed for electricity trading network using model pruning and compression techniques. Experimental results demonstrate the effectiveness of the proposed model in detecting intrusions. The achieved precision, recall, F1 score, and false positive rate are at least 98.8%, 87.9%, 90.0%, and 0.08%, respectively. Furthermore, we conducted a comparative analysis of different pruning thresholds and determined that reducing the dimensionality to 49 dimensions yields superior model performance, making it particularly suitable for resource-constrained electricity trading network.</p> <p> </p>

A lightweight intrusion detection method for IoT based on deep learning and dynamic quantization.

Intrusion detection ensures that IoT can protect itself against malicious intrusions in extensive and intricate network traffic data. In recent years, deep learning has been extensively and effectively employed in IoT intrusion detection. However, the limited computing power and storage space of IoT devices restrict the feasibility of deploying resource-intensive intrusion detection systems on them. This article introduces the DL-BiLSTM lightweight IoT intrusion detection model. By combining deep neural networks (DNNs) and bidirectional long short-term memory networks (BiLSTMs), the model enables nonlinear and bidirectional long-distance feature extraction of complex network information. This capability allows the system to capture complex patterns and behaviors related to cyber-attacks, thus enhancing detection performance. To address the resource constraints of IoT devices, the model utilizes the incremental principal component analysis (IPCA) algorithm for feature dimensionality reduction. Additionally, dynamic quantization is employed to trim the specified cell structure of the model, thereby reducing the computational burden on IoT devices while preserving accurate detection capability. The experimental results on the benchmark datasets CIC IDS2017, N-BaIoT, and CICIoT2023 demonstrate that DL-BiLSTM surpasses traditional deep learning models and cutting-edge detection techniques in terms of detection performance, while maintaining a lower model complexity.

Stochastic gradient descent classifier-based lightweight intrusion detection systems using the efficient feature subsets of datasets

The Internet of Things (IoT) has become an essential part of our daily lives. However, with the increasing use of IoT, the number of botnet attacks targeting resource-constrained IoT devices is also on the rise. To mitigate these threats, intrusion detection systems (IDSs) have been developed. However, traditional IDSs based on heavyweight deep/machine learning, fuzzy logic, rough set theories, or data mining techniques, often lack in detection accuracy and energy efficiency. Therefore, there is a crucial need for more lightweight, accurate, and energy-efficient IDSs capable of detecting a broad spectrum of cyber attacks. This paper presents a solution to these challenges by introducing lightweight and accurate IDSs that use a stochastic gradient descent classifier (SGDC) and four feature-selection algorithms based on a ridge regressor. The hyperparameters of the SGDC algorithm and ridge regressor model were fine-tuned to enhance the accuracy of IDSs while reducing computational complexity. Moreover, the fine-tuned feature selectors were used to decrease the dataset’s dimensionality and improve the accuracy of IDSs. To evaluate the proposed IDSs, three network traffic datasets (KDD-CUP-1999, BotIoT-2018, and N-BaIoT-2021) were used. The systems achieved an average accuracy of 92.69%, and the number of features was reduced by an average of 79.93%. The results demonstrate that the proposed systems can be utilized for lightweight IDSs on resource-constrained IoT devices. Overall, this paper presents a significant contribution to the field of IDSs for IoT devices by offering an efficient and accurate solution. The proposed lightweight IDSs have the potential to enhance IoT security and privacy, safeguarding sensitive IoT data.

A Lightweight Model for DDoS Attack Detection Using Machine Learning Techniques

The study in this paper characterizes lightweight IoT networks as being established by devices with few computer resources, such as reduced battery life, processing power, memory, and, more critically, minimal security and protection, which are easily vulnerable to DDoS attacks and propagating malware. A DDoS attack detection model is crucial for attacks in various industries, ensuring the availability and reliability of their networks and systems. The model distinguishes between legitimate and malicious traffic by analyzing network traffic patterns and identifying anomalies. This safeguards critical infrastructure, preserves business continuity, and protects the user experience, minimizing the impact of DDoS attacks. Numerous scholars have studied the notion that protecting lightweight IoT networks essentially requires improving intrusion detection systems. This research is valuable, as it follows a tailored pre-processing methodology specific to IoT network challenges, addressing a pressing need in cybersecurity by focusing on a growing concern related to IoT devices and DDoS attacks, enhancing the security of essential network systems in various industries by effectively detecting DDoS attacks, and developing a lightweight intrusion detection system that aligns with the limited resources of IoT devices. This manuscript proposes a compact and lightweight intrusion detection system that blends machine learning classifiers with a fresh approach to data pre-processing. The handling of missing values, data standardization using Standard Scalar, feature selection using ExtraTreeClassifier wherein only the 15 best features are extracted, and anomaly detection using a classifier are performed. The network dataset of TON-IOT and BOT-IOT datasets is used for experiments, specifically binary classifications and multiple-class classification for the experiment with DDoS and all attacks, respectively. There is an imbalance between the TON-IOT and BOT-IOT attack classes. In trials using the TON-IOT and BOT-IOT datasets, the classes were balanced using several iterations of the SMOTE approach. This research provides a number of classifier types, namely logistic regression, random forest, naïve bayes, artificial neural network, and k nearest neighbor algorithms, which are used to build a lightweight intrusion detection system that is ideally suited for protecting against DDoS attacks in IoT networks. The time taken to train and predict the DDoS attacks is also implemented. Random forest performed well under TON-IOT and naïve bayes performed well under BOT-IOT under binary and multiple-class classification, achieving an accuracy of 100% with less training and prediction time.

A lightweight intrusion detection system for internet of vehicles based on transfer learning and MobileNetV2 with hyper-parameter optimization

A lightweight intrusion detection system for internet of vehicles based on transfer learning and MobileNetV2 with hyper-parameter optimization

Improving IoT Security using Lightweight Based Deep Learning Protection Model

The Internet of Things (IoT) has recently become an essential ingredient of human life. The main critical challenges that confront IoT are security and protection. Several methods have been developed to protect the IoT; among these methods is Intrusion Detection System (IDS) Deep Learning-based. On the other hand, these types of IDS have a complex operation that takes a long time when applied on IoT devices and is inconvenient for a massive system that includes many connected devices. Thus, this paper suggested a Lightweight Intrusion Detection System (LIDS) IoT model that depends on deep learning using a Multi-Layer Perceptron (MLP) network. LIDS has the following characteristics lightweight, high accuracy, high speed in detection, and deals with a few features in MQTT protocol. The MQTTset dataset was used in training, validating, and testing the proposed model to investigate the performance of the proposed LIDS. The achieved performance ratios for the proposed LIDS, as measured by accuracy and F1-score. The experiment results showed that for the balanced MQTTset dataset, the number of obtained features was 15 with accuracy (95.06) and F1_score (95.31). Also, for the imbalanced MQTTset, the number of obtained features was 12 with accuracy (96.97) and F1-score (98.24). The obtained results have shown the deep learning efficiency role in improving the accuracy of an intrusion detection model by approximately 3.5% compared to other methods in the literature. In addition, the proposed methods reduced the number of features by around 50% of the total number of features, leading to a LIDS operating in a constrained environment.

Threats Detection in IoT Network

The recent growth in Internet of Things (IoT) deployment has increased the rapidness of integration and extended the reach of the internet from computers, tablets, and phones to countless devices in our physical world. This growth makes our life more convenient and industries more efficient. However, at the same time, it brought numerous challenges in terms of security and expanded the area of cyber-attacks, especially the DoS and DDoS attacks. Moreover, since many IoT devices run custom or outdated operating systems, and most do not have enough resources to run typical intrusion detection systems, it was necessary to search for alternative solutions. Therefore, many researchers have joined the race to develop new lightweight intrusion detection methods. In this study, we have investigated the detection of different DoS attacks on the IoT network using machine learning techniques. The studied attacks are TCP Syn-Flood Attack, UDP Flood Attack, HTTP Slowloris GET Attack, Apache Range Header DoS, and Port Scan attack. We have proposed a new dataset, namely HEIoT21, which was generated in a real smart home environment using a collective of IoT devices and non-IoT devices connected to a wireless network. The proposed dataset included normal and anomaly data, and using the CiCflowmeter application, we extracted 82 network features from the proposed dataset. The dataset was labeled and categorized into binary-class and multi-class. Our dataset underwent multiple feature selection methods to keep only enough features to produce a good detection accuracy; for that, we have used Anova F-value Feature Selection, Random Forest importance feature selection, and Sequential Forward Feature Selection. The feature selection techniques produced three new sub-datasets, which were evaluated using multiple machine learning algorithms like Logistic Regression (LR), J48 Decision Tree (DT), Naïve Bayes, and Artificial Neural Network (ANN). A comparison study was conducted on the result obtained from applying the different machine learning algorithms on the derived sub-datasets, which led to the finding that the most suitable feature selection technique for the proposed dataset was Anova F-value and the best-fit machine learning algorithm for the proposed dataset was The Decision Tree which produced an accuracy result of 99.92% for binary classification and 99.94% for multi-class classification. 
 In the end, our study was compared with other studies in the field of IoT intrusion detection, and we found that the result obtained through this study was higher than most others. Therefore, the proposed dataset could be of great use to those who want to work on the analysis and detection of the existing network security threats. Also, this study can be considered a cornerstone for a proper lightweight intrusion detection system, where the datasets can be expanded to include other types of attacks, new detection rules can be added, and an alert mechanism can be integrated to become a complete detection system.

Lightweight Intrusion Detection Model of the Internet of Things with Hybrid Cloud-Fog Computing

While promoting the development of the Internet of Things, cloud-fog hybrid computing faces severe information security risks. The intrusion detection system deployed in the fog node has lower latency but needs to be more lightweight. In response to the abovementioned problems, this paper proposes a lightweight intrusion detection model based on ConvNeXt-Sf. First, the two-dimensional structure of the latest computer vision model ConvNeXt is reduced to a one-dimensional sequence. Then, the design criteria of the lightweight computer vision model ShuffleNet V2 are used to improve ConvNeXt to make the latter more lightweight. Finally, the max-min normalization and label encoder are built into the data preprocessing model to convert the network traffic into a form conducive to ConvNeXt learning. The proposed model is evaluated on the TON-IoT and BoT-IoT datasets. The params of ConvNeXt-Sf are only 1.25% of that of ConvNeXt. Compared with the ConvNeXt, the ConvNeXt-Sf shortens the training time and prediction time by 82.63% and 56.48%, respectively, without reducing the learning capability and detection capability. Compared with the traditional models, the accuracy of the proposed model is increased by 6.18%, and the FAR is decreased by 4.49%. Compared with other lightweight models, the ShuffleNet V2 is better at making ConvNeXt lightweight.

Distributed Authentication in a Multi-Zone Direct Acyclic Graph Blockchain for IoT Environment

This research paper presents an indepth examination of the security aspects of the Multiple Zone Direct Acyclic Graph Blockchain (MZ-DAG Blockchain) framework. The MZ-DAG Blockchain features a security layer that implements a non-clonable physical function-based validation mechanism for the authentication of multiple certificates within the blockchain. To enhance the security of this layer, this study proposes the integration of a lightweight intrusion detection system specifically designed for the MZ-DAG Blockchain. This work is a contribution to the ongoing efforts to secure and streamline the implementation of blockchain networks in resourceconstrained environments.

Implementation of intrusion detection model for DDoS attacks in Lightweight IoT Networks

Protecting IoT networks and infrastructure is one of the top priorities in today’s computing industry because of the unnerving and exponential development in cyberattacks and security breaches in IoT. Lightweight IoT networks had been one of the easiest targets for attackers in botnet formation and distributing malware. The research in the paper identifies IoT networks formed by devices with minimal computing resources, such as less battery life, processing power, memory, and more importantly, minimal security, protecting infrastructure, and defense mechanisms, as being lightweight IoT networks that are easily vulnerable to DDoS attacks and disseminating malware. It is investigated by many researchers that development and progress in intrusion detection systems is the need of an hour to safeguard lightweight IoT networks. The manuscript proposes a lightweight Intrusion detection system with a novel data pre-processing technique while using machine learning and deep learning classifiers. The manuscript introduces various types of classifiers, employed to form lightweight intrusion detection systems well suited for protection against Distributed Denial of Services attacks in IoT networks. The datasets used for the experiments and investigation are BOT-IoT and the Network dataset of TON-IoT by the University of New South Wales Sydney (UNSW) Australia. DDoS attack instances are derived from both datasets. Two different experiments are performed on each dataset i.e.; for binary classifications of attack labels, one experiment for all attacks, and another experiment for the DDoS attack only in both datasets. Attack classes in the BOT-IoT dataset compared with the TON-IoT dataset are highly imbalanced. We have used Synthetic Minority oversampling Technique (Smote()) variants for class balancing in the experiments performed on the BOT-IoT dataset.

Towards achieving lightweight intrusion detection systems in Internet of Things, the role of incremental machine learning: A systematic literature review

While the benefits of IoT cannot be overstated, its computational constraints make it challenging to deploy security methodologies that have been deployed in traditional computing systems. The benefits and computational constraints have made IoT systems attractive to cyber-attacks. One way to mitigate these attacks is to detect them. In this study, a Systematic Literature Review (SLR) has been conducted to analyze the role of incremental machine learning in achieving lightweight intrusion detection for IoT systems. The study analyzed existing incremental machine learning approaches used in designing intrusion detection systems for IoT ecosystems, emphasizing the incremental methods used in detecting intrusions, the datasets used to evaluate these methods, and how the method achieves lightweight status. The SLR outlined the contributions of each study, focusing on their strengths and gaps, the datasets used, and the incremental machine learning model used. This study revealed that incremental learning approaches in detecting intrusion in IoT systems are in their infant stage. Over 12 years, from 2010 to 2022, a total of twenty-one (21) studies were carried out in IDSs using incremental machine learning, with eight (8) studies carried out in IoT systems. In addition to reviewing the literature, we offer suggestions for improving existing solutions and achieving lightweight IDS for IoT systems. We also discussed some problems with making lightweight IDS for IoT systems and areas where more research could be done in the future.

Planet Optimization with Deep Convolutional Neural Network for Lightweight Intrusion Detection in Resource-Constrained IoT Networks

Cyber security is becoming a challenging issue, because of the growth of the Internet of Things (IoT), in which an immense quantity of tiny smart gadgets push trillions of bytes of data over the Internet. Such gadgets have several security flaws, due to a lack of hardware security support and defense mechanisms, thus, making them prone to cyber-attacks. Moreover, IoT gateways present limited security features for identifying such threats, particularly the absence of intrusion detection techniques powered by deep learning (DL). Certainly, DL methods need higher computational power that exceeds the capability of such gateways. This article focuses on the development of Planet Optimization with a deep convolutional neural network for lightweight intrusion detection (PODCNN-LWID) in a resource-constrained IoT environment. The presented PODCNN-LWID technique primarily aims to identify and categorize intrusions. In the presented PODCNN-LWID model, two major processes are involved, namely, classification and parameter tuning. At the primary stage, the PODCNN-LWID technique applies a DCNN model for the intrusion identification process. Next, in the second stage, the PODCNN-LWID model utilizes the PO algorithm as a hyperparameter tuning process. The experimental validation of the PODCNN-LWID model is carried out on a benchmark dataset, and the results are assessed using varying measures. The comparison study reports the enhancements of the PODCNN-LWID model over other approaches.