The ever-expanding Internet of Things (IoT) landscape faces significant security challenges due to limitations in traffic monitoring, device heterogeneity, and weak security practices, leaving networks vulnerable to multi-target and coordinated attacks like large-scale botnets and Distributed Denial-of-Service (DDoS). Existing intrusion detection systems can be computationally expensive and resource-intensive. This can be problematic for resource-constrained IoT devices with limited processing power, memory, and battery life. This paper proposes MULTI-BLOCK, a novel, multi-module framework that leverages machine learning, stateful P4 processing, and a Software-Defined Networking (SDN)-based multi-controller architecture. MULTI-BLOCK tackles critical management tasks within IoT networks, including synchronized communication, traffic monitoring, intrusion detection, and attack mitigation. This comprehensive framework comprises four modules. The first, the proposed pyramidal conceptually decentralized multi-controller structure (PCDMCS), introduces Decentralized Control Interfaces (DCIs) for real-time threat identification through a Decentralized Warning Conduit (DWC). The second module provides comprehensive network monitoring using P4-enabled 24-state tables. The third module leverages 30 new P4-extracted/calculated features and the Enhanced Weighted Ensemble Algorithm (EWEA) for enhanced anomaly detection. The final module presents a novel mitigation approach with 22 steps distributed across multiple controllers for scalability. Extensive evaluation using established IoT datasets (X-IIoTID, TON_IoT, and Edge-IIoTset) and diverse test scenarios (including single-victim and multi-victim attacks) demonstrates MULTI-BLOCK's exceptional performance, achieving high accuracy (99.75 %), precision (99.32 %), F1-score (99.53 %), recall (99.67 %), specificity (99.60 %), low false positive rates (FPR) (0.40 %), and low Average Detection Time (ADT) (2.11 ms). By offering a robust and adaptable solution against evolving threats, MULTI-BLOCK represents a significant advancement in IoT network security.
Read full abstract