A Critical Review of Practices and Challenges in Intrusion Detection Systems for IoT: Toward Universal and Resilient Systems

Benkhelifa, Elhadj; Welsh, Thomas; Hamouda, Walaa

doi:10.1109/comst.2018.2844742

Cited by 163 publications

(89 citation statements)

References 71 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Finally, an architecture-focused survey on IDS in IoT is carried out by Benkhelifa et al [132]. This survey highlights the existing protocols, detection methods, and points out the future research challenges in this direction.…”

Section: Anomaly/intrusion Detectionmentioning

confidence: 99%

Machine Learning in IoT Security: Current Solutions and Future Challenges

Hussain

Hassan

et al. 2020

IEEE Commun. Surv. Tutorials

557

270

View full text Add to dashboard Cite

The future Internet of Things (IoT) will have a deep economical, commercial and social impact on our lives. The participating nodes in IoT networks are usually resourceconstrained, which makes them luring targets for cyber attacks. In this regard, extensive efforts have been made to address the security and privacy issues in IoT networks primarily through traditional cryptographic approaches. However, the unique characteristics of IoT nodes render the existing solutions insufficient to encompass the entire security spectrum of the IoT networks. This is, at least in part, because of the resource constraints, heterogeneity, massive real-time data generated by the IoT devices, and the extensively dynamic behavior of the networks. Therefore, Machine Learning (ML) and Deep Learning (DL) techniques, which are able to provide embedded intelligence in the IoT devices and networks, are leveraged to cope with different security problems. In this paper, we systematically review the security requirements, attack vectors, and the current security solutions for the IoT networks. We then shed light on the gaps in these security solutions that call for ML and DL approaches. We also discuss in detail the existing ML and DL solutions for addressing different security problems in IoT networks. At last, based on the detailed investigation of the existing solutions in the literature, we discuss the future research directions for ML-and DL-based IoT security.

show abstract

Section: Anomaly/intrusion Detectionmentioning

confidence: 99%

Machine Learning in IoT Security: Current Solutions and Future Challenges

Hussain

Hassan

et al. 2020

IEEE Commun. Surv. Tutorials

557

270

View full text Add to dashboard Cite

show abstract

“…The standard benchmark dataset NSL-KDDand KDD Cup 99 are applied for evaluating the proposed system for network intrusion detection. Many literature works [10,11,16,28] have utilized this benchmark dataset for evaluating their research on intrusion detection. NSL-KDD, an enhanced dataset of the KDD CUP'99, was employed in this research work.…”

Section: Dataset Descriptionmentioning

confidence: 99%

“…Considering the plausible threats relevant to all of the aforementioned detection, the deployment of IDS is an absolute necessity that would provide efficient surveillance and also detect any malicious activity in the network data traffic [8]. There are typically five types of IDS deployment, namely [9][10][11][12][13]:…”

Section: Introductionmentioning

confidence: 99%

SMO-DNN: Spider Monkey Optimization and Deep Neural Network Hybrid Classifier Model for Intrusion Detection

et al. 2020

View full text Add to dashboard Cite

The enormous growth in internet usage has led to the development of different malicious software posing serious threats to computer security. The various computational activities carried out over the network have huge chances to be tampered and manipulated and this necessitates the emergence of efficient intrusion detection systems. The network attacks are also dynamic in nature, something which increases the importance of developing appropriate models for classification and predictions. Machine learning (ML) and deep learning algorithms have been prevalent choices in the analysis of intrusion detection systems (IDS) datasets. The issues pertaining to quality and quality of data and the handling of high dimensional data is managed by the use of nature inspired algorithms. The present study uses a NSL-KDD and KDD Cup 99 dataset collected from the Kaggle repository. The dataset was cleansed using the min-max normalization technique and passed through the 1-N encoding method for achieving homogeneity. A spider monkey optimization (SMO) algorithm was used for dimensionality reduction and the reduced dataset was fed into a deep neural network (DNN). The SMO based DNN model generated classification results with 99.4% and 92% accuracy, 99.5%and 92.7% of precision, 99.5% and 92.8% of recall and 99.6%and 92.7% of F1-score, utilizing minimal training time. The model was further compared with principal component analysis (PCA)-based DNN and the classical DNN models, wherein the results justified the advantage of implementing the proposed model over other approaches.

show abstract

“…In an IoT network, due to the complex environment, the different standards and communication stacks involved, the limited resources, as well as lack of a physical line of defense (i.e., there are no gateways or switches to monitor the information flow), traditional IDS techniques are difficult to apply. Current IDSs for IoT technologies is focused on the architecture type, and from this point of view, the future development direction of IoT IDS is proposed and evaluated [30]. Zarpelao [8] classified the IDSs into four attributes which include detection method, IDS placement strategy, security threat and validation strategy, and introduced the work of making specific IDS schemes for IoT or developing an attack detection strategy that may be embedded in IDSs.…”

Section: Idss For Iotmentioning

confidence: 99%

A Stackelberg Security Game for Adversarial Outbreak Detection in the Internet of Things

Chen

Wang

et al. 2020

Sensors

View full text Add to dashboard Cite

With limited computing resources and a lack of physical lines of defense, the Internet of Things (IoT) has become a focus of cyberattacks. In recent years, outbreak propagation attacks against the IoT have occurred frequently, and these attacks are often strategical. In order to detect the outbreak propagation as soon as possible, t embedded Intrusion Detection Systems (IDSs) are widely deployed in the IoT. This paper tackles the problem of outbreak detection in adversarial environment in the IoT. A dynamic scheduling strategy based on specific IDSs monitoring of IoT devices is proposed to avoid strategic attacks. Firstly, we formulate the interaction between the defender and attacker as a Stackelberg game in which the defender first chooses a set of device nodes to activate, and then the attacker selects one seed (one device node) to spread the worms. This yields an extremely complex bilevel optimization problem. Our approach is to build a modified Column Generation framework for computing the optimal strategy effectively. The optimal response of the defender's problem is expressed as mixed-integer linear programming (MILPs). It is proved that the solution of the defender's optimal response is a NP-hard problem. Moreover, the optimal response of defenders is improved by an approximate algorithm-a greedy algorithm. Finally, the proposed scheme is tested on some randomly generated instances. The experimental results show that the scheme is effective for monitoring optimal scheduling.Sensors 2020, 20, 804 2 of 20 with IoT devices, such as the medical systems [7]. To detect the worm outbreak propagation as soon as possible, we can collect potential threat data by deploying specific embedded Intrusion Detection Systems (IDSs) in the IoT [8,9]. Therefore, the rapid detection of the worm outbreak propagation in the IoT with limited resources by IDS has become an urgent problem to be solved. Herein, such IoT devices with embedded IDS are collectively referred to as "sensors". The "scheduling strategy" mentioned in the following chapters of this paper is mainly aimed at methods of "sensor" combination opening. MotivationGenerally, the initiator of outbreak propagation is a malicious party, and our goal is to detect the outbreak propagation as soon as possible. For example, in a water network, the problem is where should we place a limited number of sensors to quickly detect contaminants [10][11][12][13][14], while in smart power grids, what is concerned about is finding the failure node in a short time [15]. It is natural in these scenarios to consider the problem of adversarial outbreak detection (AOD), where the defender can first select a set of nodes to deploy sensors, and subsequently the attacker can choose the source of infection to spread malicious information. Although there have been many studies on the AOD problem [11,15], the scenario setting of these works (e.g., a water network setting) is different from our scenario and assumptions (e.g., cybersecurity settings and parameters). A common assumption in the e...

show abstract

A Critical Review of Practices and Challenges in Intrusion Detection Systems for IoT: Toward Universal and Resilient Systems

Cited by 163 publications

References 71 publications

Machine Learning in IoT Security: Current Solutions and Future Challenges

Machine Learning in IoT Security: Current Solutions and Future Challenges

SMO-DNN: Spider Monkey Optimization and Deep Neural Network Hybrid Classifier Model for Intrusion Detection

A Stackelberg Security Game for Adversarial Outbreak Detection in the Internet of Things

Contact Info

Product

Resources

About