A Machine Learning-Based Lightweight Intrusion Detection System for the Internet of Things

Fenanir, Samir; Semchedine, Fouzi; Baadache, Abderrahmane

doi:10.18280/ria.330306

Cited by 39 publications

(22 citation statements)

References 23 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Figure 2 presents an overview of machine learning approaches based on their learning styles in lightweight techniques. The techniques of machine learning tend to be effective with regard to the improvement of detection rate and the reduction of false alarm rates and offer decreased communicating and computing costs [56,66]. The techniques of machine learning can be split into different phases, including supervised, unsupervised, and semi-supervised learning [67,68] and Reinforcement Learning (RL) [69].…”

Section: Machine Learning Techniques For Ids On Iotmentioning

confidence: 99%

Classifier Performance Evaluation for Lightweight IDS Using Fog Computing in IoT Security

et al. 2021

View full text Add to dashboard Cite

In this article, a Host-Based Intrusion Detection System (HIDS) using a Modified Vector Space Representation (MVSR) N-gram and Multilayer Perceptron (MLP) model for securing the Internet of Things (IoT), based on lightweight techniques and using Fog Computing devices, is proposed. The Australian Defence Force Academy Linux Dataset (ADFA-LD), which contains exploits and attacks on various applications, is employed for the analysis. The proposed method is divided into the feature extraction stage, the feature selection stage, and classification modeling. To maintain the lightweight criteria, the feature extraction stage considers a combination of 1-gram and 2-gram for the system call encoding. In addition, a Sparse Matrix is used to reduce the space by keeping only the weight of the features that appear in the trace, thus ignoring the zero weights. Subsequently, Linear Correlation Coefficient (LCC) is utilized to compensate for any missing N-gram in the test data. In the feature selection stage, the Mutual Information (MI) method and Principle Component Analysis (PCA) are utilized and then compared to reduce the number of input features. Following the feature selection stage, the modeling and performance evaluation of various Machine Learning classifiers are conducted using a Raspberry Pi IoT device. Further analysis of the effect of MLP parameters, such as the number of nodes, number of features, activation, solver, and regularization parameters, is also conducted. From the simulation, it can be seen that different parameters affect the accuracy and lightweight evaluation. By using a single hidden layer and four nodes, the proposed method with MI can achieve 96% accuracy, 97% recall, 96% F1-Measure, 5% False Positive Rate (FPR), highest curve of Receiver Operating Characteristic (ROC), and 96% Area Under the Curve (AUC). It also achieved low CPU time usage of 4.404 (ms) milliseconds and low energy consumption of 8.809 (mj) millijoules.

show abstract

Section: Machine Learning Techniques For Ids On Iotmentioning

confidence: 99%

Classifier Performance Evaluation for Lightweight IDS Using Fog Computing in IoT Security

et al. 2021

View full text Add to dashboard Cite

show abstract

“…In the proposed IDS, RF achieved the highest performance when detecting routing attacks among all algorithms. Samir et al [51] proposed a system for the detection of IoT attacks based on NB, LR, DT, RF, KNN, SVM, and MLP algorithms. DT and KNN obtained the best performance among all algorithms; however, compared to the DT algorithm, the KNN needed a high amount of time to classify.…”

Section: Machine Learning Techniquesmentioning

confidence: 99%

Monitoring Real Time Security Attacks for IoT Systems Using DevSecOps: A Systematic Literature Review

et al. 2021

View full text Add to dashboard Cite

In many enterprises and the private sector, the Internet of Things (IoT) has spread globally. The growing number of different devices connected to the IoT and their various protocols have contributed to the increasing number of attacks, such as denial-of-service (DoS) and remote-to-local (R2L) ones. There are several approaches and techniques that can be used to construct attack detection models, such as machine learning, data mining, and statistical analysis. Nowadays, this technique is commonly used because it can provide precise analysis and results. Therefore, we decided to study the previous literature on the detection of IoT attacks and machine learning in order to understand the process of creating detection models. We also evaluated various datasets used for the models, IoT attack types, independent variables used for the models, evaluation metrics for assessment of models, and monitoring infrastructure using DevSecOps pipelines. We found 49 primary studies, and the detection models were developed using seven different types of machine learning techniques. Most primary studies used IoT device testbed datasets, and others used public datasets such as NSL-KDD and UNSW-NB15. When it comes to measuring the efficiency of models, both numerical and graphical measures are commonly used. Most IoT attacks occur at the network layer according to the literature. If the detection models applied DevSecOps pipelines in development processes for IoT devices, they were more secure. From the results of this paper, we found that machine learning techniques can detect IoT attacks, but there are a few issues in the design of detection models. We also recommend the continued use of hybrid frameworks for the improved detection of IoT attacks, advanced monitoring infrastructure configurations using methods based on software pipelines, and the use of machine learning techniques for advanced supervision and monitoring.

show abstract

“…Thus, according to Roman et al [35], there should not be a specific intrusion detection module for each IoT node, because of the reduced computing capacity and energy consumption. For this reason, we have implemented a centralized intrusion detection system that allows solving the limited capacity problem as well as the problem of heterogeneity [36]. Figure 3 presents the architecture of our model, which consists of four modules: C-Anomaly detection: This phase identifies abnormal vectors of user.…”

Section: Proposed Modelmentioning

confidence: 99%

A Semi-supervised Deep Auto-encoder Based Intrusion Detection for IoT

Fenanir¹,

Semchedine²,

Harous³

et al. 2020

ISI

Self Cite

View full text Add to dashboard Cite

The main problem facing the Internet of Things (IoT) today is the identification of attacks due to the constrained nature of IoT devices. To address this problem, we present a lightweight intrusion detection system (IDS) which acts as a second line of defense allowing the reinforcement of the access control mechanism. The proposed method is based on a Deep Auto-Encoder (DAE), which learns the pattern of a normal process using only the features of the user’s normal behavior. Whatever deviation from the expected behavior is considered an anomaly. We validate our approach using two well-known network datasets, namely, the NSL-KDD and CIDDS-001. The experimental results demonstrate that our approach provides promising results in terms of accuracy, detection rate and false alarm rate.

show abstract

A Machine Learning-Based Lightweight Intrusion Detection System for the Internet of Things

Cited by 39 publications

References 23 publications

Classifier Performance Evaluation for Lightweight IDS Using Fog Computing in IoT Security

Classifier Performance Evaluation for Lightweight IDS Using Fog Computing in IoT Security

Monitoring Real Time Security Attacks for IoT Systems Using DevSecOps: A Systematic Literature Review

A Semi-supervised Deep Auto-encoder Based Intrusion Detection for IoT

Contact Info

Product

Resources

About