A Multikernel and Metaheuristic Feature Selection Approach for IoT Malware Threat Hunting in the Edge Layer

HaddadPajouh, Hamed; Mohtadi, Alireza; Dehghantanaha, Ali; Karimipour, Hadis; Lin, Xiaodong; Choo, Kim‐Kwang Raymond

doi:10.1109/jiot.2020.3026660

Cited by 42 publications

(26 citation statements)

References 32 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The following steps will elucidate more about the working procedure of our architecture. 1) The features extraction using Grey Wolves Optimization (GWO) [31] method for extracting the optimal feature set from the list of available features for three views, i.e., Uniflow, Biflow, and Packet features.…”

Section: ) Ensemblermentioning

confidence: 99%

An Ensemble Multi-View Federated Learning Intrusion Detection for IoT

et al. 2021

View full text Add to dashboard Cite

The rise in popularity of Internet of Things (IoT) devices has attracted hackers to develop IoT-specific attacks. The microservice architecture of IoT devices relies on the Internet to provide their intended services. An unguarded IoT network makes inter-connected devices vulnerable to attacks. It will be a tedious and ineffective process to manually detect the attacks in the network, as the attackers frequently upgrade their attack strategies. Machine learning (ML)-assisted approaches have been proposed to build intrusion detection for cybersecurity automation in IoT networks. However, most such approaches focus on training an ML model using a single view of the dataset, which often fails to build insightful knowledge and understand each feature's impact on the ML model's decision-making ability. As such, the model training with a single view may result in an incomplete understanding of patterns in large feature-set datasets. Moreover, the current approaches are mainly designed in a centralized manner in which the raw data is transferred from the edge devices to the central server for training. This, in turn, may expose the data to all kinds of attacks without adhering to the privacy-preserving of data security. Multi-view learning has gained popularity for its ability to learn from different data views and deliver efficient performance with more distinguished predictions. This paper proposes a federated learning-based intrusion detection approach, called MV-FLID, that trains on multiple views of IoT network data in a decentralized format to detect, classify, and defend against attacks. The multi-view ensemble learning aspect helps in maximizing the learning efficiency of different classes of attacks. The Federated Learning (FL) aspect, wherein the device's data is not shared to the server, performs profile aggregation efficiently with the benefit of peer learning. Our evaluation results show that our proposed approach has higher accuracy compared to the traditional non-FL centralized approach.INDEX TERMS Internet of Things, IoT security, federated learning, neural networks, multi-view classification, intrusion detection system.

show abstract

Section: ) Ensemblermentioning

confidence: 99%

An Ensemble Multi-View Federated Learning Intrusion Detection for IoT

et al. 2021

View full text Add to dashboard Cite

show abstract

“…The proposed BCMPB-RIDMPL technique and two conventional methods, namely the hybrid CNN-LSTM [1] and multi-kernel SVM [2], were assessed through the use of Python by using Drebin dataset.…”

Section: Experimental Settingsmentioning

confidence: 99%

“…In this section, the experimental results of the tests on the BCMPB-RIDMPL technique and the state-of-the-art existing hybrid CNN-LSTM [1] and multi-kernel SVM [2] methods are compared with different performance metrics such as malware detection accuracy, the Matthews correlation coefficient, and malware detection time.…”

Section: Evaluation Measuresmentioning

confidence: 99%

See 1 more Smart Citation

Biserial Miyaguchi–Preneel Blockchain-Based Ruzicka-Indexed Deep Perceptive Learning for Malware Detection in IoMT

Alotaibi

2021

Sensors

View full text Add to dashboard Cite

Detection of unknown malware and its variants remains both an operational and a research challenge in the Internet of Things (IoT). The Internet of Medical Things (IoMT) is a particular type of IoT network which deals with communication through smart healthcare (medical) devices. One of the prevailing problems currently facing IoMT solutions is security and privacy vulnerability. Previous malware detection methods have failed to provide security and privacy. In order to overcome this issue, the current study introduces a novel technique called biserial correlative Miyaguchi–Preneel blockchain-based Ruzicka-index deep multilayer perceptive learning (BCMPB-RIDMPL). The present research aims to improve the accuracy of malware detection and minimizes time consumption. The current study combines the advantages of machine-learning techniques and blockchain technology. The BCMPB-RIDMPL technique consists of one input layer, three hidden layers, and one output layer to detect the malware. The input layer receives the number of applications and malware features as input. After that, the malware features are sent to the hidden layer 1, in which feature selection is carried out using point biserial correlation, which reduces the time required to detect the malware. Then, the selected features and applications are sent to the hidden layer 2. In that layer, Miyaguchi–Preneel cryptographic hash-based blockchain is applied to generate the hash value for each selected feature. The generated hash values are stored in the blockchain, after which the classification is performed in the third hidden layer. The BCMPB-RIDMPL technique uses the Ruzicka index to verify the hash values of the training and testing malware features. If the hash is valid, then the application is classified as malware, otherwise it is classified as benign. This method improves the accuracy of malware detection. Experiments have been carried out on factors such as malware detection accuracy, Matthews’s correlation coefficient, and malware detection time with respect to a number of applications. The observed quantitative results show that our proposed BCMPB-RIDMPL method provides superior performance compared with state-of-the-art methods.

show abstract

“…In recent years, feature optimization algorithms based on Evolutionary Algorithms (EAs) are popular [7][8][9][10][11][12][13]. However, the existing studies have suffered from the following limitations.…”

Section: Introductionmentioning

confidence: 99%

DIAMOND: A Structured Coevolution Feature Optimization Method for LDDoS Detection in SDN-IoT

Yin

Cui

Qian

et al. 2021

Wireless Communications and Mobile Computing

View full text Add to dashboard Cite

Software-defined networking for IoT (SDN-IoT) has become popular owing to its utility in smart applications. However, IoT devices are limited in computing resources, which makes them vulnerable to Low-rate Distributed Denial of Service (LDDoS). It is worth noting that LDDoS attacks are extremely stealthy and can evade the monitoring of traditional detection methods. Therefore, how to choose the optimal features to improve the detection performance of LDDoS attack detection methods is a key problem. In this paper, we propose DIAMOND, a structured coevolution feature optimization method for LDDoS detection in SDN-IoT. DIAMOND is consisted of a reachable count sorting clustering algorithm, a group structuring method, a comutation strategy, and a cocrossover strategy. By analysing the information of SDN-IoT network features in the solution space, the relationship between different SDN-IoT network features and the optimal solution is explored in DIAMOND. Then, the individuals with associated SDN-IoT network features are divided into different subpopulations, and a structural tree is generated. Further, multiple structural trees evolve in concert with each other. The evaluation results show that DIAMOND can effectively select optimal low-dimension feature sets and improve the performance of the LDDoS detection method, in terms of detection precision and response time.

show abstract

A Multikernel and Metaheuristic Feature Selection Approach for IoT Malware Threat Hunting in the Edge Layer

Cited by 42 publications

References 32 publications

An Ensemble Multi-View Federated Learning Intrusion Detection for IoT

An Ensemble Multi-View Federated Learning Intrusion Detection for IoT

Biserial Miyaguchi–Preneel Blockchain-Based Ruzicka-Indexed Deep Perceptive Learning for Malware Detection in IoMT

DIAMOND: A Structured Coevolution Feature Optimization Method for LDDoS Detection in SDN-IoT

Contact Info

Product

Resources

About