A new network forensic framework based on deep learning for Internet of Things networks: A particle deep framework

Koroniotis, Nickolaos; Moustafa, Nour; Sitnikova, Elena

doi:10.1016/j.future.2020.03.042

Cited by 144 publications

(63 citation statements)

References 32 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Orevski and Androcec [ 65 ] used Genetic Algorithm (GA) to optimise the hyperparameters of ANN. In [ 66 ], Particle Swarm Optimisation (PSO) algorithm was used to determine the best hyperparameters that maximise AUC.…”

Section: Review Of Related Workmentioning

confidence: 99%

SMOTE-DRNN: A Deep Learning Algorithm for Botnet Detection in the Internet-of-Things Networks

Popoola

Adebisi

Ande

et al. 2021

Sensors

View full text Add to dashboard Cite

Nowadays, hackers take illegal advantage of distributed resources in a network of computing devices (i.e., botnet) to launch cyberattacks against the Internet of Things (IoT). Recently, diverse Machine Learning (ML) and Deep Learning (DL) methods were proposed to detect botnet attacks in IoT networks. However, highly imbalanced network traffic data in the training set often degrade the classification performance of state-of-the-art ML and DL models, especially in classes with relatively few samples. In this paper, we propose an efficient DL-based botnet attack detection algorithm that can handle highly imbalanced network traffic data. Specifically, Synthetic Minority Oversampling Technique (SMOTE) generates additional minority samples to achieve class balance, while Deep Recurrent Neural Network (DRNN) learns hierarchical feature representations from the balanced network traffic data to perform discriminative classification. We develop DRNN and SMOTE-DRNN models with the Bot-IoT dataset, and the simulation results show that high-class imbalance in the training data adversely affects the precision, recall, F1 score, area under the receiver operating characteristic curve (AUC), geometric mean (GM) and Matthews correlation coefficient (MCC) of the DRNN model. On the other hand, the SMOTE-DRNN model achieved better classification performance with 99.50% precision, 99.75% recall, 99.62% F1 score, 99.87% AUC, 99.74% GM and 99.62% MCC. Additionally, the SMOTE-DRNN model outperformed state-of-the-art ML and DL models.

show abstract

Section: Review Of Related Workmentioning

confidence: 99%

SMOTE-DRNN: A Deep Learning Algorithm for Botnet Detection in the Internet-of-Things Networks

Popoola

Adebisi

Ande

et al. 2021

Sensors

View full text Add to dashboard Cite

show abstract

“…The Operational Code sequence is converted into a vector space on which a deep Eigenspace learning approach is implemented to differentiate malicious applications from benign ones. The authors of [21] Despite the importance of these approaches, they (implicitly) rely on the unrealistic assumption that the intrusion detection environment is static. Yet, in real-life, many factors such as the statistical properties of the target class labels, distribution of the data, relationships among features and data quality are subject to change over time.…”

Section: Related Workmentioning

confidence: 99%

Sustaining the Effectiveness of IoT-Driven Intrusion Detection over Time: Defeating Concept and Data Drifts

Wahab¹

2021

Preprint

View full text Add to dashboard Cite

<p>This paper addresses the challenge of sustaining the intrusion detection effectiveness of machine learning-based intrusion detection systems in the Internet of Things (IoT) in the presence of concept and data drifts. Data drift is a phenomenon which embodies the change that happens in the relationships among the independent features, which is mainly due to changes in the data quality over time. Concept drift is a phenomenon which depicts the change in the relationships between input and output data in the machine learning model over time. To address data drifts, we first propose a series of data preparation steps that help improve the quality of the data and avoid inconsistencies. To counter concept drifts, we capitalize on an online deep neural network model that relies on an ensemble of varying depth neural networks that cooperate and compete together to enable the model to steadily learn and adapt as new data come, thus allowing for stable and long-lasting learning. Experiments conducted on a real-world IoT-based intrusion detection dataset, designed to address concept and data drifts, suggest that our solution stabilizes the performance of the intrusion detection on both the training and testing data compared to the static deep neural network model, which is widely used for intrusion detection.</p>

show abstract

“…No clear rules exist for selecting the best hyperparameter values for a model in any particular field of application, with experts often calling it more of an "art" than a science. Essentially, most often it is a trial and error process, although existing research has addressed and proposed methods for automatic hyperparameter selec-VOLUME 4, 2016 tion/tuning [176], [180]. Another threat that can target ML and DL models is an adversarial attack, during which, an attacker prepares a malicious input for a trained model, aiming to force it to misclassify the fake input, or to otherwise manipulate the model's output [181].…”

Section: Weaknesses Of Ai-based Cyber-defence Mechanismsmentioning

confidence: 99%

“…On the other hand, failing to detect a cyber-threat may have other significant consequences, causing sensitive information to be stolen, devices and services to malfunction, flight plans to be altered, with the potential of threat to life becoming substantial. To ensure the effectiveness of DL models, extensive collections of properly curated data need to be utilised for the training process, and their hyperparameters need to be tuned, potentially through automated methods, for optimal performance [176], [203]. • Process heterogeneous systems, protocols and data:…”

Section: Open Gaps and Future Directionsmentioning

confidence: 99%

A Holistic Review of Cybersecurity and Reliability Perspectives in Smart Airports

et al. 2020

Self Cite

View full text Add to dashboard Cite

A new network forensic framework based on deep learning for Internet of Things networks: A particle deep framework

Cited by 144 publications

References 32 publications

SMOTE-DRNN: A Deep Learning Algorithm for Botnet Detection in the Internet-of-Things Networks

SMOTE-DRNN: A Deep Learning Algorithm for Botnet Detection in the Internet-of-Things Networks

Sustaining the Effectiveness of IoT-Driven Intrusion Detection over Time: Defeating Concept and Data Drifts

A Holistic Review of Cybersecurity and Reliability Perspectives in Smart Airports

Contact Info

Product

Resources

About