AI-Powered Honeypots for Enhanced IoT Botnet Detection

Memos, Vasileios A.; Psannis, Kostas E.

doi:10.1109/wsce51339.2020.9275581

Cited by 12 publications

(4 citation statements)

References 19 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…There are many existing botnet detection systems, such as the following: based on behavioral features [20][21][22], based on honeypots [23][24][25], based on network features [26,27], and so on. However, in the IoT environment, devices in edge networks typically have limited computational resources, network bandwidth, and storage capacity.…”

Section: Feature Selectionmentioning

confidence: 99%

GBDT-IL: Incremental Learning of Gradient Boosting Decision Trees to Detect Botnets in Internet of Things

Chen,

Dai,

Zhang

et al. 2024

Sensors

View full text Add to dashboard Cite

The rapid development of the Internet of Things (IoT) has brought many conveniences to our daily life. However, it has also introduced various security risks that need to be addressed. The proliferation of IoT botnets is one of these risks. Most of researchers have had some success in IoT botnet detection using artificial intelligence (AI). However, they have not considered the impact of dynamic network data streams on the models in real-world environments. Over time, existing detection models struggle to cope with evolving botnets. To address this challenge, we propose an incremental learning approach based on Gradient Boosting Decision Trees (GBDT), called GBDT-IL, for detecting botnet traffic in IoT environments. It improves the robustness of the framework by adapting to dynamic IoT data using incremental learning. Additionally, it incorporates an enhanced Fisher Score feature selection algorithm, which enables the model to achieve a high accuracy even with a smaller set of optimal features, thereby reducing the system resources required for model training. To evaluate the effectiveness of our approach, we conducted experiments on the BoT-IoT, N-BaIoT, MedBIoT, and MQTTSet datasets. We compared our method with similar feature selection algorithms and existing concept drift detection algorithms. The experimental results demonstrated that our method achieved an average accuracy of 99.81% using only 25 features, outperforming similar feature selection algorithms. Furthermore, our method achieved an average accuracy of 96.88% in the presence of different types of drifting data, which is 2.98% higher than the best available concept drift detection algorithms, while maintaining a low average false positive rate of 3.02%.

show abstract

Section: Feature Selectionmentioning

confidence: 99%

GBDT-IL: Incremental Learning of Gradient Boosting Decision Trees to Detect Botnets in Internet of Things

Chen,

Dai,

Zhang

et al. 2024

Sensors

View full text Add to dashboard Cite

show abstract

“…Table 3 summarizes host-based detection techniques and their details. PSI graph to feed in ML 2014 [65] Dynamic Analysis 2016, 2019, 2020 [66][67][68][69] IOT Honeypots 2020 [70] Manufacturer Usage Description (MUD) improvements…”

Section: Host-based Detection Techniquesmentioning

confidence: 99%

“…This trained ML model is tested and validated with the popular SocialNet dataset. Later, Memos and Psannis [ 69 ] propose AI-powered honeypots with the use of cloud computing. They create a novel honeynet that is composed of many isolated honeypots, and each of the honeypots operates as a decoy for the attacks.…”

Section: Iot Botnet Detectionmentioning

confidence: 99%

Systematic Literature Review of IoT Botnet DDOS Attacks and Evaluation of Detection Techniques

Gelgi,

Guan,

Arunachala

et al. 2024

Sensors

View full text Add to dashboard Cite

Internet of Things (IoT) technology has become an inevitable part of our daily lives. With the increase in usage of IoT Devices, manufacturers continuously develop IoT technology. However, the security of IoT devices is left behind in those developments due to cost, size, and computational power limitations. Since these IoT devices are connected to the Internet and have low security levels, one of the main risks of these devices is being compromised by malicious malware and becoming part of IoT botnets. IoT botnets are used for launching different types of large-scale attacks including Distributed Denial-of-Service (DDoS) attacks. These attacks are continuously evolving, and researchers have conducted numerous analyses and studies in this area to narrow security vulnerabilities. This paper systematically reviews the prominent literature on IoT botnet DDoS attacks and detection techniques. Architecture IoT botnet DDoS attacks, evaluations of those attacks, and systematically categorized detection techniques are discussed in detail. The paper presents current threats and detection techniques, and some open research questions are recommended for future studies in this field.

show abstract

“…However, LS-DRNN combines Long Short-Term Memory Autoencoder (LAE), SMOTE, and DRNN algorithms. The framework proposed in [187] uses ML combined with 10 https://www.spamhaus.org/news/article/793/ spamhaus-botnet-threat-report-2019 a honeynet-based detection method for predicting if an IoT device can be a part of a Botnet. In [188], the authors use a CNN to perceive subtle differences in power consumption and detect Anomalies.…”

Section: ) Artificial Intelligence In Bot(net) Detectionmentioning

confidence: 99%

Explainable Artificial Intelligence in CyberSecurity: A Survey

et al. 2022

View full text Add to dashboard Cite

Nowadays, Artificial Intelligence (AI) is widely applied in every area of human being's daily life. Despite the AI benefits, its application suffer from the opacity of complex internal mechanisms and doesn't satisfy by design the principles of Explainable Artificial Intelligence (XAI). The lack of transparency further exacerbates the problem in the field of Cybersecurity because entrusting crucial decisions to a system that cannot explain itself presents obvious dangers. There are several methods in the literature capable of providing explainability of AI results. Anyway, the application of XAI in Cybersecurity can be a doubleedged sword. It substantially improves the Cybersecurity practices but simultaneously leaves the system vulnerable to adversary attacks. Therefore, there is a need to analyze the state-of-the-art of XAI methods in Cybersecurity to provide a clear vision for future research. This study presents an in-depth examination of the application of XAI in Cybersecurity. It considers more than 300 papers to comprehensively analyze the main Cybersecurity application fields, like Intrusion Detection Systems,Malware detection, Phishing and Spam detection, BotNets detection, Fraud detection, Zero-Day vulnerabilities, Digital Forensics and Crypto-Jacking . Specifically, this study focuses on the explainability methods adopted or proposed in these fields, pointing out promising works and new challenges.

show abstract

AI-Powered Honeypots for Enhanced IoT Botnet Detection

Cited by 12 publications

References 19 publications

GBDT-IL: Incremental Learning of Gradient Boosting Decision Trees to Detect Botnets in Internet of Things

GBDT-IL: Incremental Learning of Gradient Boosting Decision Trees to Detect Botnets in Internet of Things

Systematic Literature Review of IoT Botnet DDOS Attacks and Evaluation of Detection Techniques

Explainable Artificial Intelligence in CyberSecurity: A Survey

Contact Info

Product

Resources

About