An Intrusion Detection and Classification System for IoT Traffic with Improved Data Engineering

Alsulami, Abdulaziz A.; Al‐Haija, Qasem Abu; Tayeb, Ahmad; Alqahtani, Ali

doi:10.3390/app122312336

Cited by 21 publications

(14 citation statements)

References 36 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Our near-future plans are focused on developing unsupervised machine learning-based DoH IDS to alleviate the limitation of the labeled data requirement. Also, efficient feature augmentation and engineering techniques [ 60 ] can be applied at the preprocessing stages to improve the data preparation process prior to the learning phases.…”

Section: Discussionmentioning

confidence: 99%

A Lightweight Double-Stage Scheme to Identify Malicious DNS over HTTPS Traffic Using a Hybrid Learning Approach

Al‐Haija

Alohaly

Odeh

2023

Sensors

View full text Add to dashboard Cite

The Domain Name System (DNS) protocol essentially translates domain names to IP addresses, enabling browsers to load and utilize Internet resources. Despite its major role, DNS is vulnerable to various security loopholes that attackers have continually abused. Therefore, delivering secure DNS traffic has become challenging since attackers use advanced and fast malicious information-stealing approaches. To overcome DNS vulnerabilities, the DNS over HTTPS (DoH) protocol was introduced to improve the security of the DNS protocol by encrypting the DNS traffic and communicating it over a covert network channel. This paper proposes a lightweight, double-stage scheme to identify malicious DoH traffic using a hybrid learning approach. The system comprises two layers. At the first layer, the traffic is examined using random fine trees (RF) and identified as DoH traffic or non-DoH traffic. At the second layer, the DoH traffic is further investigated using Adaboost trees (ADT) and identified as benign DoH or malicious DoH. Specifically, the proposed system is lightweight since it works with the least number of features (using only six out of thirty-three features) selected using principal component analysis (PCA) and minimizes the number of samples produced using a random under-sampling (RUS) approach. The experiential evaluation reported a high-performance system with a predictive accuracy of 99.4% and 100% and a predictive overhead of 0.83 µs and 2.27 µs for layer one and layer two, respectively. Hence, the reported results are superior and surpass existing models, given that our proposed model uses only 18% of the feature set and 17% of the sample set, distributed in balanced classes.

show abstract

Section: Discussionmentioning

confidence: 99%

A Lightweight Double-Stage Scheme to Identify Malicious DNS over HTTPS Traffic Using a Hybrid Learning Approach

Al‐Haija

Alohaly

Odeh

2023

Sensors

View full text Add to dashboard Cite

show abstract

“…The ABS scored 99.8% classification accuracy and 6.67 μseconds of classification overhead. We recommend using a federated machine learning approach for future work since it suits the distribution system architecture that connects vehicle support with improved data engineering [32].…”

Section: Discussionmentioning

confidence: 99%

Fast anomalous traffic detection system for secure vehicular communications

Al‐Haija

Alsulami

2023

Preprint

View full text Add to dashboard Cite

Nowadays, vehicle industrialization has realized several connectivity protocols to enable in-vehicle network communication. These protocols have been collectively standardized in a de facto standard for the in-vehicle network viz controller area network (CAN). Merely, CAN protocol shortages several security features that make vehicular communications susceptible to diverse message injection attacks that may mislead original electronic control units (ECUs) or cause failures. Therefore, defending the in-vehicle network from cyber-attacks is an essential concern. This paper proposes a fast anomalous traffic detection system for secure vehicular communications. The proposed system differentiates the performance of four different machine-learning approaches: Adaboost trees (ABT), Coarse decision trees (CDT), naïve Bayes classifier (NBC), and support vector machine (SVM). The models were evaluated on a recent dataset from a real-time vehicular communications environment, the car-hacking-2018 dataset. Specifically, the system considers five balanced classes, including one normal traffic class and four classes for message injection attacks over the in-vehicle controller area network: fuzzy attack, DoS attack, RPM attack (spoofing), and gear attack (spoofing). Our best performance outcomes belong to the ABT model, which notched 99.8% classification accuracy and 6.67 µseconds of classification overhead. Such results have outweighed existing in-vehicle intrusion detection systems employing the same/similar dataset.

show abstract

“…According to the results, the DT algorithm performed more accurately than the other algorithms, but RF had better AUC score. Abdulaziz et al [78] proposed an anomaly intrusion detection in an IoT system. Five supervised ML models were implemented to characterize their performance in detecting and classifying network activities with feature engineering and data preprocessing framework.…”

Section: Analysis and Comparison Of Supervised ML Algorithms For Iot ...mentioning

confidence: 99%

A Review on IoT Intrusion Detection Systems Using Supervised Machine Learning: Techniques, Datasets, and Algorithms

Abdulla

Jameel

2023

UHD J SCI TECH

View full text Add to dashboard Cite

Physical objects that may communicate with one another are referred to “things” throughout the Internet of Things (IoT) concept. It introduces a variety of services and activities that are both available, trustworthy and essential for human life. The IoT necessitates multifaceted security measures that prioritize communication protected by confidentiality, integrity and authentication services; data inside sensor nodes are encrypted and the network is secured against interruptions and attacks. As a result, the issue of communication security in an IoT network needs to be solved. Even though the IoT network is protected by encryption and authentication, cyber-attacks are still possible. Consequently, it’s crucial to have an intrusion detection system (IDS) technology. In this paper, common and potential security threats to the IoT environment are explored. Then, based on evaluating and contrasting recent studies in the field of IoT intrusion detection, a review regarding the IoT IDSs is offered with regard to the methodologies, datasets and machine learning (ML) algorithms. In This study, the strengths and limitations of recent IoT intrusion detection techniques are determined, recent datasets collected from real or simulated IoT environment are explored, high-performing ML methods are discovered, and the gap in recent studies is identified.

show abstract

An Intrusion Detection and Classification System for IoT Traffic with Improved Data Engineering

Cited by 21 publications

References 36 publications

A Lightweight Double-Stage Scheme to Identify Malicious DNS over HTTPS Traffic Using a Hybrid Learning Approach

A Lightweight Double-Stage Scheme to Identify Malicious DNS over HTTPS Traffic Using a Hybrid Learning Approach

Fast anomalous traffic detection system for secure vehicular communications

A Review on IoT Intrusion Detection Systems Using Supervised Machine Learning: Techniques, Datasets, and Algorithms

Contact Info

Product

Resources

About