Attack and Anomaly Detection in IoT Networks using Machine Learning Techniques: A Review

Abstract

The Internet of Things (IoT) is one of today's most rapidly growing technologies. It is a technology that allows billions of smart devices or objects known as "Things" to collect different types of data about themselves and their surroundings using various sensors. They may then share it with the authorized parties for various purposes, including controlling and monitoring industrial services or increasing business services or functions. However, the Internet of Things currently faces more security threats than ever before. Machine Learning (ML) has observed a critical technological breakthrough, which has opened several new research avenues to solve current and future IoT challenges. However, Machine Learning is a powerful technology to identify threats and suspected activities in intelligent devices and networks. In this paper, various ML algorithms have been compared in terms of attack detection and anomaly detection, following a thorough literature review on Machine Learning methods and the significance of IoT security in the context of various types of potential attacks. Furthermore, possible ML-based IoT protection technologies have been introduced.

Classification of Encrypted IoT Traffic Despite Padding and Shaping

“…Zhang et al [44] have developed a Deterministic Finite Automaton (DFA) model for every smart device activity and used it to identify misbehavior in the traffic, similarly to the Goldenberg-Wool model [17] used on industrial control systems' traffic. Other papers applied machine learning algorithms in order to identify anomalies in the traffic [18,21,38] using statistics such as mean and standard deviation of inter-arrival times as feature vectors. Sridharan et al [38] implemented modules for both cases of unsupervised and supervised learning and demonstrated how they can identify different types of attacks.…”

“…We consider 3 kinds of adversaries: the local adversary, the external adversary [1,6] and the active adversary [18,21,38].…”

“…Using similar methodology, but now on the defender's side, we are also able to detect anomalous activities in IoT traffic related to possibly compromised smart devices [18,20,38].…”

IoT-Based Small Scale Anomaly Detection Using Dixon’s Q Test for e-Health Data

“…We select the appropriate r statistic based on the sample size η. By default, we use r 10 as the Dixon statistic where a sample of data packet must lie within the range of [3,7]. However, one can change the range and r statistic according to the need to adjust with the packet size.…”

“…Sensors are used in IoT-based ecosystems to generate data streams in regular intervals to provide real-time monitoring support to the owner of the given IoT system [1]. Such sensors may sometimes become faulty or generate erroneous data which must be detected at an early stage; otherwise, it can create serious troubles for decision making in the following stage of the applications [2,3].…”