Intrusion Detection Based on Autoencoder and Isolation Forest in Fog Computing

Abstract

Fog Computing has emerged as an extension to cloud computing by providing an efficient infrastructure to support IoT. Fog computing acting as a mediator provides local processing of the endusers' requests and reduced delays in communication between the end-users and the cloud via fog devices. Therefore, the authenticity of incoming network traffic on the fog devices is of immense importance. These devices are vulnerable to malicious attacks. All kinds of information, especially financial and health information travel through these devices. Attackers target these devices by sending malicious data packets. It is imperative to detect these intrusions to provide secure and reliable service to the user. So, an effective Intrusion Detection System (IDS) is essential for the secure functioning of fog without compromising efficiency. In this paper, we propose a method (Auto-IF) for intrusion detection based on deep learning approach using Autoencoder (AE) and Isolation Forest (IF) for the fog environment. This approach targets only binary classification of the incoming packets as fog devices are more concerned about differentiating attack from normal packets in real-time. We validate the proposed method on the benchmark NSL-KDD dataset. Our technique of intrusion detection achieves a high accuracy rate of 95.4% as compared to many other state-of-art intrusion detection methods.

Building an Intrusion Detection System to Detect Atypical Cyberattack Flows

“…Although the authors report very low FAR (≤ 1), this evaluation is provided only for a maximum of 25 packets. Many anomaly detection-based research works report improved accuracy [24], [25], but the main problem with these models is their high false alarm rate [26]. Such intrusion detection models may not be able to generalize effectively on an unknown observation and may classify it as an attack even though it is an unknown benign observation [27].…”

مراجعة حول أنظمة کشف ومنع التسلل فی بیئة حوسبة الضباب

“…IDS can also be used in computing fog on the fog node system side to detect any unsuspecting behavior by monitoring and analyzing files, especially log files, tracking the implementation of access control policies, as well as monitoring user login information. Also, intrusion detection techniques can be classified into two categories, namely detection, signature based intrusion detection systems, and anomaly-based intrusion detection systems [13].…”

Fog computing security and privacy for the Internet of Thing applications: State‐of‐the‐art

“…Applying strong access control to enable good protection to the Fog node, detecting fake, rogue, or compromised Fog nodes and IoT devices is still a big challenge 87 . Reusing Cloud computing's intrusion detection and protection systems can help to detect external attacks with a certain probability only 29,113 . Therefore, further researches on the detection and protection methods from rogue and compromised Fog nodes and IoT devices are an urgent need in Fog computing 29,87 .…”

“…87 Reusing Cloud computing's intrusion detection and protection systems can help to detect external attacks with a certain probability only. 29,113 Therefore, further researches on the detection and protection methods from rogue and compromised Fog nodes and IoT devices are an urgent need in Fog computing. 29,87 Moreover, packet forwarding is another big issue in the Fog environment.…”