IoT-IE: An Information-Entropy-Based Approach to Traffic Anomaly Detection in Internet of Things

Abstract

Security issues related to the Internet of Things (IoTs) have attracted much attention in many fields in recent years. One important problem in IoT security is to recognize the type of IoT devices, according to which different strategies can be designed to enhance the security of IoT applications. However, existing IoT device recognition approaches rarely consider traffic attacks, which might change the pattern of traffic and consequently decrease the recognition accuracy of different IoT devices. In this work, we first validate by experiments that traffic attacks indeed decrease the recognition accuracy of existing IoT device recognition approaches; then, we propose an approach called IoT-IE that combines information entropy of different traffic features to detect traffic anomaly. We then enhance the robustness of IoT device recognition by detecting and ignoring the abnormal traffic detected by our approach. Experimental evaluations show that IoT-IE can effectively detect abnormal behaviors of IoT devices in the traffic under eight different types of attacks, achieving a high accuracy value of 0.977 and a low false positive rate of 0.011. It also achieves an accuracy of 0.969 in a multiclassification experiment with 7 different types of attacks.

RETRACTED ARTICLE: An abnormal traffic detection method using GCN-BiLSTM-Attention in the internet of vehicles environment

“…In situations where there is a small amount of abnormal data and traffic data is severely imbalanced, directly inputting this imbalanced traffic data training set into traditional classification models for learning and training can cause the majority of class sample to overwhelm the minority of it. A few high threat attack traffic may be mistakenly detected as benign traffic or other attack categories, which also poses higher risks to networks, devices, and users [27,28]. Many deep learning methods have automatically extracted advanced features from raw traffic features through the search space of neural networks and have been selected to traffic anomaly detection research, achieving some good research results in recent years [29,30].…”

Hybrid Chain: Blockchain Enabled Framework for Bi-Level Intrusion Detection and Graph-Based Mitigation for Security Provisioning in Edge Assisted IoT Environment

“…In work [16], the author proposed a method for anomaly detection using traffic features in IoT network. Initially, The IOT gateway centric security monitoring system collect the IOT device traffic in centralized location.…”