【免费】用于检测物联网（IoT）网络攻击的新型混合入侵检测系统（IDS）-研究论文_物联网入侵检测的

需积分: 0 85 浏览量更新于2023-04-29 评论 5 收藏 1.43MB PDF 举报

身份认证购VIP最低享 7 折!

领优惠券(最高得80元）

资源详情

资源评论

资源推荐

Annals of Emerging Technologies in Computing (AETiC)

Vol. 4, No. 5, 2020

Rabie A. Ramadan and Kusum Yadav, "A Novel Hybrid Intrusion Detection System (IDS) for the Detection of Internet of

Things (IoT) Network Attacks”, Annals of Emerging Technologies in Computing (AETiC), Print ISSN: 2516-0281, Online ISSN:

2516-029X, pp. 61-74, Vol. 4, No. 5, 20

December 2020, Published by International Association of Educators and Researchers

(IAER), DOI: 10.33166/AETiC.2020.05.004, Available: http://aetic.theiaer.org/archive/v4/v4n5/p4.html.

Research Article

A Novel Hybrid Intrusion Detection

System (IDS) for the Detection of

Internet of Things (IoT) Network

Attacks

Rabie A. Ramadan

1,2,

* and Kusum Yadav

Computer Science and Engineering College, University of Hai’l, Hai’l, Saudi Arabia

rabie@rabieramadan.org

Computer Engineering Department, Cairo University, Giza, Egypt

y.kusum@uoh.edu.sa

*Correspondence: rabie@rabieramadan.org

Received: 8

November 2020; Accepted: 11

December 2020; Published: 20

December 2020

Abstract: Nowadays, IoT has been widely used in different applications to improve the quality of life.

However, the IoT becomes increasingly an ideal target for unauthorized attacks due to its large number of

objects, openness, and distributed nature. Therefore, to maintain the security of IoT systems, there is a need

for an efficient Intrusion Detection System (IDS). IDS implements detectors that continuously monitor the

network traffic. There are various IDs methods proposed in the literature for IoT security. However, the

existing methods had the disadvantages in terms of detection accuracy and time overhead. To enhance the

IDS detection accuracy and reduces the required time, this paper proposes a hybrid IDS system where a pre-

processing phase is utilized to reduce the required time and feature selection as well as the classification is

done in a separate stage. The feature selection process is done by using the Enhanced Shuffled Frog Leaping

(ESFL) algorithm and the selected features are classified using Light Convolutional Neural Network with

Gated Recurrent Neural Network (LCNN-GRNN) algorithm. This two-stage method is compared to up-to-

date methods used for intrusion detection and it over performs them in terms of accuracy and running time

due to the light processing required by the proposed method.

Keywords: IoT; Hybrid classification; IoT security; Convolution Neural Network; KDD cup dataset

1. Introduction

Internet of Things (IoT) becomes more increasingly popular in different industries such as social

domains, healthcare, personal and smart cities. However, it increases the risk of security issues in

many applications like medical monitoring, mission-critical tasks, and industrial control. These

applications work mainly based on trustworthy data delivery, data privacy, and reliability. Due to

the limitations of the IoT technologies, security became one of the key issues in IoT services and

networks. The IoT devices are tiny, heterogeneous and not supporting interoperability. These

characteristics extend the attack range and increase the complexity of developing any security

solution. IoT devices are vulnerable to not only network attacks (Putra, Dedeoglu, Kanhere, and

Jurdak, 2020)(Daia, Ramadan, and Fayek, 2018), they are also susceptible to powerful hackers from

unauthorized internet users. In some of the literatures, cryptography algorithms are proposed for IoT

authenticity and confidentiality to some extent. However, cryptography tools are costly in terms of

computations and time which might not be suitable for IoT devices.

AETiC 2020, Vol. 4, No. 5 62

www.aetic.theiaer.org

In addition, cryptography algorithms help in satisfying network authentication and data

integrity. Additional tools are required to monitor the IoT network traffic to avoid the recent

network attacks. Intrusion Detection System ((IDS) is most essential to maintain such function. IDSs

play the role of network monitoring, analysis, and attack detection.

Various IDS techniques are presented in the literature. These techniques are categorized into

two types which are anomaly-based detection and signature-based detection (Blanco, Malagón,

Briongos, and Moya, 2019) [4]. The signature-based detection method depends on the history of pre-

defined malicious activities patterns and the anomaly-based detection method depends on the

discovery of the deviation from normal behaviors to determine the intrusions. Therefore, the

anomaly-based method had the capability of detecting unknown attacks without predefined activity

patterns. In this paper, we present an anomaly-based intrusion detection model in IoT networks.

One of the anomaly-based methods is clustering. Clustering techniques can determine the

intrusions without predefined patterns. For instance, the authors of (Jyothsna, V. Rama Prasad, and

Munivara Prasad, 2011) experimented with k-means, k-medoids, outlier detection algorithms and

EM clustering to detect network intrusions. Through clustering, the traffic could be divided into

normal and abnormal traffic [6]. However, EM-based anomaly detection method turns out to provide

more accurate results than other clustering methods. Other classification methods are utilized for

anomaly detection such as Fuzzy logic, classification tree, Naïve Bayes network, genetic algorithm,

Support vector machine, and neural network [7]. The main idea behind the operation of these

algorithms is to classify the data into two types such as normal or abnormal categories. When

multiple numbers of attacks presented in-network, single algorithm might not be sufficient. Hybrid

approaches are used to use cascaded supervised algorithms, cascaded unsupervised algorithms, or

combining supervised and unsupervised algorithms [8] [9].

The research in this paper falls under the umbrella of the hybrid approach where the main

objectives are:

• To select more relevant features using Enhanced Shuffled Frog Leaping (ESFL)

algorithm,

• To achieve the high classification rate using Light Convolutional Neural Network with

Gated Recurrent Neural Network (LCNN-GRNN) method,

• To improve the detection rate accuracy of certain attacks such as U2R, DoS, R2L attacks

without mitigating of performance. Those attacks are the most attacks recently

discovered for IoT networks.

The paper is organized as follows: Section II defines the various literature survey of IDS

techniques and IoT security challenges. Section II defines the problem to be solved in this paper.

Section IV describes the overall workflow of the proposed system and a detailed description of the

proposed hybrid methods and algorithms. Section V contains the performance analysis of the

proposed system and dataset description. Section VI concludes the proposed system results and

discussion.

2. Problem Definition

With the advances in sensing technologies, IoT network became possible. However, IoT devices

suffer from different limitations including the energy sources and limited capabilities. In addition,

standard cryptography and regular IDS techniques could not be suitable for such network. Besides,

with the connectivity to the Internet, hacking techniques are getting strong and easy to be learnt.

Therefore, efficient monitoring process for intrusion detection is a challenge. This leads to various

research proposals to enhance IoT intrusion detection performance. One of the famous datasets that

has been extensively studied is NSL-KDD cup dataset. It became a de facto standard to test new

algorithms. Unfortunately, the existing methods suffer from the following problems:

• Minimum classification rate of attacks,

• Time overhead,

• Minimum detection rate of attack and

• Minimum accuracy.

AETiC 2020, Vol. 4, No. 5 63

www.aetic.theiaer.org

Therefore, the problem in hand is to introduce an efficient IDS solution that solve the following

mentioned problems where the detection time is important especially with IoT runtime operation.

Also, the accuracy is another issue where IoT systems could be used in critical applications such as

healthcare or military systems.

This paper proposes a hybrid IDS system that combines CNN and Gated Recurrent Neural

Network, LCNN-GRNN. In addition, it proposes a pre-processing method entitled Enhanced

Shuffled Frog Leaping (ESFL) for the best feature selection operation. To improve the performance

of the proposed system, the dataset is split into training and testing sub-data before classification. It

classifies the information into normal class or anomaly class.

3. Literature Review

Chaabouni et al. [10] classified the IoT security attacks in IoT networks using existing anomaly

detection approaches. They survey the state-of-the-art NIDS - Network Intrusion Detection System

describing various existing NIDS implementation tools, open-source network sniffing software, and

datasets. This review comprises the existing NIDS techniques with machine learning techniques and

the conclusion was that machine learning techniques give higher success rate than other techniques.

Pajouh et al. in [11] presented the novel IDS system based on the two-tier classification module

and two-layer dimension reduction to determine the malicious activities named R2L and U2R attacks.

The proposed method examined the linear discriminant analysis and component analysis of

dimension reduction for feature selection or dimensionality reduction. Then, the authors applied the

two-tier classification method in the form of K-NN and naïve Bayes to analyze the suspicious

behaviors. The proposed method was examined with the NSL-KDD dataset and the authors claimed

that the proposed method of superior performances to determine R2L and U2R attacks.

The IoT becomes much more interests in many industries such as logistics tracking, healthcare,

automobile, and smart cities. Hodo et al. in [12] described the threat analysis in IoT and ANN

algorithm was used to analyze these threats. A supervised ANN or multilevel perceptron was trained

by internet packet traces, then evaluated the ability of the proposed system to DDoS attacks. The

paper focuses on the classification of normal and attack patterns in IoT networks. The authors claimed

that they were able to detect up to 99.4% of DDoS attacks in the used datasets.

Another work has been conducted by Deng et al. in [13] where they proposed an IDS system for

mobile networks based on a transfer learning algorithm. the authors analyzed various security issues

and characteristics of networking security. Then, they discussed the internet security technologies of

authentication, key management, routing security, access control, intrusion detection, fault tolerance,

and privacy protection. Also, various types of intrusion detection technologies were discussed and

the applications of IoT architecture were identified.

Midi et al. [14] proposed a knowledge-driven adaptable IDS system (KALIS) for IoT. KALIS is

designed to be able to detect intrusions across a wide range of IoT systems in real-time. The proposed

system monitors numerous protocols and it had no performance impacts on IoT applications. The

proposed IDS approach does not mark individual protocols for IoT networks. It familiarizes the

suitable detection strategy to certain network features. The authors claimed that that KALIS

algorithms is effective in detecting intrusions of IoT systems.

Similar algorithm is proposed in [15] where deep learning is utilized for traffic flow intrusion

detection in IoT networks. The proposed method generates the generic features from packet-level

information. The authors developed Feed Forward Neural Networks (FFNN) to detect Dos, DDOS,

information theft attacks, and reconnaissance for binary and multiclass classification. Again, the

authors claimed the effectiveness of their algorithm in attacks detection and classification.

Another deep leaning approach is presented in [16] where the authors proposed a new intrusion

detection system named as mutual information selection element and deep extraction. The feature

extraction process was done using deep structure stacked autoencoders based on mutual information

between the class label and the feature. The entropy-based tree wrapper method was utilized for

optimizing the feature subsets.

剩余13页未读，继续阅读

weixin_38691703

粉丝: 2
资源: 961

会员权益专享

用于检测物联网（IoT）网络攻击的新型混合入侵检测系统（IDS）-研究论文

评论0

会员权益专享

最新资源

用于检测物联网（IoT）网络攻击的新型混合入侵检测系统（IDS）-研究论文

评论0

smartIDS:物联网和嵌入式设备的轻量级入侵检测。-开源

基于深度学习的工业物联网智能入侵检测

处理的入侵检测数据集

springboot风电检测物联网平台java源码 iot物联网源码

物联网nb-iot开发与实践pdf 下载

iot物联网平台源码

物联网NB-IOT开幕动画

江林华. 5g物联网及nb-iot技术详解

了解BC95 NB-IOT芯片和NB-IOT节点硬件系统实验小结

c++ iot物联网技术栈

详细介绍iot-23数据集

国外对于窄带物联网研究现状

基于物联网的智慧停车系统国内外研究现状

iot物联网源码搭建教程

关于NB-IOT的环境监测系统文献综述

cic iot dataset 2023

帮我找一些物联网流量数据集

nb-iot\lora窄带物联网技术 pdf

iotos物联网中间件平台源码

请给基于物联网的矿井环境检测系统的设计写一段研究思路

会员权益专享

最新资源