A Comparative Analysis of Network Intrusion Detection System for IoT Using Machine Learning

We are living in a connected world which encompasses various types of devices and networks. The most widely used network in modern age is Internet of Things (IoT). It is a type of network where IOT devices can communicate with each other without human intervention. The life of people is transformed with the evolution of smart city, smart home concepts. The areas are not limited. It ranges from healthcare, medical, transportation to banking, smart grid, agriculture. It has transformed the lives of people by providing ease and comfort of completing the tasks in less time with less overhead. However, there is a negative side of IoT and that is it lacks the implementation of sound and effective security measures. There are various risks associated with use of IoT. Some of them are risk of unauthorized access of data, node spoofing and different cyber-attacks like denial of service (DoS), Botnet, Ransom ware, eavesdropping, zero day attack. So, the main concern addressed here is how to detect intrusions into the network using Machine Learning. Machine Learning (ML) plays an important role in designing of intrusion detection systems to detect the anomalies in the network. The ML techniques are very efficient in detection of different types of cyber-attacks. This paper presents the review of different ML techniques in detection of intrusions into IoT networks. Different ML techniques like Random Forest, Neural Network, support vector machine etc. are useful in detection of anomalies in the network. Different datasets like UNSW-NB 15, CICIDS-2017, KDD-99, NSL-KDD, TON_IoT and ECU-IOHT are available which consists of data related to different types of cyber-attacks and are used to form intrusion detection systems. This paper presents the application of different ML algorithms in detection of abnormalities in the network, comparative analysis of different feature selection and machine learning techniques along with challenges and issues present in traditional intrusion detection systems(IDS) in IOT networks.

Internet of Things (IoT) has been thriving in recent years, playing an important role in a multitude of various domains, including industry 4.0, smart transportation, home automation, and healthcare. As a result, a massive number of IoT devices are deployed to collect data from our surrounding environment and transfer these data to other systems over the Internet. This may lead to cybersecurity threats, such as denial of service attacks, brute‐force attacks, and unauthorized accesses. Unfortunately, many IoT devices lack solid security mechanisms and hardware security supports because of their limitations in computational capability. In addition, the heterogeneity of devices in IoT networks causes nontrivial challenges in detecting security threats. In this article, we present a collaborative intrusion detection system (IDS), namely, MidSiot, deployed at both Internet gateways and IoT local gateways. Our proposed IDS consists of three stages: (1) classifying the type of each IoT device in the IoT network; (2) differentiating between benign and malicious network traffic; and (3) identifying the type of attacks targeting IoT devices. The last two stages are handled by the Internet gateways, whereas the first stage is on the local gateway to leverage the computational resources from edge devices. The evaluation results on three popular IDS datasets (IoTID20, CIC‐IDS‐2017, and BOT‐IoT) indicate our proposal could detect seven common cyberattacks targeting IoT devices with an average accuracy of 99.68% and outperforms state‐of‐the‐art IDSs. This demonstrates that MidSiot could be an effective and practical IDS to protect IoT networks.

The environmental impacts that are associated with the interconnected sensor devices in the Internet of Things (IoT) network are minimized with the utilization of green communication. This is because, when the IoT devices tend to grow, the IoT system becomes more prone to issues regarding the utilization of resources, sustainability, and energy consumption within the communication system. Tuning the communication protocols, lowering the IoT device’s energy usage rate, and establishing an effective technique for the transmission of data are performed. This is achieved by the green communication technique, which aids in the establishment of significant energy savings in the IoT network. For devices with limited power sources, the green communication technology offers an extended battery life. Despite the enormous potential of IoT technology, a number of obstacles need to be overcome, including those related to load balancing, security, storage, privacy, energy management, and device heterogeneity. In response to the challenges posed by conventional models, an innovative solution for the selection of Cluster Head (CH) using a hybrid approach is devised here. The energy consumption of sensor nodes is influenced by various factors, such asCH load, temperature, distance, residual energy, the number of alive nodes, delay, and so on. To address these challenges in IoT networks, a hybrid approach that combines the Squid Game Optimizer (SGO) and the Artificial Gorilla Troops Optimizer (AGTO) for the optimal selection of CH is suggested. The implemented approach is named Hybrid Squid Game with Artificial Gorilla Troops Optimizer (HSG-AGTO). This approach aims to optimize the above-mentioned factors and overcome energy consumption challenges in IoT networks. The effectiveness of the model is validated, and the results demonstrate the superior performance of the suggested model.

In the Internet of Things (IoT) technology, there are several issues to overcome, including network security. New attacks have been developed to target vulnerabilities in IoT devices, and the Internet of Things on a huge scale will exacerbate present network threats. Machine learning is becoming increasingly used in applications such as traffic classification and intrusion detection. This paper offers a technique for detecting network fault severity and identifying Internet of Things (IoT) devices based on several attributes. By pushing information to the network area, the proposed framework captures different features from each network flow in order to identify the source of traffic and the type of traffic generated is used to detect different network attacks. Different machine learning algorithms are tested to find the better suited algorithm that deliver best results. The following are some of the examples: Random Forest (RF) algorithm, decision tree, SVM, etc. After completing the experimentation, it was found that the random forest classifier and decision tree are the best performing ML algorithms to classify the network severity with an accuracy of about 96.98% and GNB is found as the least performing machine learning model with an accuracy of about 54.41%.

Destructive cyber-attacks and cybercriminals are increasing with the increase in IoT (Internet of Things) devices globally. This ha/s led to the need for increase in security in IoT systems. Innovative and novel techniques are used by the intruders to accomplish malicious goals effectively through cyber-attacks. An Intrusion Detection System (IDS) is used for classification of attacks in IoT networks based on anomaly detection and machine learning techniques. Inefficiency is observed in the conventional machine learning models and intrusion detection techniques as the network technologies are unpredictable. Accurate identification of various anomalies is possible with deep learning models in several research segments. The input data along with its prominent characteristics may be categorized automatically for classification and anomaly detection using convolutional neural networks (CNN). Faster computations are enabled due to the performance efficiency of CNN. For IoT networks, an intrusion detection model based on anomaly detection is designed and developed in this paper. A multiclass classification framework is created initially using a CNN model. Further, 3D CNN is used for implementation of the proposed model. Various intrusion detection datasets from IoT networks are used for validation of the proposed CNN model. Pre-trained multiclass CNN model is used for implementation of multiclass and binary classification based on transfer learning. When compared to the conventional deep learning models, the proposed multiclass and binary classification framework has attained improved F1 score, recall, precision and accuracy.

The Internet of Things (IoT) enables smart settings, which help human pursuits. Although the IoT has increased economic opportunities and made numerous human conveniences possible, it has also made it easier for intruders or attackers to take advantage of the technology by either attacking it or avoiding it. Therefore, the primary concerns for IoT networks are security and privacy. For Internet of Things (IoT) networks, several intrusion detection systems (IDS) have been developed thus far using various optimization techniques methods. But as data dimensionality has increased, the search space has grown significantly, offering difficult problems for optimization techniques like swarm optimization using particles (PSO). To overcome these obstacles, this work suggests an approach for feature selection dubbed enhanced to increase the sticky binary dynamic sticky binary particle swarm optimization's searchability, and particle swarm optimization (IDSBPSO) was developed. It introduced a method for decrease of the dynamic search space and various dynamic parameters (SBPSO). To identify malicious data flow in IoT networks, an IDS was developed using this methodology. The IoTID20 and UNSW-NB15 IoT network datasets were used to assess the proposed model. It was found that, even with less features, IDSBPSO typically attained accuracy that was either higher or comparable. Moreover, as compared to traditional IDSBPSO and PSO-based feature selection methods dramatically reduced computational cost and prediction time.

The Internet of Things (IoT) represents a paradigm shift in which the Internet is connected to real objects in a range of areas, including home automation, industrial processes, human health, and environmental monitoring. The global market for IoT devices is booming, and it is estimated that there will be 50 billion connected devices by the end of 2025. This explosion of IoT devices, which can be expanded more easily than desktop PCs, has led to an increase in cyber-attacks involving IoT devices. To address this issue, it is necessary to create novel approaches for identifying attacks launched by hacked IoT devices. Due to the possibility that these attacks would succeed, Intrusion Detection Systems (IDS) are required. IDS' feature selection stage is widely regarded as the most essential stage. This stage is extremely time-consuming and labor-intensive. However, numerous machine learning (ML) algorithms have been proposed to enhance this stage to boost an IDS's performance. These approaches, however, did not produce desirable results in terms of accuracy and detection rate (DR). In this paper, we propose a novel hybrid Autoencoder and Modified Particle Swarm Optimization (HAEMPSO) for feature selection and deep neural network (DNN) for classification. The PSO with modification of inertia weight was utilized to optimize the parameters of DNN. The experimental analysis was performed on two realistic UNSW-NB15 and BoT-IoT datasets that are suitable for IoT environment. The findings obtained by analyzing the proposed HAEMPSO against the Generic attack in the UNSW-NB15 dataset gave an accuracy of 98.8%, and a DR of 99.9%. While the benign class revealed an accuracy of 99.9% and DR of 99.7%. In the BoT-IoT dataset, the DDoS HTTP attack revealed an accuracy of 99.22% and DR of 97.79%. While the benign class gave an accuracy of 97.54% and DR of 97.92%. In comparison with the state-of-the-art machine learning schemes, our proposed HAEMPSO-DNN achieved a competitive feat in terms of DR and accuracy.

A blockchain-enabled Model integrates blockchain technology with Intrusion Detection Systems to enhance the security of Internet of Things (IoT) networks. It ensures data integrity, decentralization, and tamper-proof logging of intrusion detection. The approach improves trust, transparency, and real-time threat detection in distributed IoT environments. The existing blockchain-based IDS approaches, Blockchain Enabled (BCE-IoT), uniquely integrate blockchain consensus with federated-style local training, lightweight cryptography, and Shapley Additive Explanations (SHAP)-based explainability, ensuring both security and interpretability in IoT environments. The proposed work combines Blockchain technology with explainable artificial intelligence solutions to create a new cybersecurity Model that strengthens intrusion detection within IoT networks. The proposed model enhances transparency in tracking cyberattacks by combining blockchain security storage capabilities with SHAP, an explainable AI. This research utilises machine learning and artificial intelligence to detect threats in real-time, countering Distributed Denial of Service (DDoS), Denial of Service (DoS), scanning, Cross-Site Scripting (XSS), injection, password, and backdoor attacks. BCE-IoT delivers more precise security by combining blockchain’s permanent data features and AI anomaly detectors, thereby reducing security alert mistakes. The performance effectiveness of Blockchain-Enabled IoT surpasses that of the Content Integrity Detection System. It combines Blockchain and Software-Defined Networking to enhance security in network environments, utilising blockchain-based mutual confirmation for software-defined networking to detect and block cyber threats. The evaluation establishes BCE-IoT as an effective IoT network security solution that delivers strong cybersecurity features, is adaptable to modern connected environments, and offers interpretable security solutions. The performance evaluations demonstrate that BCE-IoT provides a robust, flexible, and interpretable cybersecurity solution suitable for modern IoT environments.

Background. With the proliferation of Internet of Things (IoT) networks in the digital age, the risk of cyberattacks, especially DDoS attacks, is also increasing. IoT devices such as smart refrigerators, thermostats, webcams and other Internet-connected home appliances are being targeted by attackers who can use them as part of a botnet to conduct DDoS attacks. These devices often have inadequate network security and are rarely updated, making them vulnerable. DDoS attacks can result in significant losses such as lost revenue, reputational damage and costs to restore services. So, the vulnerability of IoT networks to DDoS attacks and the need to develop effective protection measures is a pressing issue. Objective. The purpose of the paper is to analyse software that supports DDoS attacks in IoT networks. Provide general recommendations to help improve approaches to defence measures in IoT networks against DDoS-enabled malware. Methods. Five main DDoS attack models are considered: agent-handler model, reflexive model, IRC-based model, web-based model, and P2P-based model. Three most dangerous software capable of DDoS attacks on IoT networks are analyzed: Mirai, XOR.DDoS and Linux.Hydra. Results. There are many models and methods of DDoS attacks on IoT networks. The most dangerous are Mirai, XOR.DDoS and Linux.Hydra. Each of these software has its own specific characteristics and methods of carrying out attacks. The study also showed that there are several effective measures to counter these attacks, including setting strong passwords, regularly updating software, setting up traffic filters and restricting network access. Conclusions. Key aspects of DDoS attacks, their models and process steps are considered. The paper focuses on the three most dangerous software used to conduct such attacks and provides recommendations on how to counteract them.

Internet of things (IoT) is a complex and massive wireless network, where millions of devices are connected together. These devices gather different types of data from different systems that transform human daily lives by modernizing home appliances, business, medicine, traveling, research, and so on. Security is a critical challenge for a stable IoT network, for instance, routing attacks, especially sinkhole attack is a severe attack which has the capability to direct network data toward the intruder, and it can also disrupt and disconnect the devices from their network. The IoT needs multi-facet security solutions where network communication is protected with integrity, confidentiality, and authentication verification services. Therefore, the IoT network should be secured against intrusions and disruptions; the data exchanged throughout the network should be an encrypted form. In this article, an intrusion detection system for the prevention of an active sinkhole routing attack (PASR) in IoT is presented. The proposed PASR solves the problem of the sinkhole attack; for this purpose, the whole network is divided into the clusters of IoT. All the IoT devices are connected to their respective gateways. The gateway devices are equipped with an intrusion detection system. The intrusion detection system activates intrusion analyzer to detect anomalies in the context of ad hoc on-demand distance vector protocol. The base station is the main device that is responsible to receive data from all devices. Therefore, it detects and prevents sinkhole attacks; the base station keeps the record of all active devices and their possible links. The PASR is implemented and compared with the existing intrusion detection techniques ad hoc on-demand distance vector, and dual attack detection for black and gray hole attack. It was observed from the simulation results that the PASR outperforms in terms of data packet delivery, energy consumption, the detection rate of sinkhole attack, and routing overhead.

The growing development of IoT (Internet of Things) devices creates a large attack surface for cybercriminals to conduct potentially more destructive cyberattacks; as a result, the security industry has seen an exponential increase in cyber-attacks. Many of these attacks have effectively accomplished their malicious goals because intruders conduct cyber-attacks using novel and innovative techniques. An anomaly-based IDS (Intrusion Detection System) uses machine learning techniques to detect and classify attacks in IoT networks. In the presence of unpredictable network technologies and various intrusion methods, traditional machine learning techniques appear inefficient. In many research areas, deep learning methods have shown their ability to identify anomalies accurately. Convolutional neural networks are an excellent alternative for anomaly detection and classification due to their ability to automatically categorize main characteristics in input data and their effectiveness in performing faster computations. In this paper, we design and develop a novel anomaly-based intrusion detection model for IoT networks. First, a convolutional neural network model is used to create a multiclass classification model. The proposed model is then implemented using convolutional neural networks in 1D, 2D, and 3D. The proposed convolutional neural network model is validated using the BoT-IoT, IoT Network Intrusion, MQTT-IoT-IDS2020, and IoT-23 intrusion detection datasets. Transfer learning is used to implement binary and multiclass classification using a convolutional neural network multiclass pre-trained model. Our proposed binary and multiclass classification models have achieved high accuracy, precision, recall, and F1 score compared to existing deep learning implementations.

Cognitive radio (CR) is considered as a key enabling communication technology that offers efficient wireless connectivity to Internet of Things (IoT) devices. Its integration with the future 5G architecture is expected to advance the IoT paradigm. Security attacks can severely degrade the performance of such CR‐based IoT (CRIoT) networks. The effect of security attacks can be reduced by implementing defensive approaches. However, such solutions come at the expense of degrading spectrum efficiency and consuming more network resources. In this paper, we investigate the spectrum sharing and access problem in a multidevice single‐transceiver CRIoT network with time‐critical applications under jamming attacks. Our main goal is to maximize the number of simultaneously served IoT devices over all available idle channels while ensuring delay requirement, hardware, link quality, security attacks, and spectrum utilization constraints. This problem is formulated as a total unimodular binary linear programming, which is shown to be solvable in polynomial time. Unlike most of previous security‐aware channel assignment solutions that conduct the channel assignment sequentially, our solution simultaneously provides secured distributed channel‐assignment decisions for multiple CRIoT links (batching method). Batching can be realized through an admission control stage for CR IoT devices to announce their control packets. Simulation results reveal that our solution significantly improves network performance compared to previous security‐aware schemes.

The Internet of Things (IoT) has emerged as a crucial expansion of Internet services, linking numerous devices that produce and exchange substantial quantities of data. Strong defense against evolving cyberattacks that jeopardize the confidentiality, integrity, and availability (CIA Triad) of IoT systems is necessary due to this interconnectedness. Therefore, by controlling network activity to stop invasions and identify odd data patterns, intrusion detection systems can offer a robust layer of security for IoT systems. With a focus on identifying less frequent Advanced Persistent Threats (APT), this study aims to detect attacks directed at the CIA Triad. We examined two popular and unbalanced data sets, TON-IoT and BoT-IoT, for anomaly detection in IoT networks. By examining the usefulness of the ensemble learning and deep learning models in anomaly detection inside the IoT network data, we were able to study the security element of the network. The ensemble learning models considered are the following. Random Forest, XGBoost, and Stacking. The considered deep learning models are as follows: BiLSTM, GRU, Autoencoder, and Self-Taught Learning (STL: AE-SVM). The performance metrics studied are as follows: Accuracy, False Alert Rate, Recall, Precision, and F1-score. Regrettably, there were instances in which anomalies could not be detected using conventional techniques. This is because labeled data is scarce, particularly for APT attacks, and attack traffic is frequently sparse and noisy. We suggested a deep self-taught learning system (STL: AE-XGB) based on Transfer Learning to detect anomalies in IoT network data to tackle these difficult issues. To enhance classification performance and capture the changing landscape of attack methods in IoT networks. Our models automatically augment annotated data. The results show that our proposed model (STL: AE-XGB) outperforms the conventional models studied and provides interesting results in binary and multiclass classification.

Internet of Things (IoT) networks are being designed to connect billions of sensors/devices for an application-specific environment to provide services and carry out special tasks. It enables the virtual connection of the real-world physical devices with Internet cyberspace. While, there is an exponentially growing trend in the use of IoT technology for diverse applications such as smart agriculture, smart industries, smart hospitals, smart homes, etc., there are pressing design issues which affect the IoT network performance in the long run, for example, replacement of batteries for increasing the lifetime of devices to maintain the network longevity. To tackle this challenge, various wireless powered-based energy transfer paradigms were proposed over time. Backscatter communication (BackCom) is likewise one of the energy-efficient solutions proposed, which can satisfy the stringent green communication aspects of IoT networks. To achieve massive connectivity in BackCom-enabled IoT network, selecting a suitable multiple access scheme is also a crucial part. Most multiple access schemes proposed for BackCom systems are based on frequency or timeslots sharing techniques. Multiple access techniques proposed for BackCom IoT system can reap the gain of non-orthogonal multiple access (NOMA) principle. In NOMA, multiple end nodes (ENs) of sensors network is served in the same resource block, thereby, increasing the spectrum efficiency of BackCom IoT system. In this chapter, we discuss the prospects of backscatter technique with application of NOMA for green communication in IoT network.

Securing massive IoT in 6G: Recent solutions, architectures, future directions