Cyber Threat Intelligence for IoT Using Machine Learning

An intrusion detection system (IDS) is an important protection instrument for detecting complex network attacks. Various machine learning (ML) or deep learning (DL) algorithms have been proposed for implementing anomaly-based IDS (AIDS). Our review of the AIDS literature identifies some issues in related work, including the randomness of the selected algorithms, parameters, and testing criteria, the application of old datasets, or shallow analyses and validation of the results. This paper comprehensively reviews previous studies on AIDS by using a set of criteria with different datasets and types of attacks to set benchmarking outcomes that can reveal the suitable AIDS algorithms, parameters, and testing criteria. Specifically, this paper applies 10 popular supervised and unsupervised ML algorithms for identifying effective and efficient ML-AIDS of networks and computers. These supervised ML algorithms include the artificial neural network (ANN), decision tree (DT), k-nearest neighbor (k-NN), naive Bayes (NB), random forest (RF), support vector machine (SVM), and convolutional neural network (CNN) algorithms, whereas the unsupervised ML algorithms include the expectation-maximization (EM), k-means, and self-organizing maps (SOM) algorithms. Several models of these algorithms are introduced, and the turning and training parameters of each algorithm are examined to achieve an optimal classifier evaluation. Unlike previous studies, this study evaluates the performance of AIDS by measuring the true positive and negative rates, accuracy, precision, recall, and F-Score of 31 ML-AIDS models. The training and testing time for ML-AIDS models are also considered in measuring their performance efficiency given that time complexity is an important factor in AIDSs. The ML-AIDS models are tested by using a recent and highly unbalanced multiclass CICIDS2017 dataset that involves real-world network attacks. In general, the k-NN-AIDS, DT-AIDS, and NB-AIDS models obtain the best results and show a greater capability in detecting web attacks compared with other models that demonstrate irregular and inferior results.

The paradigm of computing has completely altered as a result of the development of communication and Information technology. The Internet of Things (IoT) is a type of communication environment made up of web-enabled devices that can communicate, gather, assess, and send data across the network without the need for human participation. The IoT idea is widely established in numerous fields of application, and it has also been used in the medical industry. The Internet of Medical Things (IoMT) refers to the combination of IoT with medical technology. Even though IoMT applications have facilitated real time monitoring in the healthcare sector, it suffers from several security and privacy attacks. The presence of such security and privacy attacks can cause the alteration or disclosure of sensitive data or sometimes authorized users cannot access the data also. Hence, it is crucial to secure the IoMT environment from such malicious attacks. Therefore, this study aims in assessing harmful traffic in IoMT environment. In this research, XGBoost classification algorithm is proposed to classify malicious traffic in an IoMT environment. Further, the study has also implemented state-of-art machine learning algorithms such as DT (Decision Tree), RF (Random Forest), LR (Logistic Regression), SVM (Support Vector Machine), NB (Naive Bayes), MLP (Multilayer Perceptron), SGD (Stochastic Gradient Descent) to test the efficacy of the proposed model. The experimental outcomes indicate that the proposed XGBoost algorithm outperformed other conventional machine learning approaches in terms of predicting malicious traffic in an IoMT environment, with a 100-percentage accuracy rate. Furthermore, the XGBoost algorithm exhibits better performance in terms of precision, Fl-score, recall, and AUC as compared with traditional approaches.

We are living in a connected world which encompasses various types of devices and networks. The most widely used network in modern age is Internet of Things (IoT). It is a type of network where IOT devices can communicate with each other without human intervention. The life of people is transformed with the evolution of smart city, smart home concepts. The areas are not limited. It ranges from healthcare, medical, transportation to banking, smart grid, agriculture. It has transformed the lives of people by providing ease and comfort of completing the tasks in less time with less overhead. However, there is a negative side of IoT and that is it lacks the implementation of sound and effective security measures. There are various risks associated with use of IoT. Some of them are risk of unauthorized access of data, node spoofing and different cyber-attacks like denial of service (DoS), Botnet, Ransom ware, eavesdropping, zero day attack. So, the main concern addressed here is how to detect intrusions into the network using Machine Learning. Machine Learning (ML) plays an important role in designing of intrusion detection systems to detect the anomalies in the network. The ML techniques are very efficient in detection of different types of cyber-attacks. This paper presents the review of different ML techniques in detection of intrusions into IoT networks. Different ML techniques like Random Forest, Neural Network, support vector machine etc. are useful in detection of anomalies in the network. Different datasets like UNSW-NB 15, CICIDS-2017, KDD-99, NSL-KDD, TON_IoT and ECU-IOHT are available which consists of data related to different types of cyber-attacks and are used to form intrusion detection systems. This paper presents the application of different ML algorithms in detection of abnormalities in the network, comparative analysis of different feature selection and machine learning techniques along with challenges and issues present in traditional intrusion detection systems(IDS) in IOT networks.

The Internet of Things (IoT) is a framework of interconnected computing devices mechanical and digital machines, internationally identifiable physical objects (or things) or people that are have unique identity and the ability to transfer data over a network without human-to-human or human-to-computer interaction., their combination with the Internet, and their representation in the digital world. The accessibility and availability of cheap components of IoT devices enables a extensive range of applications and provide smart environments. These devices perform actuating and sensing tasks and identified through unique addresses. The IoT devices are connected to the Internet and expected to use the Constrained Application Protocol (CoAP) at the application layer as a main web transfer protocol. Message Queuing Telemetry Transport (MQTT) does not enforce the use of a particular security approach for its applications, but instead leaves that to the application designer. Therefore, IoT solutions can be based on application context and specific security requirements. MQTT is a Client Server publish/subscribe messaging transport protocol. It is lightweight, open, uncomplicated, and designed to make implementation more easier. These characteristics of MQTT make it perfect for use in most of the situations, including communication in Machine to Machine (M2M) and Internet of Things (IoT). In IOT there is major use of Wireless Sensor Networks (WSN) which connects virtual world to physical world. In this paper focus is given to application layer of IOT. In application layer two important protocols are MQTT and CoAP. Security mechanism is proposed in the paper for these protocols.

Recently, the Internet of Things (IoT) has been used in various applications such as manufacturing, transportation, agriculture, and healthcare that can enhance efficiency and productivity via an intelligent management console remotely. With the increased use of Industrial IoT (IIoT) applications, the risk of brutal cyber-attacks also increased. This leads researchers worldwide to work on developing effective Intrusion Detection Systems (IDS) for IoT infrastructure against any malicious activities. Therefore, this paper provides effective IDS to detect and classify unpredicted and unpredictable severe attacks in contradiction to the IoT infrastructure. A comprehensive evaluation examined on a new available benchmark TON_IoT dataset is introduced. The data-driven IoT/IIoT dataset incorporates a label feature indicating classes of normal and attack-targeting IoT/IIoT applications. Correspondingly, this data involves IoT/IIoT services-based telemetry data that involves operating systems logs and IoT-based traffic networks collected from a realistic medium-scale IoT network. This is to classify and recognize the intrusion activity and provide the intrusion detection objectives in IoT environments in an efficient fashion. Therefore, several machine learning algorithms such as Logistic Regression (LR), Linear Discriminant Analysis (LDA), K-Nearest Neighbors (KNN), Gaussian Naive Bayes (NB), Classification and Regression Tree (CART), Random Forest (RF), and AdaBoost (AB) are used for the detection intent on thirteen different intrusion datasets. Several performance metrics like accuracy, precision, recall, and F1-score are used to estimate the proposed framework. The experimental results show that the CART surpasses the other algorithms with the highest accuracy values like 0.97, 1.00, 0.99, 0.99, 1.00, 1.00, and 1.00 for effectively detecting the intrusion activities on the IoT/IIoT infrastructure on most of the employed datasets. In addition, the proposed work accomplishes high performance compared to other recent related works in terms of different security and detection evaluation parameters.

Internet of Things (IoT) plays an increasingly significant role in our daily activities, connecting physical objects around us into digital services. In other words, IoT is the driving force behind home automation, smart cities, modern health systems, and advanced manufacturing. This also increases the likelihood of cyber threats against IoT devices and services. Attackers may attempt to exploit vulnerabilities in application protocols, including Domain Name System (DNS), Hyper Text Transfer Protocol (HTTP) and Message Queue Telemetry Transport (MQTT) that interact directly with backend database systems and client-server applications to store data of IoT services. Successful exploitation of one or more of these protocols can result in data leakage and security breaches. In this paper, an ensemble intrusion detection technique is proposed to mitigate malicious events, in particular botnet attacks against DNS, HTTP, and MQTT protocols utilized in IoT networks. New statistical flow features are generated from the protocols based on an analysis of their potential properties. Then, an AdaBoost ensemble learning method is developed using three machine learning techniques, namely decision tree, Naive Bayes (NB), and artificial neural network, to evaluate the effect of these features and detect malicious events effectively. The UNSW-NB15 and NIMS botnet datasets with simulated IoT sensors' data are used to extract the proposed features and evaluate the ensemble technique. The experimental results show that the proposed features have the potential characteristics of normal and malicious activity using the correntropy and correlation coefficient measures. Moreover, the proposed ensemble technique provides a higher detection rate and a lower false positive rate compared with each classification technique included in the framework and three other state-of-the-art techniques.

Ensuring the security of networks is a significant hurdle in the rollout of the Internet of Things (IoT). A widely used protocol in the IoT ecosystem is message queuing telemetry transport (MQTT), which is based on the published-subscribe model. IoT manufacturers are expected to expand their usage of the MQTT protocol, which is expected to increase the number of cyber security threats against the protocol. IoT settings are crucial to overcoming scalability and computing resource issues and minimizing the characteristics needed for categorization. Machine learning (ML) is extensively used in traffic categorization and intrusion detection. This study proposes a ML-based network traffic detection model (MLNTDM) to enhance IoT application layer attack detection. The proposed architecture for the MQTT protocol is evaluated based on its effectiveness in detecting malicious attacks and how these affect various MQTT brokers. This study focuses on low-power-consuming ML algorithms for detecting IoT botnet offenses and identifying typical attacks and their responses. With this framework, each network flow provides information that can help identify the source of generated traffic and network assaults. Results from our approach, as shown in the experiment, prove more accuracy.

Internet of Medical Things (IoMT) is network of interconnected medical devices (smart watches, pace makers, prosthetics, glucometer, etc.), software applications, and health systems and services. IoMT has successfully addressed many old healthcare problems. But it comes with its drawbacks essentially with patient’s information privacy and security related issues that comes from IoMT architecture. Using obsolete systems can bring security vulnerabilities and draw attacker’s attention emphasizing the need for effective solution to secure and protect the data traffic in IoMT network. Recently, intrusion detection system (IDS) is regarded as an essential security solution for protecting IoMT network. In the past decades, machines learning (ML) algorithms have demonstrated breakthrough results in the field of intrusion detection. Notwithstanding, to our knowledge, there is no work that investigates the power of machines learning algorithms for intrusion detection in IoMT network. This paper aims to fill this gap of knowledge investigating the application of different ML algorithms for intrusion detection in IoMT network. The investigation analysis includes ML algorithms such as K-nearest neighbor, Naïve Bayes, support vector machine, artificial neural network and decision tree. The benchmark dataset, Bot-IoT which is publicly available with comprehensive set of attacks was used to train and test the effectiveness of all ML models considered for investigation. Also, we used comprehensive set of evaluation metrics to compare the power of ML algorithms with regard to their detection accuracy for intrusion in IoMT networks. The outcome of the analysis provides a promising path to identify the best the machine learning approach can be used for building effective IDS that can safeguard IoMT network against malicious activities.

In today's world, Internet of Things (IoT) technology has revolutionized various fields – including agriculture – by offering smart solutions that enhance crop yield and quality. One crucial aspect of smart farming is the application of IoT for disease detection and prevention. Crop diseases caused by bacteria and viruses can have devastating effects, leading to significant financial losses for farmers. Early detection plays a crucial role in managing these diseases, and IoT technology provides reliable and efficient methods to achieve this goal. To aid in the research on disease recognition in corn or maize plants, a large-scale dataset comprising 4188 images across four disease categories – namely, healthy, common rust, gray-leaf spot, and blight – is utilized. This dataset is used to train various machine learning algorithms such as K-nearest neighbor (KNN), support vector machine (SVM), random forest (RF), decision tree (DT), convolutional neural network (CNN), naïve Bayes (NB), gradient boosting trees (GBT), long short-term memory (LSTM), and the algorithms from recent literature such as genetic algorithm-based ensemble classifier, XGBoost, AdaBoost and XGBoost + KNN to accurately identify disease patterns in plants and is loaded into the Raspberry Pi. By interfacing a camera with a Raspberry Pi, leaf diseases can be detected, and the farm’s status can be sent to the farmer’s webpage using a Wi- Fi server. This information empowers farmers to take immediate action to control the disease such as activating sprinklers or applying pesticides. Through manually controllable on/off mechanisms, farmers can remotely manage these actions, ensuring the health and disease-free state of their crops. Among the selected algorithms, the XGBoost + KNN algorithm demonstrates the highest accuracy, reaching an impressive 98.77%.

This paper proposes a comparison of three machine learning algorithms for a better intelligent irrigation system based on internet of things (IoT) for differents products. This work's major contribution is to specify the most accurate algorithm among the three machine learning algorithms (k-nearest neighbors (KNN), support vector machine (SVM), artificial neural network (ANN)). This is achieved by collecting irrigation data of a specific products and split it into training data and test data then compare the accuracy of the three algorithms. To evaluate the performance of our algorithm we built a system of IoT devices. The temperature and humidity sensors are installed in the field interact with the Arduino microcontroller. The Arduino is connected to Raspberry Pi3, which holds the machine learning algorithm. It turned out to be ANN algorithm is the most accurate for such system of irrigation. The ANN algorithm is the best choice for an intelligent system to minimize water loss for some products.

In the realm of Internet of Things (IoT) security, malware classification is crucial for identifying, isolating, and mitigating the impacts of malicious software that exploits system vulnerabilities. Effective IoT malware classification employs various machine learning algorithms to enhance detection accuracy and system resilience. The most commonly used Machine Learning algorithms for Malware Classification are "Support Vector Machine (SVM), Random Forest (RF), Naive Bayes (NB), and Logistic Regression (LR)". Each of these algorithms has distinct advantages in identifying malware, but this study explores the creation of an Ensemble / Hybrid model by integrating the two most effective machine learning algorithms, which can lead to superior performance. The proposed model outperforms the simple models mentioned above and other related works discussed in the literature. Key performance metrics evaluated for this work includes Accuracy, Precision, Recall, F-Score. This advancement is vital for improving the security posture of IOT systems by providing a more reliable mechanism for early detection and effective response to emerging malware threats

Recent advances in machine learning techniques have significantly influenced the development of early diabetes detection systems. In this paper, different machine learning (ML) algorithms are employed for diabetes detection based on hand movement. The spatial and temporal information for horizontal and vertical hand movement deviations for both diabetic and non-diabetic subjects are obtained using a data acquisition system. A dataset is constructed based on the obtained hand movement information along with other related attributes such as age, gender, weight and vision health. Binary classification of diabetic and non-diabetic subjects is achieved using several machine learning algorithms. These algorithms include Naïve Bayes (NB), Logistic Regression (LR), Linear Discriminate Analysis (LDA), Classification and Regression Tree (CART), k-Nearest Neighbors (KNN), Support Vector Machine (SVM) and Multi-layer Perceptron (MLP). The considered ML algorithms are evaluated and ranked according to a set of key performance metrics that include accuracy, precision, recall and F-1 score. Algorithm ranking results demonstrate that LR, CART, KNN and MLP algorithms have achieved higher ranking positions as compared to other algorithms. The best ranked ML algorithms are then validated and thoroughly investigated to prove their ability to discriminate between diabetic and non-diabetic subjects. Validation results show that the best-ranked ML algorithms have achieved high classification accuracy, precision, recall and F-1 scores. Therefore, the considered machine learning algorithms can serve as efficient tools for diabetes detection based on the constructed dataset.

The Internet of Things (IoT) based water quality monitoring system, mostly uses cost-effective sensors with a faster response time. Few water quality parameters such as Chemical Oxygen Demand (COD), Biological Oxygen Demand (BOD), Chlorine (Cl), and Total Phosphorous, hard to be measured online, soft sensing techniques are used as an alternate solution to this. This paper studies different Machine Learning (ML) models to prefer a suitable one that can identify the non-linearity of the dependency and establish a correlation between input and output parameters to design a COD soft sensor. The selected models are deployed in the proposed IoT architecture to predict the COD in real-time. More than 16000 data samples from the river Ganga with ten independent water quality parameters are collected and tested to validate the proposed IoT architecture. The paper compares the results of a few best performing ML algorithms like Multiple Linear Regression, Multilayer Perceptron, Support Vector Machine, Random Forest and K-Nearest Neighbour (KNN). Where, KNN technique proves to be the most efficient one in the prediction of COD in terms of response time and other performance matrices like R, R2, MSE, MAE, and RMSE. Finally, the preferred model (KNN) with the IoT setup is deployed and tested at the Sewage Treatment Plant (STP) outlet of the authors’ institute to verify the accuracy of the COD in real-time.

The research relevance is determined by the growing threats in cybersecurity, which require improved methods of detecting vulnerabilities in software, with the help of the latest technologies such as artificial intelligence (AI). The study aimed to determine the effectiveness of AI for vulnerability testing as an alternative to traditional security testing methods, particularly pentesting. To achieve this goal, machine learning algorithms were analysed, a hybrid model for vulnerability detection was developed, and the use of intrusion detection and prevention systems, automated approaches to software testing, and application interface security was addressed. The study determined that decision trees quickly classify traffic but overlearn; support vector machines accurately analyse logs but are sensitive to settings; naive Bayesian classifiers effectively filter messages but are limited by assumptions; neural networks and deep learning detect complex threats but require a lot of data; the k-nearest neighbours’ algorithm is suitable for small systems but slow; and random forests are accurate in code analysis but less interpretable. AI is fast and scalable but limited in understanding context and responding to new threats. The results showed that pentesting prevailed in detecting complex vulnerabilities, and the hybrid machine learning model achieved 93% accuracy and 100% prediction accuracy but missed 17% of vulnerabilities. For their part, cybersecurity technologies such as application interface testing, bug bounty programmes, security integration into development, intrusion detection systems, end-to-end encryption, IoT security and phishing are also effective, but need to be adapted to new threats. The results of the study can be used by cybersecurity companies, software developers, and security engineers to improve vulnerability testing and cyber threat protection processes, including with the help of AI-based tools

Solar energy is considered the most abundant form of energy available on earth. However, the efficiency of photovoltaic (PV) panels is greatly reduced due to the accumulation of dust particles on the surface of PV panels. The optimization of the cleaning cycles of a PV power plant through condition monitoring of PV panels is crucial for its optimal performance. Specialized equipment and weather stations are deployed for large-scale PV plants to monitor the amount of soil accumulated on panel surface. However, not much focus is given to small- and medium-scale PV plants, where the costs associated with specialized weather stations cannot be justified. To overcome this hurdle, a cost-effective and scalable solution is required. Therefore, a new centralized cloud-based solar conversion recovery system (SCRS) is proposed in this research work. The proposed system utilizes the Internet of Things (IoT) and cloud-based centralized architecture, which allows users to remotely monitor the amount of soiling on PV panels, regardless of the scale. To improve scalability and cost-effectiveness, the proposed system uses low-cost sensors and an artificial neural network (ANN) to reduce the amount of hardware required for a soiling station. Multiple ANN models with different numbers of neurons in hidden layers were tested and compared to determine the most suitable model. The selected ANN model was trained using the data collected from an experimental setup. After training the ANN model, the mean squared error (MSE) value of 0.0117 was achieved. Additionally, the adjusted R-squared (R2) value of 0.905 was attained on the test data. Furthermore, data is transmitted from soiling station to the cloud server wirelessly using a message queuing telemetry transport (MQTT) lightweight communication protocol over Wi-Fi network. Therefore, SCRS depicts a complete wireless sensor network eliminating the need for extra wiring. The average percentage error in the soiling ratio estimation was found to be 4.33%.