Fed-DTCN: A Federated Disentangled Learning Framework for Unsupervised Zero-Day Anomaly Detection in IoT with Semantic-Aware Augmentation.

Recent advances in Internet of Things (IoT) technologies require a new type of IoT security environment. Various heterogeneous smart devices have easy access to IoT environment, and as the number of users increases, they are exposed to various threats such as malicious attacks on IoT devices and IoT infrastructure, and data tampering by malicious code. Malware detection in IoT requires data and models for continuous and changing learning of smart devices. Methods/Statistical analysis: To minimize these security threats, various malware detection techniques in the field of IoT security have been studied. Malware detection in IoT environment is important for data derivation and learning model required for continuous and changing learning of smart devices. The metadata of malware detection can be normalized by the value of device id, time, behavior, location and state. This paper proposes behavior-based malware detection using deep learning (BMD-DL). Findings: BMD-DL was able to collect metadata about behavior-based malicious behavior and learn and detect malicious codes through deep learning. In addition, through the learned model, IoT Security is provided by disconnecting malicious devices that cause malicious behavior in the IoT environment. Improvements/Applications: BMD-DL collects behavioral data generated from multiple devices in the IoT and applies the results learned through deep learning to detect persistent malware.

The Internet of Things (IoT) has become an integral part of everyday life, and plays a significant role in various sectors by enabling device-to-device communication without human intervention. However, the constant connectivity of these devices to the Internet exposes them to numerous cyberattacks, potentially leading to data breaches, device malfunctions, and unauthorized network access. The diverse range of threats targeting IoT systems highlights the need for robust security solutions, such as machine learning-based intrusion detection systems, which have attracted growing research interest. This study proposes a novel adaptive approach for intrusion detection in IoT environments by combining batch and incremental learning models. Our work overcomes the limitations of traditional machine learning-based intrusion detection methods, emphasizing the potential of incremental learning to develop more effective and resilient solutions. Unlike most existing approaches that rely solely on batch learning and lack adaptability to integrate new data for long-term security, our method offers a more flexible alternative. Specifically, we leverage the predictive power of LightGBM in batch mode to improve the performance of a Passive-Aggressive classifier as a meta-learner in incremental mode. This dual learning approach aims to enhance intrusion detection in two key ways: effectively capturing diverse attack patterns with batch learning and adapting to emerging attack patterns with incremental learning. Experiments conducted on the CICIoT2023 dataset demonstrate that the proposed approach successfully balances performance and adaptability. It maintains accurate detection capabilities across various classification tasks while remaining responsive to evolving attack patterns.

The Internet of Things (IoT) is emerging as a new trend mainly employed in developing numerous vital applications. These applications endure on a federal storage framework primarily concerned with multiple issues. Blockchain technology (BC) is one of the supportive methods for developing IoT-based applications. It is employed to solve the problems encountered in IoT applications. The attack Distributed Denial of Service (DDoS) is one of the leading security attacks in IoT systems. Attackers can effortlessly develop the exposures of IoT gadgets and restrain them as fragments of botnets to commence DDoS threats. The IoT devices are said to be resource-constrained with computing resources and restricted memory. As a developing technology, BC holds the possibility of resolving security problems in IoT. This paper proposes the Metaheuristic-Optimized Blockchain Framework for Attack Detection using a Deep Learning Model (MOBCF-ADDLM) method. The main intention of the MOBCF-ADDLM method is to deliver an effective method for detecting DDoS threats in an IoT environment using advanced techniques. The BC technology is initially applied to mitigate DDoS attacks by presenting decentralized security solutions. Furthermore, data preprocessing utilizes the min-max scaling method to convert input data into a beneficial format. Additionally, feature selection (FS) is performed using the Aquila optimizer (AO) technique to recognize the most relevant features from input data. The attack classification process employs the deep belief network (DBN) technique. Finally, the red panda optimizer (RPO) model modifies the hyper-parameter values of the DBN model optimally and results in higher classification performance. A wide range of experiments with the MOBCF-ADDLM approach is performed under the BoT-IoT Binary and Multiclass datasets. The performance validation of the MOBCF-ADDLM approach portrayed a superior accuracy value of 99.22% over existing models.

In the face of constantly changing cyber threats, a variety of actions, tools, and regulations must be considered to safeguard information assets and guarantee the confidentiality, reliability, and availability of digital resources. The purpose of this research is to create an artificial intelligence (AI)-driven system to enhance sustainability for cyber threat detection in Internet of Things (IoT) environments. This study proposes a modern technique named Artificial Fish Swarm-driven Weight-normalized Adaboost (AF-WAdaBoost) for optimizing accuracy and sustainability in identifying attacks, thus contributing to heightening security in IoT environments. CICIDS2017, NSL-KDD, and UNSW-NB15 were used in this study. Min-max normalization is employed to pre-process the obtained raw information. The proposed model AF-WAdaBoost dynamically adjusts classifiers, enhancing accuracy and resilience against evolving threats. Python is used for model implementation. The effectiveness of the suggested AF-WAdaBoost model in identifying different kinds of cyber-threats in IoT systems is examined through evaluation metrics like accuracy (98.69%), F-measure (94.86%), and precision (95.72%). The experimental results unequivocally demonstrate that the recommended model performed better than other traditional approaches, showing essential enhancements in accuracy and strength, particularly in a dynamic environment. Integrating AI-driven detection balances offers sustainability in cybersecurity, ensuring the confidentiality, reliability, and availability of information assets, and also helps in optimizing the accuracy of systems.

This research introduces a comprehensive collaborative intrusion detection system (CIDS) framework aimed at bolstering the security of Internet of Things (IoT) environments by synergistically integrating lightweight architecture, trust management, and privacy-preserving mechanisms. The proposed hierarchical architecture spans edge, fog, and cloud layers, ensuring efficient and scalable collaborative intrusion detection. Trustworthiness is established through the incorporation of distributed ledger technology (DLT), leveraging blockchain frameworks to enhance the reliability and transparency of communication among IoT devices. Furthermore, the research adopts federated learning (FL) techniques to address privacy concerns, allowing devices to collaboratively learn from decentralized data sources while preserving individual data privacy. Validation of the proposed approach is conducted using the CICIoT2023 dataset, demonstrating its effectiveness in enhancing the security posture of IoT ecosystems. This research contributes to the advancement of secure and resilient IoT infrastructures, addressing the imperative need for lightweight, trust-managing, and privacy-preserving solutions in the face of evolving cybersecurity challenges. According to our experiments, the proposed model achieved an average accuracy of 97.65%, precision of 97.65%, recall of 100%, and F1-score of 98.81% when detecting various attacks on IoT systems with heterogeneous devices and networks. The system is a lightweight system when compared with traditional intrusion detection that uses centralized learning in terms of network latency and memory consumption. The proposed system shows trust and can keep private data in an IoT environment.

Multi-objective PSO based feature selection for intrusion detection in IoT based wireless sensor networks

Internet of things (IoT) is penetrating into every aspect of our lives including our body, our home and our living environment along with numerous security challenges. With rapidly growing number of connected devices in IoT, the scope for cyber-attack also increases exponentially. Therefore an effective intrusion detection system (IDS) is needed to efficiently detect the attack at faster rate in highly scalable and dynamic IoT environment. In this paper, a novel intrusion detection technique is proposed based on fog computing using Online Sequential Extreme Learning Machine (OS-ELM) which can intelligently interpret the attacks from the IoT traffic. In the proposed system, the existing centralized cloud intelligence in detecting the attack is distributed to local fog nodes to detect the attack at faster rate for IoT application. The distributed architecture of fog computing enables distributed intrusion detection mechanism with scalability, flexibility and interoperability. The analysis of the proposed system proves to be efficient in terms of response time and detection accuracy.

Cloud computing is perhaps the most enticing innovation in the present figuring situation. It gives an expense-effective arrangement by diminishing the enormous forthright expense for purchasing equipment foundations and processing power. Fog computing is an additional help to cloud infrastructure by utilizing a portion of the less register concentrated undertaking at the edge devices, reducing the end client’s reaction time, such as the Internet of Things (IoT). However, most IoT devices are resource-constrained, and there are many devices that cyber-attacks could target. Cyber-attacks such as Denial of Service (DoS), Distributed Denial of Service (DDoS), and botnets are still significant threats in the IoT environment. Botnets are currently the most significant threat on the internet. A botnet is a group of compromised systems connected through the internet and controlled by a criminal to perform a malicious activity without authentication and permission. A botnet can compromise the system and steal the data. It can also be used to perform attacks, like Phishing, spamming, and more. To overcome the critical issue, the authors exhibit a novel botnet attack detection approach that could be utilized in fog computing situations to dispense with the attack using the programmable nature of the SDN environment. In order to demonstrate the effectiveness of the proposed technique, extensive experimentation has been performed on the N_BaIoT dataset for botnet attack signature in various edge devices, i.e., Internet of Things (IoT), to evaluate the standard parameters. We have also compared the proposed technique with other deep learning algorithms. The proposed technique shows promising detection accuracy and time utilization results.

Intrusion detection is a crucial aspect of maintaining the security of computer network devices.With the advancement of Internet of Things (IoT) technology, the need for intrusion detection has become even more critical due to the many IoT devices that remain inadequately protected due to resource constraints.Although various intrusion detection methods have been developed, many of them have not been optimized to address the resource limitations of IoT devices, such as limited computational capacity and low power consumption.Furthermore, existing feature selection methods often overlook the potential of combining various selection techniques to enhance accuracy and efficiency.This research introduces a novel intrusion detection framework that integrates multiple feature selection algorithms-Pearson Correlation, Spearman Correlation, and Mutual Information-during the pre-processing phase, aiming to reduce data complexity and improve classification accuracy.Unlike prior approaches that apply singlemethod feature selection, our method combines these techniques to capture both linear and non-linear dependencies, ensuring that only the most relevant features are retained.When evaluated on the UNSW-NB15 dataset, the proposed Deep Feedforward Neural Network (DFNN) classifier achieved an accuracy of 89.23%, outperforming other models in terms of accuracy and training efficiency.These improvements make the model better suited for real-world IoT environments with computational limitations.

The Internet of Things (IoT) is a new technology paradigm that refers to distributed physical devices that are connected to the Internet. The large amount of data generated by these devices is considered to be a challenging issue. This data suffers from anomalies or abnormal behaviour for a number of reasons, such as sensor faults or attack issues. However, the data collected from IoT devices is usually unlabelled, which means that the normal or anomaly classes are unknown. This study proposes TCMD, a two-tier classification model for anomaly detection in IoT. In addition, it describes the validation methods used for the model to evaluate the quality of the clustering and the performance of the classification. TCMD firstly employs hierarchical affinity propagation (HAP) clustering to group the data into normal and anomaly clusters. Secondly, the labelled data obtained from the clustering is used to train decision trees (DTs). The results show that the TCMD is able to label the data which can be helpful to reduce human intervention. In addition, in terms of false positive rate (FPR), TCMD performs well compared with the DTs on the original dataset and outperforms the state-of-the-art model.

The rapid development of Internet of Things (IoT) networks has significantly increased their vulnerability to cyberattacks, so it is essential to develop effective Intrusion Detection Systems (IDS). Traditional algorithms often struggle with a high false positive rate and scalability issues in dynamic IoT environments. For addressing these challenges, this article proposed Optimized Cascading Long Short-Term Memory with Latin Sampling Satin Bowerbird Optimization (OCLSTM-LSBO) algorithm to effectively identify intrusions. The deep cascading LSTM framework captures the deep temporal dependencies in network traffic and improves the identification of difficult intrusion patterns in IoT networks. Then, employed the LSBO algorithm to fine-tune the hyperparameters of the LSTM model, which improves classification accuracy and enhances the generalization ability of the model. In the pre-processing phase, the Min-Max normalization technique is used to normalise the features in a uniform range. The OCLSTM-LSBO algorithm obtained the highest accuracy of 98.97% using the CICIoT2023 dataset and 95.62% using ToNIoT dataset for multiclass classification when compared to existing algorithms like Federated Multi Layered Deep-Learning (Fed-MLDL).

The emergence of various smart services delivered by heterogeneous Internet of Things (IoT) devices has made daily human-life easy and comfortable. IoT devices have brought enormous convenience to various applications, no matter the IoT systems include homogeneous devices like in most sensor networks or heterogeneous devices like in smart homes or smart business applications. However, several known communication infrastructures of IoT systems are at risk to various security attacks and threats. The practice of discovering uncommon occurrences of conventional behaviors is known as anomaly detection. It is an essential tool for detecting fraud as well as network intrusion. In this work, we provide an anomaly-based model on the Extended Isolation Forest method. In our work, the available dataset ’UNSW_2018_IoT_Botnet_Final_10_best_Testing’ has been used for the experiment. Performance indicators, including accuracy, precision, recall, and F1-Score, are used to validate the performance of our suggested system. We get an Accuracy Score of 93% and F1-Score of 96% through the experiment. In addition, the most important top 12 features have a more substantial impact on correct prediction for anomaly identification and have also been identified in this study.KeywordsAnomaly detectionIsolation forestExtended isolation forestIot securityFeature set

The economic growth and information technology leads to the development of Internet of Things (IoT) industry and has become the emerging field of research. Several intrusion detection techniques are introduced but the detection of intrusion and malicious activities poses a challenging task. This paper devises a novel method, namely the Water Moth Search algorithm (WMSA) algorithm, for training Deep Recurrent Neural Network (Deep RNN) to detect malicious network activities. The WMSA algorithm is newly devised by combining Water Wave optimization (WWO) and the Moth Search Optimization (MSO). The pre-processing is employed for the removal of redundant data. Then, the feature selection is devised using the Wrapper approach, then using the selected features; the Deep RNN classifier effectively detects the intrusion using the selected features. The proposed WMSA-based Deep RNN showed improved results with maximal accuracy, specificity, and sensitivity of 0.96, 0.973 and 0.960.

The proliferating popularity of Internet of Things (IoT) devices has led to wide‐scale networked system implementations across multiple disciplines, including transportation, medicine, smart homes, and many others. This unprecedented level of interconnectivity has introduced new security vulnerabilities and threats. Ensuring security in these IoT settings is crucial for protecting against malicious activities and safeguarding data. Real‐time identification and response to potential intrusions and attacks are essential, and intrusion detection systems (IDS) are pivotal in this process. However, the dynamic and diverse nature of the IoT environment presents significant challenges to existing IDS solutions, which are often based on rule‐based or statistical approaches. Deep learning, a subset of artificial intelligence, has shown great potential to enhance IDS in IoT. Deep learning models can identify complex patterns and characteristics by utilizing artificial neural networks, automatically building hierarchical representations from data. This capability results in more precise and efficient intrusion detection in IoT‐based systems. The primary aim of this survey is to present an extensive overview of the current research on deep learning and IDS in the IoT domain. By examining existing literature, discussing mainstream datasets, and highlighting current challenges and potential prospects, this survey provides valuable insights into the prevailing scenario and future directions for using deep learning in IDS for IoT. The findings from this research aim to enhance intrusion detection techniques in IoT environments and promote the development of more effective antimalware solutions against cyber threats targeting IoT device systems.

To classify sensor data correctly and quickly has a very sound impact on areas such as performance monitoring, user behavior analysis, and user accounting and intrusion detection in IoT (Internet of things). This work is an approach to reorganize the features in a dataset of 114 features depending on the relevancy and non-redundancy of an attribute or feature. Thus having a minimal set of 30 features can create a linear SVM classifier model to detect TCP attack in IoT botnet attack traffic.KeywordsFeature selectionIoTBotnetTCPSVM