MULTI-BLOCK: A novel ML-based intrusion detection framework for SDN-enabled IoT networks using new pyramidal structure

A blockchain-enabled Model integrates blockchain technology with Intrusion Detection Systems to enhance the security of Internet of Things (IoT) networks. It ensures data integrity, decentralization, and tamper-proof logging of intrusion detection. The approach improves trust, transparency, and real-time threat detection in distributed IoT environments. The existing blockchain-based IDS approaches, Blockchain Enabled (BCE-IoT), uniquely integrate blockchain consensus with federated-style local training, lightweight cryptography, and Shapley Additive Explanations (SHAP)-based explainability, ensuring both security and interpretability in IoT environments. The proposed work combines Blockchain technology with explainable artificial intelligence solutions to create a new cybersecurity Model that strengthens intrusion detection within IoT networks. The proposed model enhances transparency in tracking cyberattacks by combining blockchain security storage capabilities with SHAP, an explainable AI. This research utilises machine learning and artificial intelligence to detect threats in real-time, countering Distributed Denial of Service (DDoS), Denial of Service (DoS), scanning, Cross-Site Scripting (XSS), injection, password, and backdoor attacks. BCE-IoT delivers more precise security by combining blockchain’s permanent data features and AI anomaly detectors, thereby reducing security alert mistakes. The performance effectiveness of Blockchain-Enabled IoT surpasses that of the Content Integrity Detection System. It combines Blockchain and Software-Defined Networking to enhance security in network environments, utilising blockchain-based mutual confirmation for software-defined networking to detect and block cyber threats. The evaluation establishes BCE-IoT as an effective IoT network security solution that delivers strong cybersecurity features, is adaptable to modern connected environments, and offers interpretable security solutions. The performance evaluations demonstrate that BCE-IoT provides a robust, flexible, and interpretable cybersecurity solution suitable for modern IoT environments.

The absence of standards and the diverse nature of the Internet of Things (IoT) have made security and privacy concerns more acute. Attacks such as distributed denial of service (DDoS) are becoming increasingly widespread in IoT, and the need for ways to stop them is growing. The use of newly formed Software-Defined Networking (SDN) significantly lowers the computational burden on IoT network nodes and makes it possible to perform more security measurements. This paper proposes an SDN-based, four-module DDoS attack detection and mitigation framework for IoT networks called FMDADM. The proposed FMDADM framework comprises four main modules and five-tier architecture. The first module implements an early detection process based on the average drop rate (ADR) principle using a 32-packet window size. The second module uses a novel double-check mapping function (DCMF), that aids in earlier attack detection at the data plane level. The third module is an ML-based detection application comprising four phases: data preprocessing, feature extraction, training and testing, and classification. This module detects DDoS attacks using only seven features: two selected and five newly computed features. The last module introduces an attack mitigation process. We applied the proposed framework to three test cases: one single-node attack test case and two multi-node attack test cases, all with real IoT traffic generated and deployed in Mininet-IoT. The proposed FMDADM framework efficiently detects DDoS attacks at high and low rates, can discriminate between attack traffic and flash crowds, and protects both local and remote IoT nodes by preventing infection from propagating to the ISP level. The FMDADM outperformed most existing cutting-edge approaches across ten different evaluation criteria. According to the experimental results, FMDADM achieved the following accuracy, precision, F-measure, recall, specificity, negative predictive value, false positive rate, false detection rate, false negative rate, and average detection time benchmarks:- 99.79%, 99.43%, 99.77%, 99.79%, 99.95%, 00.21%, 00.91%, 00.23%, and 2.64 μs, respectively.

The Internet of Things (IoT) is a network of sensors that helps collect data 24/7 without human intervention. However, the network may suffer from problems such as the low battery, heterogeneity, and connectivity issues due to the lack of standards. Even though these problems can cause several performance hiccups, security issues need immediate attention because hackers access vital personal and financial information and then misuse it. These security issues can allow hackers to hijack IoT devices and then use them to establish a Botnet to launch a Distributed Denial of Service (DDoS) attack. Blockchain technology can provide security to IoT devices by providing secure authentication using public keys. Similarly, Smart Contracts (SCs) can improve the performance of the IoT–blockchain network through automation. However, surveyed work shows that the blockchain and SCs do not provide foolproof security; sometimes, attackers defeat these security mechanisms and initiate DDoS attacks. Thus, developers and security software engineers must be aware of different techniques to detect DDoS attacks. In this survey paper, we highlight different techniques to detect DDoS attacks. The novelty of our work is to classify the DDoS detection techniques according to blockchain technology. As a result, researchers can enhance their systems by using blockchain-based support for detecting threats. In addition, we provide general information about the studied systems and their workings. However, we cannot neglect the recent surveys. To that end, we compare the state-of-the-art DDoS surveys based on their data collection techniques and the discussed DDoS attacks on the IoT subsystems. The study of different IoT subsystems tells us that DDoS attacks also impact other computing systems, such as SCs, networking devices, and power grids. Hence, our work briefly describes DDoS attacks and their impacts on the above subsystems and IoT. For instance, due to DDoS attacks, the targeted computing systems suffer delays which cause tremendous financial and utility losses to the subscribers. Hence, we discuss the impacts of DDoS attacks in the context of associated systems. Finally, we discuss Machine-Learning algorithms, performance metrics, and the underlying technology of IoT systems so that the readers can grasp the detection techniques and the attack vectors. Moreover, associated systems such as Software-Defined Networking (SDN) and Field-Programmable Gate Arrays (FPGA) are a source of good security enhancement for IoT Networks. Thus, we include a detailed discussion of future development encompassing all major IoT subsystems.

The Internet of Things (IoT) represents a new reality, as smart devices spread quickly and a higher number of applications arises. This attracts the attention of not only legitimate users but also attackers aiming to jeopardize the entire IoT infrastructure. Intrusion detection mechanisms are paramount in this networking environment as its first line of defense. Hence, this work proposes a Network Intrusion Detection System (NIDS) that deals with the Distributed Denial of Service (DDoS) attack, one of the most critical attacks that occur through IoT. The proposed NIDS uses stream learning to detect DDoS attacks in the IoT network and is designed to be deployed in a fog infrastructure. The detection model, built on Hoeffding Anytime Tree (HATT) algorithm, achieved a 99% accuracy and a 99% recall.

Internet of Things (IoT) networks are being designed to connect billions of sensors/devices for an application-specific environment to provide services and carry out special tasks. It enables the virtual connection of the real-world physical devices with Internet cyberspace. While, there is an exponentially growing trend in the use of IoT technology for diverse applications such as smart agriculture, smart industries, smart hospitals, smart homes, etc., there are pressing design issues which affect the IoT network performance in the long run, for example, replacement of batteries for increasing the lifetime of devices to maintain the network longevity. To tackle this challenge, various wireless powered-based energy transfer paradigms were proposed over time. Backscatter communication (BackCom) is likewise one of the energy-efficient solutions proposed, which can satisfy the stringent green communication aspects of IoT networks. To achieve massive connectivity in BackCom-enabled IoT network, selecting a suitable multiple access scheme is also a crucial part. Most multiple access schemes proposed for BackCom systems are based on frequency or timeslots sharing techniques. Multiple access techniques proposed for BackCom IoT system can reap the gain of non-orthogonal multiple access (NOMA) principle. In NOMA, multiple end nodes (ENs) of sensors network is served in the same resource block, thereby, increasing the spectrum efficiency of BackCom IoT system. In this chapter, we discuss the prospects of backscatter technique with application of NOMA for green communication in IoT network.

Internet of Things (IoT) is a technology that allows various physical devices to connect to each other and exchange data via the internet network. The application of IoT is increasingly widespread in various sectors such as smart homes, manufacturing industries, smart agriculture, and healthcare. However, along with the increasing number of devices and the volume of data traffic sent, the potential risk of cybersecurity threats is also increasing. The large number of IoT devices that have limited computing capabilities makes the system more vulnerable to various attacks, including intrusion, exploitation of system weaknesses, and Distributed Denial of Service (DDoS) attacks. Therefore, early detection of anomalies in network traffic is a crucial aspect to maintain the security and stability of IoT systems. This study aims to develop and implement a Support Vector Machine (SVM)-based architecture as a classification method in an anomaly detection system on an IoT network. SVM was chosen because of its ability to handle high-dimensional data and non-linear classification effectively. The methodology used includes the process of extracting features from IoT network traffic datasets, data normalization, model training using the SVM algorithm, and evaluating model performance in distinguishing between normal and anomalous traffic. Thus, the implementation of SVM architecture can be an effective and efficient solution in intrusion detection systems for IoT networks. This research also opens up opportunities for the development of more adaptive security systems by integrating machine learning-based detection models into large-scale IoT infrastructures.

The Internet of Things (IoT) is developing as a novel phenomenon that is applied in the growth of several crucial applications. However, these applications continue to function on a centralized storage structure, which leads to several major problems, such as security, privacy, and a single point of failure. In recent years, blockchain (BC) technology has become a pillar for the progression of IoT-based applications. The BC technique is utilized to resolve the security, privacy, and single point of failure (third-part dependency) issues encountered in IoT applications. Conversely, the distributed denial of service (DDoS) attacks on mining pools revealed the existence of vital fault lines amongst the BC-assisted IoT networks. Therefore, the current study designs a hybrid Harris Hawks with sine cosine and a deep learning-based intrusion detection system (H3SC-DLIDS) for a BC-supported IoT environment. The aim of the presented H3SC-DLIDS approach is to recognize the presence of DDoS attacks in the BC-assisted IoT environment. To enable secure communication in the IoT networks, BC technology is used. The proposed H3SC-DLIDS technique designs a H3SC technique by integrating the concepts of Harris Hawks optimization (HHO) and sine cosine algorithm (SCA) for feature selection. For the intrusion detection process, a long short-term memory auto-encoder (LSTM-AE) model is utilized in this study. Finally, the arithmetic optimization algorithm (AOA) is implemented for hyperparameter tuning of the LSTM-AE technique. The proposed H3SC-DLIDS method was experimentally validated using the BoT-IoT database, and the results indicate the superior performance of the proposed H3SC-DLIDS technique over other existing methods, with a maximum accuracy of 99.05%.

With the fast growth of Internet of Things (IoT), there is an increasing security impact, e.g., IoT environments has become the advanced target of complex cyber-attack like Distributed Denial of Service (DDoS) attack. Most conventional Intrusion Detection Systems (IDSs) fail to scale with the heterogeneity, scale, and dynamism of IoT networks. To overcome these challenges, in this paper, we develop a smart hybrid intrusion detection framework that can effectively utilize the power of Machine Learning (ML) and Neural Network (NN) models, namely: cascades backpropagation neural network (CPBNN) and convolutional neural network (CNN) to improving accuracy and adaptability of detection in IoT environments. The proposed system employs a two-layer detection structure where the CPBNN model is used to detect abnormal patterns in the network packet level and identify the abnormal behaviors of packet sequences, whereas the CNN model performs deep feature extraction and classification to predict the abnormality as well as the nature of the abnormality. We develop this hybrid architecture to work well under IoT level large-scale deployments without incurring software overhead. The system has been evaluated on the KDDTest-21 benchmark dataset with the usual metrics, including accuracy, precision, recall and F1-score. Experiments results prove the CNN’s performance with 90% and CPBNN with 82% which valid the efficiency of the proposed method in detecting IoT related security threats. These results suggest the ability of intelligent hybrid IDS systems not only to defend in a pro-active manner using ML and neural networks in synergy, but also to use the adversary's strength against itself.

The size of Internet of Things (IoT) networks is increasing exponentially, and parallelly, the security threats are also escalating. As many of the IoT devices run on limited resources, any intrusion attack based on DoS, packet flooding, man-in-middle and probing is effective to disturb, distract and defunct the networks. A intrusion detection is always a challenging task for the network administrator or any automated software system. A machine learning network-based intrusion detection system (IDS) works efficiently and detects such attacks in any type of networks. It analyzes the packets transmitting over the networks without bothering the IoT devices. Hence, IDS systems are highly crucial and important for IoT network security. This paper proposes a machine learning network-based IDS for securing IoT networks. The proposed technique uses classification techniques to classify a network packet as normal or some kind of malicious attacks. The model was trained with a dataset which is a network logs collected from a network transmitting data from NodeMCU with ESP8266 wi-fi module to a server. The data was captured from the ultrasonic sensor with Arduino and NodeMCU used to monitor a network. For choosing the best detection model out of eight classification based models were studied. The decision tree and random forest are most accurate models as compared to other classification techniques. The comparative analysis of these models is analyzed and discussed in the result section.KeywordsIoTNetwork securityIntrusion detection systemMachine learningAttacks

The environmental impacts that are associated with the interconnected sensor devices in the Internet of Things (IoT) network are minimized with the utilization of green communication. This is because, when the IoT devices tend to grow, the IoT system becomes more prone to issues regarding the utilization of resources, sustainability, and energy consumption within the communication system. Tuning the communication protocols, lowering the IoT device’s energy usage rate, and establishing an effective technique for the transmission of data are performed. This is achieved by the green communication technique, which aids in the establishment of significant energy savings in the IoT network. For devices with limited power sources, the green communication technology offers an extended battery life. Despite the enormous potential of IoT technology, a number of obstacles need to be overcome, including those related to load balancing, security, storage, privacy, energy management, and device heterogeneity. In response to the challenges posed by conventional models, an innovative solution for the selection of Cluster Head (CH) using a hybrid approach is devised here. The energy consumption of sensor nodes is influenced by various factors, such asCH load, temperature, distance, residual energy, the number of alive nodes, delay, and so on. To address these challenges in IoT networks, a hybrid approach that combines the Squid Game Optimizer (SGO) and the Artificial Gorilla Troops Optimizer (AGTO) for the optimal selection of CH is suggested. The implemented approach is named Hybrid Squid Game with Artificial Gorilla Troops Optimizer (HSG-AGTO). This approach aims to optimize the above-mentioned factors and overcome energy consumption challenges in IoT networks. The effectiveness of the model is validated, and the results demonstrate the superior performance of the suggested model.

This paper examines the enhancement of security measures for the Internet of Things (IoT) systems through the application of Machine Learning (ML) techniques. As the number of IoT devices continues to rise, ensuring their security has become increasingly critical, given that conventional methods frequently struggle to identify advanced threats. This study explores the implementation of several ML algorithms, including Random Forest (RF), Decision Trees (DT), Support Vector Machines (SVM), and Convolutional Neural Networks (CNN), to identify anomalies and intrusions within IoT networks. By conducting a comprehensive review of existing research and experiments, it highlights the effectiveness of ML in enhancing IoT security, with high detection rates for various threats, including botnet attacks, Denial-of-Service (DoS) and Distributed Denial-of-Service (DDoS) incidents, and intrusion attempts. DoS/DDoS attacks and many types of botnets are the most devastating attacks that have been spreading for a long time, and they are still branching out in new ways against IoT networks. They can damage IoT services and prevent these services from being used by legitimate users. Therefore, securing IoT networks becomes a significant concern. The proposed model is used to increasingly monitor network traffic for any deviations from standard patterns IoT networks. This paper also stresses the necessity of utilising suitable datasets and feature selection techniques to enhance the efficacy of ML models. To train our model, we have utilized a dataset called the IoT23 dataset, which is one of the most recent datasets that has many IoT scenarios and anomalous activities. Further-more, we utilised two types of feature selection algorithms, the Correlation-based Feature Selection (CFS) algorithm and the Genetic Algorithm (GA), and then we compared the results of these algorithms when training our model. The best performances were obtained with DT and RF classifiers when they were trained with features selected by CFS However, for training and testing times metrics, DT performance was superior across both feature selection methods.

The substantial growth of Internet-connected devices within the Internet of Things (IoT) has given rise to significant security challenges. Among the various threats confronting these interconnected devices, Denial of Service (DoS)/Distributed Denial of Service (DDoS) attacks emerge as significant concerns. The attacks, which seek to disrupt IoT services by flooding networks with unnecessary traffic, there is a critical need for robust security measures. Intrusion Detection Systems (IDS) are vital in identifying suspicious activities, yet many existing systems lack real-time capabilities to address evolving attack strategies. This study investigates the vulnerabilities of IoT networks and the pressing need to detect and classify DoS/DDoS attacks in real time. Traditional IDS, while effective in recognizing known attack patterns, fall short in identifying new attack types due to their reliance on historical data. To bridge this gap, this research focuses on developing an enhanced hybrid network intrusion detection and classification system. This study seeks to make contribution to the advancement of resilient security measures within IoT environments. The framework uses the Kth Nearest Neighbor (KNN) algorithm and dense neural networks to efficiently detect and categorize DoS/DDoS attacks in real time. To achieve this, a simulation model implementing the proposed hybrid algorithm will be developed. The framework utilized the MQTT-IoT-IDS2020 dataset, and a comparison was presented with recent approaches found in the literature. The results demonstrated enhanced performance in terms of true positive rate, accuracy, speed of detection.

ABSTRACTThe rapid evolution of the Internet of Things (IoT) has revolutionized various sectors, fostering seamless intercommunication and real‐time monitoring. Central to this transformation is integrating blockchain technology, which ensures data integrity and security in IoT networks. This paper provides a meticulous exploration of data aggregation techniques within the context of blockchain‐based IoT systems. The study categorizes data aggregation algorithms into Privacy‐Preserving, Machine Learning‐Based, Hierarchical, Real‐Time, and Custom Aggregation Algorithms, each tailored to specific IoT requirements. Privacy‐Preserving Aggregation Algorithms focus on safeguarding sensitive data through encryption and secure protocols. Machine Learning‐Based Aggregation adapts dynamically to data patterns, offering predictive insights and real‐time adaptability. Hierarchical Aggregation organizes devices into a structured hierarchy, optimizing data processing. Real‐Time Aggregation processes data instantly, ensuring low latency for time‐sensitive applications. Custom Aggregation Algorithms are bespoke solutions tailored to unique application demands, emphasizing efficiency and security. Through a comparative analysis of these techniques, this paper explores their advantages, disadvantages, and applicability, addressing the challenges and suggesting future research directions. The integration of blockchain‐based data aggregation techniques not only enhances IoT network efficiency but also ensures the longevity and security of modern technological infrastructures. This study builds upon prior research in the field of IoT and blockchain technology by extending the exploration of data aggregation techniques and their implications for network efficiency and security. SLR method has been used to investigate each one in terms of influential properties such as the main idea, advantages, disadvantages, and strategies. The results indicate most of the articles were published in 2021 and 2022. Moreover, some important parameters such as privacy and security, latency, data processing, energy consumption, complexity, and reliability were involved in these investigations.

The concept of Security Aware Routing is not widely adopted in current networks. However, the new IoT-centric core networks give possibilities to re-open that field of research. We consider routing to be an addition to existing network security methods, especially in IoT domain. Security-aware routing incorporates the security and safety metrics to the traditional set of metrics (bandwidth, network delay, hop count, path cost, load etc.). The paper shows a new approach in which, based on the Software Defined Networks (SDN) we estimate trust relationships between nodes and flows and use them to create SDN paths, based on the Cognitive Packet Network (CPN) principle. The Random Neural Networks (RNN) supported with cognitive packets are used for making routing decisions. The proposed solution was designed and is being implemented within the SerIoT project to demonstrate secure networks for the Internet of Things (IoT).

The exponential growth of the Internet of Things (IoT) has led to the rapid expansion of interconnected systems, which has also increased the vulnerability of IoT devices to security threats such as distributed denial-of-service (DDoS) attacks. In this paper, we propose a machine learning pipeline that specifically addresses the issue of DDoS attack detection in IoT networks. Our approach comprises of (i) a processing module to prepare the data for further analysis, (ii) a dynamic attribute selection module that selects the most adaptive and productive features and reduces the training time, and (iii) a classification module to detect DDoS attacks. We evaluate the effectiveness of our approach using the CICI-IDS-2018 dataset and five powerful yet simple machine learning classifiers—Decision Tree (DT), Gaussian Naive Bayes, Logistic Regression (LR), K-Nearest Neighbor (KNN), and Random Forest (RF). Our results demonstrate that DT outperforms its counterparts and achieves up to 99.98% accuracy in just 0.18 s of CPU time. Our approach is simple, lightweight, and accurate for detecting DDoS attacks in IoT networks.