Anomaly-Based Intrusion Detection Systems in IoT Using Deep Learning: A Systematic Literature Review
Source abstract
Abstract
The Internet of Things (IoT) concept has emerged to improve people’s lives by providing a wide range of smart and connected devices and applications in several domains, such as green IoT-based agriculture, smart farming, smart homes, smart transportation, smart health, smart grid, smart cities, and smart environment. However, IoT devices are at risk of cyber attacks. The use of deep learning techniques has been adequately adopted by researchers as a solution in securing the IoT environment. Deep learning has also successfully been implemented in various fields, proving its superiority in tackling intrusion detection attacks. Due to the limitation of signature-based detection for unknown attacks, the anomaly-based Intrusion Detection System (IDS) gains advantages to detect zero-day attacks. In this paper, a systematic literature review (SLR) is presented to analyze the existing published literature regarding anomaly-based intrusion detection, using deep learning techniques in securing IoT environments. Data from the published studies were retrieved from five databases (IEEE Xplore, Scopus, Web of Science, Science Direct, and MDPI). Out of 2116 identified records, 26 relevant studies were selected to answer the research questions. This review has explored seven deep learning techniques practiced in IoT security, and the results showed their effectiveness in dealing with security challenges in the IoT ecosystem. It is also found that supervised deep learning techniques offer better performance, compared to unsupervised and semi-supervised learning. This analysis provides an insight into how the use of data types and learning methods will affect the performance of deep learning techniques for further contribution to enhancing a novel model for anomaly intrusion detection and prediction.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Network Security and Intrusion Detection · Anomaly Detection Techniques and Applications · Advanced Malware Detection Techniques
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
School of Computing, Faculty of Engineering, Universiti Teknologi Malaysia (UTM), Skudai 81310, Johor, Malaysia
College of Computer Science and Engineering, Taibah University, Medina 41477, Saudi Arabia
Institute for Artificial Intelligence and Big Data, Universiti Malaysia Kelantan, City Campus, Pengkalan Chepa, Kota Bharu 16100, Kelantan, Malaysia
References (66)
Show source-provided references
1. Understanding the Internet of Things: Definition, potentials, and societal role of a fast evolving paradigm10.1016/j.adhoc.2016.12.004 ↗
2. Intrusion detection systems for IoT-based smart environments: A survey10.1186/s13677-018-0123-6 ↗
3. Internet of things in industries: A survey10.1109/TII.2014.2300753 ↗
4. A Survey on Internet of Things: Architecture, Enabling Technologies, Security and Privacy, and Applications10.1109/JIOT.2017.2683200 ↗
5. Deep recurrent neural network for IoT intrusion detection system10.1016/j.simpat.2019.102031 ↗
6. IoT reliability: A review leading to 5 key research directions10.1007/s42486-020-00037-z ↗
7. Security and Privacy for Green IoT-Based Agriculture: Review, Blockchain Solutions, and Challenges10.1109/ACCESS.2020.2973178 ↗
8. A Survey on the Role of IoT in Agriculture for the Implementation of Smart Farming10.1109/ACCESS.2019.2949703 ↗
9. A Life Cycle Framework of Green IoT-Based Agriculture and Its Finance, Operation, and Management Issues10.1109/MCOM.2019.1800332 ↗
10. Pal, S., Hitchens, M., Rabehaja, T., and Mukhopadhyay, S. (2020). Security Requirements for the Internet of Things: A Systematic Approach. Sensors, 20.10.3390/s20205897 ↗
11. Context-aware data-centric misbehaviour detection scheme for vehicular ad hoc networks using sequential analysis of the temporal and spatial correlation of the consistency between the cooperative awareness messages
12. Understanding Security Requirements and Challenges in Internet of Things (IoT): A Review
13. Distributed attack detection scheme using deep learning approach for Internet of Things10.1016/j.future.2017.08.043 ↗
14. Thamilarasu, G., and Chawla, S. (2019). Towards Deep-Learning-Driven Intrusion Detection for the Internet of Things. Sensors, 19.10.3390/s19091977 ↗
15. Yang, Y., Zheng, K., Wu, C., and Yang, Y. (2019). Improving the classification effectiveness of intrusion detection by using improved conditional variational autoencoder and deep neural network. Sensors, 19.10.3390/s19112528 ↗
16. DeepBot: A time-based botnet detection with deep learning10.1007/s00500-020-04963-z ↗
17. DeepAnT: A Deep Learning Approach for Unsupervised Anomaly Detection in Time Series10.1109/ACCESS.2018.2886457 ↗
18. A Deep Learning Approach to Network Intrusion Detection10.1109/TETCI.2017.2772792 ↗
19. Intrusion detection systems in the Internet of things: A comprehensive investigation10.1016/j.comnet.2019.05.014 ↗
20. Anomaly Detection, Analysis and Prediction Techniques in IoT Environment: A Systematic Literature Review10.1109/ACCESS.2019.2921912 ↗
21. Internet of Things: A survey on machine learning-based intrusion detection approaches10.1016/j.comnet.2019.01.023 ↗
22. Chalapathy, R., and Chawla, S. (2019). Deep learning for anomaly detection: A survey. arXiv.10.1145/3394486.3406704 ↗
23. Sharma, B., Sharma, L., and Lal, C. (2019, January 11–12). Anomaly Detection Techniques using Deep Learning in IoT: A Survey. Proceedings of the 2019 International Conference on Computational Intelligence and Knowledge Economy (ICCIKE), Dubai, United Arab Emirates.10.1109/ICCIKE47802.2019.9004362 ↗
24. Alsoufi, M.A., Razak, S., Siraj, M.M., Ali, A., Nasser, M., and Abdo, S. (2021). Anomaly Intrusion Detection Systems in IoT Using Deep Learning Techniques: A Survey, Springer International Publishing.10.1007/978-3-030-70713-2_60 ↗
25. Kitchenham, B., and Charters, S. (2007). Guidelines for Performing Systematic Literature Reviews in Software Engineering, Keele University. EBSE Technical Report.
26. A systematic review of systematic review process research in software engineering10.1016/j.infsof.2013.07.010 ↗
27. A Systematic Literature Review of the Data Replication Techniques in the Cloud Environments10.1016/j.bdr.2017.06.003 ↗
28. Safaei, M., Asadi, S., Driss, M., Boulila, W., Alsaeedi, A., Chizari, H., Abdullah, R., and Safaei, M. (2020). A systematic literature review on outlier detection in wireless sensor networks. Symmetry, 12.10.3390/sym12030328 ↗
29. Knowledge transfer challenges and mitigation strategies in global software development—A systematic literature review and industrial validation10.1016/j.ijinfomgt.2012.11.004 ↗
30. Improved Long Short-Term Memory based anomaly detection with concept drift adaptive method for supporting IoT services10.1016/j.future.2020.05.035 ↗
31. Deep Learning for Proactive Network Monitoring and Security Protection10.1109/ACCESS.2020.2968718 ↗
32. Detection of Low-Frequency and Multi-Stage Attacks in Industrial Internet of Things10.1109/TVT.2020.2995133 ↗
33. Detecting Internet of Things attacks using distributed deep learning10.1016/j.jnca.2020.102662 ↗
34. Kim, J., Kim, J., Kim, H., Shim, M., and Choi, E. (2020). CNN-Based Network Intrusion Detection against Denial-of-Service Attacks. Electronics, 9.10.3390/electronics9060916 ↗
35. IoT botnet detection via power consumption modeling10.1016/j.smhl.2019.100103 ↗
36. Robust detection for network intrusion of industrial IoT based on multi-CNN fusion10.1016/j.measurement.2019.107450 ↗
37. Yin, C., Zhang, S., Wang, J., and Xiong, N.N. (2020). Anomaly Detection Based on Convolutional Recurrent Autoencoder for IoT Time Series. IEEE Trans. Syst. Man Cybern. Syst., 1–11.
38. Identification of malicious activities in industrial internet of things based on deep learning models
39. A graph neural network method for distributed anomaly detection in IoT10.1007/s12530-020-09347-0 ↗
40. Effective Attack Detection in Internet of Medical Things Smart Environment Using a Deep Belief Neural Network10.1109/ACCESS.2020.2986013 ↗
41. N-BaIoT—Network-Based Detection of IoT Botnet Attacks Using Deep Autoencoders10.1109/MPRV.2018.03367731 ↗
42. Gurina, A., and Eliseev, V. (2019). Anomaly-Based Method for Detecting Multiple Classes of Network Attacks. Information, 10.10.3390/info10030084 ↗
43. Kim, S., Hwang, C., and Lee, T. (2020). Anomaly Based Unknown Intrusion Detection in Endpoint Environments. Electronics, 9.10.3390/electronics9061022 ↗
44. Cost-sensitive stacked auto-encoders for intrusion detection in the Internet of Things10.1016/j.iot.2019.100122 ↗
45. An Unsupervised Deep Learning Model for Early Network Traffic Anomaly Detection10.1109/ACCESS.2020.2973023 ↗
46. An Empirical Evaluation of Deep Learning for Network Anomaly Detection10.1109/ACCESS.2019.2943249 ↗
47. IoT data feature extraction and intrusion detection system for smart cities based on deep migration learning10.1016/j.ijinfomgt.2019.04.006 ↗
48. Lopez-Martin, M., Carro, B., Sanchez-Esguevillas, A., and Lloret, J. (2017). Conditional Variational Autoencoder for Prediction and Feature Recovery Applied to Intrusion Detection in IoT. Sensors, 17.10.3390/s17091967 ↗
49. Leveraging Semi-supervised Hierarchical Stacking Temporal Convolutional Network for Anomaly Detection in IoT Communication10.1109/JIOT.2020.3000771 ↗
50. A systematic analysis of performance measures for classification tasks10.1016/j.ipm.2009.03.002 ↗
51. Powers, D.M. (2011). Evaluation: From precision, recall and F-measure to ROC, informedness, markedness and correlation. arXiv.
52. Machine Learning and Deep Learning Methods for Cybersecurity10.1109/ACCESS.2018.2836950 ↗
53. Distributed Abnormal Behavior Detection Approach Based on Deep Belief Network and Ensemble SVM Using Spark10.1109/ACCESS.2018.2875045 ↗
54. Deep learning and big data technologies for IoT security10.1016/j.comcom.2020.01.016 ↗
55. Moustafa, N., and Slay, J. (2015, January 10–12). UNSW-NB15: A comprehensive data set for network intrusion detection systems (UNSW-NB15 network data set). Proceedings of the 2015 Military Communications and Information Systems Conference (MilCIS), Canberra, Australia.10.1109/MilCIS.2015.7348942 ↗
56. Towards the development of realistic botnet dataset in the internet of things for network forensic analytics: Botiot dataset10.1016/j.future.2019.05.041 ↗
57. Song, J., Takakura, H., and Okabe, Y. (2016, March 15). Description of Kyoto University Benchmark Data. Available online: http://www.takakura.com/Kyoto_data/BenchmarkData-Description-v5.pdf.
58. Tang, T.A., Mhamdi, L., McLernon, D., Zaidi, S.A.R., and Ghogho, M. (2016, January 26–29). Deep learning approach for network intrusion detection in software defined networking. Proceedings of the 2016 International Conference on Wireless Networks and Mobile Communications (WINCOM), Fez, Morocco.10.1109/WINCOM.2016.7777224 ↗
59. Hossain, M.M., Fotouhi, M., and Hasan, R. (July, January 27). Towards an analysis of security issues, challenges, and open problems in the internet of things. Proceedings of the 2015 IEEE World Congress on Services, New York, NY, USA.10.1109/SERVICES.2015.12 ↗
60. Framework for Mobile Internet of Things Security Monitoring Based on Big Data Processing and Machine Learning10.1109/ACCESS.2018.2881998 ↗
61. Deep Learning Approach for Intelligent Intrusion Detection System10.1109/ACCESS.2019.2895334 ↗
62. Deep learning for visual understanding: A review10.1016/j.neucom.2015.09.116 ↗
63. A scalable distributed machine learning approach for attack detection in edge computing environments10.1016/j.jpdc.2018.03.006 ↗
64. IoTDeM: An IoT Big Data-oriented MapReduce performance prediction extended model in multiple edge clouds10.1016/j.jpdc.2017.11.001 ↗
65. Accurate periocular recognition under less constrained environment using semantics-assisted convolutional neural network10.1109/TIFS.2016.2636093 ↗
66. A deep Recurrent Neural Network based approach for Internet of Things malware threat hunting10.1016/j.future.2018.03.007 ↗