DeepDCA: Novel Network-Based Detection of IoT Attacks Using Artificial Immune System
Source abstract
Abstract
Recently Internet of Things (IoT) attains tremendous popularity, although this promising technology leads to a variety of security obstacles. The conventional solutions do not suit the new dilemmas brought by the IoT ecosystem. Conversely, Artificial Immune Systems (AIS) is intelligent and adaptive systems mimic the human immune system which holds desirable properties for such a dynamic environment and provides an opportunity to improve IoT security. In this work, we develop a novel hybrid Deep Learning and Dendritic Cell Algorithm (DeepDCA) in the context of an Intrusion Detection System (IDS). The framework adopts Dendritic Cell Algorithm (DCA) and Self Normalizing Neural Network (SNN). The aim of this research is to classify IoT intrusion and minimize the false alarm generation. Also, automate and smooth the signal extraction phase which improves the classification performance. The proposed IDS selects the convenient set of features from the IoT-Bot dataset, performs signal categorization using the SNN then use the DCA for classification. The experimentation results show that DeepDCA performed well in detecting the IoT attacks with a high detection rate demonstrating over 98.73% accuracy and low false-positive rate. Also, we compared these results with State-of-the-art techniques, which showed that our model is capable of performing better classification tasks than SVM, NB, KNN, and MLP. We plan to carry out further experiments to verify the framework using a more challenging dataset and make further comparisons with other signal extraction approaches. Also, involve in real-time (online) attack detection.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Artificial Immune Systems Applications · Network Security and Intrusion Detection · Advanced Malware Detection Techniques
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
Faculty of Computing and Information Technology, King Abdulaziz University, Jeddah 21589, Saudi Arabia
Xinjiang Technical Institute of Physics & Chemistry, Chinese Academy of Sciences, Urumqi 830011, China
Funding
Deanship of Scientific Research (DSR) at King Abdulaziz University
References (81)
Show source-provided references
1. Kim, N.; Lee, I.; Zazo, J.; Belei, B. Internet of Things EDITOR. Technical report, 2019.
2. Secure routing for internet of things: A survey10.1016/j.jnca.2016.03.006 ↗
3. A Survey on Security and Privacy Issues in Internet-of-Things10.1109/JIOT.2017.2694844 ↗
4. RTE Ltd. FreeRTOS—Market leading RTOS (Real Time Operating System) for embedded systems with Internet of Things extensions, 2018.
5. Malwarebytes LABS. 2019 State of Malware. Technical report, 2019; p. 33.
6. DDoS in the IoT: Mirai and other botnets10.1109/MC.2017.201 ↗
7. Zahra, A., and Shah, M.A. (2017, January 7–8). IoT based ransomware growth rate evaluation and detection using command and control blacklisting. Proceedings of the ICAC 2017—2017 23rd IEEE International Conference on Automation and Computing: Addressing Global Challenges through Automation and Computing, Huddersfield, UK.10.23919/IConAC.2017.8082013 ↗
8. The rise of ransomware and emerging security challenges in the Internet of Things10.1016/j.comnet.2017.09.003 ↗
9. A Survey on Internet of Things: Architecture, Enabling Technologies, Security and Privacy, and Applications10.1109/JIOT.2017.2683200 ↗
10. Theoretical advances in artificial immune systems10.1016/j.tcs.2008.02.011 ↗
11. Anomaly detection in TCP/IP networks using immune systems paradigm10.1016/j.comcom.2006.08.016 ↗
12. Kim, J., and Bentley, P. (1999, January 13–16). An Artificial Immune Model for Network Intrusion Detection. Proceedings of the 7th European Congress on Intelligent Techniques and Soft Computing (EUFIT’99), Aachen, Germany.
13. An intelligent information security mechanism for the network layer of WSN: BIOSARP
14. Big data classification10.1145/2627534.2627557 ↗
15. Mazhar, N., and Farooq, M. (2007, January 26–29). BeeAIS: Artificial immune system security for nature inspired, MANET routing protocol, BeeAdHoc. Proceedings of the 6th International Conference on Artificial Immune Systems, Santos, Brazil.10.1007/978-3-540-73922-7_32 ↗
16. Mazhar, N., and Farooq, M. (2008, January 12–16). A sense of danger. Proceedings of the 10th Annual Conference on Genetic And Evolutionary Computation—GECCO ’08, Atlanta, GA, USA.10.1145/1389095.1389105 ↗
17. Aldhaheri, S., Alghazzawi, D., Cheng, L., Barnawi, A., and Alzahrani, B.A. (2020). Artificial Immune Systems approaches to secure the internet of things: A systematic review of the literature and recommendations for future research. J. Netw. Comput. Appl., 102537.10.1016/j.jnca.2020.102537 ↗
18. An artificial immune system architecture for computer security applications10.1109/TEVC.2002.1011540 ↗
19. Jungwon, K., and Bentley, P. (2001, January 27–30). Towards an artificial immune system for network intrusion detection: An investigation of clonal selection with a negative selection operator. Proceedings of the 2001 Congress on Evolutionary Computation (IEEE Cat. No.01TH8546), Seoul, Korea.
20. Kim, J., and Bentley, P.J. (2001, January 7–11). An evaluation of negative selection in an artificial immune system for network intrusion detection. Proceedings of the Genetic and Evolutionary Computation Conference (GECCO), San Francisco, CA, USA.
21. Greensmith, J.; Aickelin, U.; Cayzer, S. Introducing Dendritic Cells as a Novel Immune-Inspired Algorithm for Anomaly Detection. 2016. doi:10.2139/ssrn.2832073.10.2139/ssrn.2832073 ↗
22. Alves, R.T., Delgado, M.R., Lopes, H.S., and Freitas, A.A. (2004). An Artificial Immune System for Fuzzy-Rule Induction in Data Mining, Springer.10.1007/978-3-540-30217-9_102 ↗
23. Revisiting the foundations of artificial immune systems for data mining10.1109/TEVC.2006.884042 ↗
24. De Castro, L.N., and Timmis, J. (2002). Artificial Immune Systems: A Novel Paradigm to Pattern Recognition. Neural Netw. Pattern Recognit., 67–84.
25. Hart, E., Ross, P., and Nelson, J. (1998, January 4–9). Producing robust schedules via an artificial immune system. Proceedings of the 1998 IEEE International Conference on Evolutionary Computation Proceedings, IEEE World Congress on Computational Intelligence (Cat. No.98TH8360), Anchorage, AK, USA.
26. A new approach to solve hybrid flow shop scheduling problems by artificial immune system10.1016/j.future.2004.03.014 ↗
27. Solving multiobjective optimization problems using an artificial immune system10.1007/s10710-005-6164-x ↗
28. Artificial immune systems optimization approach for multiobjective distribution system reconfiguration10.1109/TPWRS.2014.2330628 ↗
29. An intelligent multifeature statistical approach for the discrimination of driving conditions of a hybrid electric vehicle10.1109/TITS.2010.2093129 ↗
30. Recentness biased learning for time series forecasting10.1016/j.ins.2010.09.004 ↗
31. Ishiguro, A., Kondo, T., Watanabe, Y., Shirai, Y., and Uchikawa, Y. (1997, January 12–15). Emergent construction of artificial immune networks for autonomous mobile robots. Proceedings of the 1997 IEEE International Conference on Systems, Man, and Cybernetics. Computational Cybernetics and Simulation, Orlando, FL, USA.
32. Greensmith, J. (2007). The Dendritic Cell Algorithm. [Ph.D. Thesis, University of Nottingham].
33. Conversion methods for symbolic features: A comparison applied to an intrusion detection problem10.1016/j.eswa.2009.02.054 ↗
34. A survey of intrusion detection in Internet of Things10.1016/j.jnca.2017.02.009 ↗
35. Anomaly-based network intrusion detection: Techniques, systems and challenges10.1016/j.cose.2008.08.003 ↗
36. Kasinathan, P., Pastrone, C., Spirito, M.A., and Vinkovits, M. (2013, January 7–9). Denial-of-Service detection in 6LoWPAN based Internet of Things. Proceedings of the International Conference on Wireless and Mobile Computing, Networking and Communications, Lyon, France.10.1109/WiMOB.2013.6673419 ↗
37. Deogirikar, J., and Vidhate, A. (2017, January 10–11). Security attacks in IoT: A survey. Proceedings of the International Conference on IoT in Social, Mobile, Analytics and Cloud, I-SMAC 2017, Palladam, India.10.1109/I-SMAC.2017.8058363 ↗
38. Ivan, C., Vujic, M., and Husnjak, S. (2015, January 21–24). Classification of Security Risks in the IoT Environment. Proceedings of the 26th DAAAM International Symposium on Intelligent Manufacturing and Automation, Zadar, Croatia.
39. Tambe, A., Aung, Y.L., Sridharan, R., Ochoa, M., Tippenhauer, N.O., Shabtai, A., and Elovici, Y. (2019, January 25–27). Detection of threats to IoT devices using scalable VPN-forwarded honeypots. Proceedings of the CODASPY 2019—9th ACM Conference on Data and Application Security and Privacy, Dallas, TX, USA.10.1145/3292006.3300024 ↗
40. Al Salami, S., Baek, J., Salah, K., and Damiani, E. (September, January 31). Lightweight encryption for smart home. Proceedings of the 2016 11th International Conference on Availability, Reliability and Security, ARES 2016, Salzburg, Austria.10.1109/ARES.2016.40 ↗
41. Cervantes, C., Poplade, D., Nogueira, M., and Santos, A. (2015, January 11–15). Detection of sinkhole attacks for supporting secure routing on 6LoWPAN for Internet of Things. Proceedings of the 2015 IFIP/IEEE International Symposium on Integrated Network Management, IM 2015, Ottawa, ON, Canada.10.1109/INM.2015.7140344 ↗
42. Notra, S., Siddiqi, M., Gharakheili, H.H., Sivaraman, V., and Boreli, R. (2014, January 29–31). An experimental study of security and privacy risks with emerging household appliances. Proceedings of the 2014 IEEE Conference on Communications and Network Security (CNS), San Francisco, CA, USA.10.1109/CNS.2014.6997469 ↗
43. Chen, J., and Chen, C. (2014, January 10–11). Design of complex event-processing IDS in internet of things. Proceedings of the 2014 6th International Conference on Measuring Technology and Mechatronics Automation, ICMTMA 2014, Zhangjiajie, China.
44. Wen, Q., Dong, X., and Zhang, R. (November, January 30). Application of dynamic variable cipher security certificate in Internet of Things. Proceedings of the 2012 IEEE 2nd International Conference on Cloud Computing and Intelligence Systems, IEEE CCIS 2012, Hangzhou, China.10.1109/CCIS.2012.6664544 ↗
45. Kasinathan, P., Costamagna, G., Khaleel, H., Pastrone, C., and Spirito, M.A. (2013, January 4–8). DEMO: An IDS framework for internet of things empowered by 6LoWPAN. Proceedings of the 2013 ACM SIGSAC Conference on Computer & Communications Security—CCS ’13, Berlin, Germany.10.1145/2508859.2512494 ↗
46. SVELTE: Real-time intrusion detection in the Internet of Things10.1016/j.adhoc.2013.04.014 ↗
47. Khraisat, A., Gondal, I., Vamplew, P., Kamruzzaman, J., and Alazab, A. (2019). A novel ensemble of hybrid intrusion detection system for detecting internet of things attacks. Electronics, 8.10.3390/electronics8111210 ↗
48. Khater, B.S., Wahab, A.W.B.A., Idris, M.Y.I.B., Hussain, M.A., and Ibrahim, A.A. (2019). A lightweight perceptron-based intrusion detection system for fog computing. Appl. Sci., 9.10.3390/app9010178 ↗
49. Network Traffic Classifier with Convolutional and Recurrent Neural Networks for Internet of Things10.1109/ACCESS.2017.2747560 ↗
50. Identification of malicious activities in industrial internet of things based on deep learning models
51. Tama, B.A., and Rhee, K.H. (2017). Attack Classification Analysis of IoT Network via Deep Learning Approach. Res. Briefs Inf. Commun. Technol. Evol. (ReBICTE).
52. Su, J., Vargas, D.V., Prasad, S., Sgandurra, D., Feng, Y., and Sakurai, K. (2018, January 23–27). Lightweight Classification of IoT Malware based on Image Recognition. Proceedings of the 2018 IEEE 42nd Annual Computer Software and Applications Conference (COMPSAC), Tokyo, Japan.10.1109/COMPSAC.2018.10315 ↗
53. Bansal, A., and Mahapatra, S. (2017, January 17). A comparative analysis of machine learning techniques for botnet detection. Proceedings of the 10th International Conference on Security of Information and Networks—SIN ’17, Jaipur, India.10.1145/3136825.3136874 ↗
54. Aminanto, M.E., and Kim, K. (2019, February 23). Deep Learning-based Feature Selection for Intrusion Detection System in Transport Layer. Available online: https://pdfs.semanticscholar.org/bf07/e753401b36662eee7b8cd6c65cb8cfe31562.pdf.
55. Canedo, J., and Skjellum, A. (2016, January 12–14). Using machine learning to secure IoT systems. Proceedings of the 2016 14th Annual Conference on Privacy, Security and Trust, PST 2016, Auckland, New Zealand.10.1109/PST.2016.7906930 ↗
56. Hodo, E., Bellekens, X., Hamilton, A., Dubouilh, P.L., Iorkyase, E., Tachtatzis, C., and Atkinson, R. (2016, January 11–13). Threat analysis of IoT networks using artificial neural network intrusion detection system. Proceedings of the 2016 International Symposium on Networks, Computers and Communications (ISNCC), Yasmine Hammamet, Tunisia.10.1109/ISNCC.2016.7746067 ↗
57. Chawla, S., and Thamilarasu, G. (2018, January 9–11). Security as a Service: Real-time Intrusion Detection in Internet of Things. Proceedings of the Fifth Cybersecurity Symposium, CyberSec ’18, Coeur d’ Alene, ID, USA.10.1145/3212687.3212872 ↗
58. Efficient service request detection algorithm based on hormone regulation mechanism in the Internet of things10.1016/S1005-8885(13)60242-3 ↗
59. Tolerance, Danger, and the Extended Family10.1146/annurev.iy.12.040194.005015 ↗
60. The danger model: A renewed sense of self10.1126/science.1071059 ↗
61. Aickelin, U., and Cayzer, S. (2008, January 10–13). The Danger Theory and Its Application to Artificial Immune Systems. Proceedings of the 7th International Conference on Artificial Immune Systems (ICARIS-2008), Phuket, Thailand.
62. A survey of the dendritic cell algorithm10.1007/s10115-015-0891-y ↗
63. Klambauer, G., Unterthiner, T., Mayr, A., and Hochreiter, S. (2017, January 4–9). Self-Normalizing Neural Networks. Proceedings of the Advances in Neural Information Processing Systems 30 (NIPS 2017), Long Beach, CA, USA.
64. Ioffe, S., and Szegedy, C. (2015, January 6–11). Batch normalization: Accelerating deep network training by reducing internal covariate shift. Proceedings of the 32nd International Conference on Machine Learning, ICML 2015, Lille, France.
65. Immune approach to the protection of IoT devices
66. A Security Situation Sense Model Based on Artificial Immune System in the Internet of Things10.4028/www.scientific.net/AMR.403-408.2457 ↗
67. Liu, C., Yang, J., Chen, R., Zhang, Y., and Zeng, J. (2011, January 26–28). Research on immunity-based intrusion detection technology for the Internet of Things. Proceedings of the 2011 7th International Conference on Natural Computation, ICNC 2011, Shanghai, China.10.1109/ICNC.2011.6022060 ↗
68. Artificial immunity-based security response model for the internet of things10.4304/jcp.8.12.3111-3118 ↗
69. Arrington, B., Barnett, L.E., Rufus, R., and Esterline, A. (2016, January 1–4). Behavioral modeling intrusion detection system (BMIDS) using internet of things (IoT) behavior-based anomaly detection via immunity-inspired algorithms. Proceedings of the 2016 25th International Conference on Computer Communications and Networks, ICCCN 2016, Waikoloa, HI, USA.10.1109/ICCCN.2016.7568495 ↗
70. Immune-Endocrine System Inspired Hierarchical Coevolutionary Multiobjective Optimization Algorithm for IoT Service10.1109/TCYB.2018.2866527 ↗
71. Kayacik, H.G., Zincir-Heywood, A.N., and Heywood, M.I. (2005, January 12–14). Selecting features for intrusion detection: A feature relevance analysis on KDD 99 intrusion detection datasets. Proceedings of the Third Annual Conference on Privacy, Security and Trust, Fredericton, NB, Canada.10.4018/978-1-59140-561-0.ch071 ↗
72. Wickham, H., and Winston, C. (2019, May 12). Create Elegant Data Visualisations Using the Grammar of Graphics. R Package Version 3.1.0. Available online: https://CRAN.R-project.org/package=ggplot2.
73. Waskom, M.; Botvinnik, O.; Hobson, P.; Cole, J.B.; Halchenko, Y.; Hoyer, S.; Miles, A.; Augspurger, T.; Yarkoni, T.; Megies, T.; et al. Seaborn: Statistical data visualization. 2018.
74. McKinney, W. (2011, January 18). pandas: A Foundational Python Library for Data Analysis and Statistics. Proceedings of the Workshop Python for High Performance and Scientific Computing (SC11), Seattle, WA, USA.
75. Guide to NumPy
76. Pedregosa, F.; Michel, V.; Grisel, O.; Blondel, M.; Prettenhofer, P.; Weiss, R.; Vanderplas, J.; Cournapeau, D.; Pedregosa, F.; Varoquaux, G.; et al. Scikit-learn: Machine Learning in Python Gaël Varoquaux Bertrand Thirion Vincent Dubourg Alexandre Passos PEDREGOSA, VAROQUAUX, GRAMFORT ET AL. Matthieu Perrot. Technical report, 2011.
77. van Merriënboer, B.; Bahdanau, D.; Dumoulin, V.; Serdyuk, D.;Warde-Farley, D.; Chorowski, J.; Bengio, Y. Blocks and Fuel: Frameworks for deep learning. 2015.
78. Chapman, P.; Clinton, J.; Kerber, R.; Khabaza, T.; Reinartz, T.; Shearer, C.R.H.; Wirth, R. CRISP-DM 1.0 Step-by-Step Data Mining Guide. 1999.
79. Towards the development of realistic botnet dataset in the Internet of Things for network forensic analytics: Bot-IoT dataset10.1016/j.future.2019.05.041 ↗
80. Collins, M. (2014). Network Security Through Data Analysis II, O’Reilly Media.
81. 1999 DARPA off-line intrusion detection evaluation10.1016/S1389-1286(00)00139-0 ↗