A Deep Learning Method for Lightweight and Cross-Device IoT Botnet Detection
Source abstract
Abstract
Ensuring security of Internet of Things (IoT) devices in the face of threats and attacks is a primary concern. IoT plays an increasingly key role in cyber–physical systems. Many existing intrusion detection systems (IDS) proposals for the IoT leverage complex machine learning architectures, which often provide one separate model per device or per attack. These solutions are not suited to the scale and dynamism of modern IoT networks. This paper proposes a novel IoT-driven cross-device method, which allows learning a single IDS model instead of many separate models atop the traffic of different IoT devices. A semi-supervised approach is adopted due to its wider applicability for unanticipated attacks. The solution is based on an all-in-one deep autoencoder, which consists of training a single deep neural network with the normal traffic from different IoT devices. Extensive experimentation performed with a widely used benchmarking dataset indicates that the all-in-one approach achieves within 0.9994–0.9997 recall, 0.9999–1.0 precision, 0.0–0.0071 false positive rate and 0.9996–0.9998 F1 score, depending on the device. The results obtained demonstrate the validity of the proposal, which represents a lightweight and device-independent solution with considerable advantages in terms of transferability and adaptability.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Network Security and Intrusion Detection · Anomaly Detection Techniques and Applications · Advanced Malware Detection Techniques
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
Dipartimento di Ingegneria, Università degli Studi del Sannio, Palazzo Bosco Lucarelli C.so Garibaldi 107, 82100 Benevento, Italy
References (38)
Show source-provided references
1. Internet of Things in Industries: A Survey10.1109/TII.2014.2300753 ↗
2. N-BaIoT—Network-Based Detection of IoT Botnet Attacks Using Deep Autoencoders10.1109/MPRV.2018.03367731 ↗
3. Detecting Internet of Things attacks using distributed deep learning10.1016/j.jnca.2020.102662 ↗
4. Malach, E., and Shalev-Shwartz, S. (2019, January 8–14). Is Deeper Better Only When Shallow is Good?. Proceedings of the International Conference on Neural Information Processing Systems, Vancouver, BC, Canada. Art. no. 577.
5. Vinayakumar, R., Soman, K.P., and Poornachandran, P. (2017, January 13–16). Evaluating effectiveness of shallow and deep networks to intrusion detection system. Proceedings of the International Conference on Advances in Computing, Communications and Informatics, Manipal, India.10.1109/ICACCI.2017.8126018 ↗
6. Deep learning methods in network intrusion detection: A survey and an objective comparison10.1016/j.jnca.2020.102767 ↗
7. Catillo, M., Pecchia, A., and Villano, U. (2022, January 23–26). Botnet Detection in the Internet of Things through All-in-One Deep Autoencoding. Proceedings of the International Conference on Availability, Reliability and Security, Vienna, Austria. Art. no. 90.10.1145/3538969.3544460 ↗
8. Preuveneers, D., Rimmer, V., Tsingenopoulos, I., Spooren, J., Joosen, W., and Ilie-Zudor, E. (2018). Chained Anomaly Detection Models for Federated Learning: An Intrusion Detection Case Study. Appl. Sci., 8.10.3390/app8122663 ↗
9. Network Anomaly Detection: Methods, Systems and Tools10.1109/SURV.2013.052213.00046 ↗
10. No more DoS? An empirical study on defense techniques for web server Denial of Service mitigation10.1016/j.jnca.2022.103363 ↗
11. Internet of Things: A Survey on Enabling Technologies, Protocols, and Applications10.1109/COMST.2015.2444095 ↗
12. Guerra-Manzanares, A., Medina-Galindo, J., Bahsi, H., and Nõmm, S. (2020, January 25–27). MedBIoT: Generation of an IoT Botnet Dataset in a Medium-sized IoT Network. Proceedings of the International Conference on Information Systems Security and Privacy, Valletta, Malta.10.5220/0009187802070218 ↗
13. Ullah, I., and Mahmoud, Q.H. (2020, January 29–30). A Scheme for Generating a Dataset for Anomalous Activity Detection in IoT Networks. Proceedings of the Advances in Artificial Intelligence, Canberra, Australia.10.1007/978-3-030-47358-7_52 ↗
14. Lopez-Martin, M., Carro, B., Sanchez-Esguevillas, A., and Lloret, J. (2017). Conditional Variational Autoencoder for Prediction and Feature Recovery Applied to Intrusion Detection in IoT. Sensors, 17.10.3390/s17091967 ↗
15. Towards a deep learning-driven intrusion detection approach for Internet of Things10.1016/j.comnet.2020.107784 ↗
16. Albulayhi, K., Abu Al-Haija, Q., Alsuhibany, S.A., Jillepalli, A.A., Ashrafuzzaman, M., and Sheldon, F.T. (2022). IoT Intrusion Detection Using Machine Learning with a Novel High Performing Feature Selection Method. Appl. Sci., 12.10.3390/app12105015 ↗
17. Ahmad, Z., Shahid Khan, A., Nisar, K., Haider, I., Hassan, R., Haque, M.R., Tarmizi, S., and Rodrigues, J.J.P.C. (2021). Anomaly Detection Using Deep Neural Network for IoT Architecture. Appl. Sci., 11.10.3390/app11157050 ↗
18. Anomaly-Based Intrusion Detection From Network Flow Features Using Variational Autoencoder10.1109/ACCESS.2020.3001350 ↗
19. Catillo, M., Rak, M., and Villano, U. (2019, January 7-9). Auto-scaling in the Cloud: Current Status and Perspectives. Proceedings of the Advances on P2P, Parallel, Grid, Cloud and Internet Computing, Antwerp, Belgium.10.1007/978-3-030-33509-0_58 ↗
20. Deep recurrent neural network for IoT intrusion detection system10.1016/j.simpat.2019.102031 ↗
21. Transferability of machine learning models learned from public intrusion detection datasets: The CICIDS2017 case study10.1007/s11219-022-09587-0 ↗
22. Fed-IIoT: A Robust Federated Malware Detection Architecture in Industrial IoT10.1109/TII.2020.3043458 ↗
23. Liu, Y., Kumar, N., Xiong, Z., Lim, W.Y.B., Kang, J., and Niyato, D. (2020, January 7–11). Communication-Efficient Federated Learning for Anomaly Detection in Industrial Internet of Things. Proceedings of the IEEE Global Communications Conference, Taipei, Taiwan.10.1109/GLOBECOM42002.2020.9348249 ↗
24. Mirsky, Y., Doitshman, T., Elovici, Y., and Shabtai, A. (2018, January 18–21). Kitsune: An Ensemble of Autoencoders for Online Network Intrusion Detection. Proceedings of the International Conference of Network and Distributed System Security Symposium, San Diego, CA, USA.10.14722/ndss.2018.23204 ↗
25. Catillo, M., Pecchia, A., and Villano, U. (2022). Simpler Is Better: On the Use of Autoencoders for Intrusion Detection. Quality of Information and Communications Technology, Springer.10.1007/978-3-031-14179-9_15 ↗
26. VAE-Based Latent Representations Learning for Botnet Detection in IoT Networks
27. Federated IoT attack detection using decentralized edge data
28. DeL-IoT: A deep ensemble learning approach to uncover anomalies in IoT10.1016/j.iot.2021.100391 ↗
29. A distributed density estimation algorithm and its application to naive Bayes classification10.1016/j.asoc.2020.106837 ↗
30. Unsupervised intelligent system based on one class support vector machine and Grey Wolf optimization for IoT botnet detection10.1007/s12652-019-01387-y ↗
31. A novel IoT network intrusion detection approach based on Adaptive Particle Swarm Optimization Convolutional Neural Network10.1016/j.ins.2021.03.060 ↗
32. Stacked Denoising Autoencoders: Learning Useful Representations in a Deep Network with a Local Denoising Criterion
33. Deep Learning for Anomaly Detection: A Review
34. Anomaly Detection: A Survey10.1145/1541880.1541882 ↗
35. Liu, F.T., Ting, K.M., and Zhou, Z. (2008, January 15–19). Isolation Forest. Proceedings of the IEEE International Conference on Data Mining, Pisa, Italy.10.1109/ICDM.2008.17 ↗
36. DDoS in the IoT: Mirai and Other Botnets10.1109/MC.2017.201 ↗
37. Outlier Detection for Monitoring Data Using Stacked Autoencoder10.1109/ACCESS.2019.2956494 ↗
38. Wohlin, C., Runeson, P., Höst, M., Ohlsson, M.C., Regnell, B., and Wesslén, A. (2000). Experimentation in Software Engineering: An Introduction, Kluwer Academic.10.1007/978-1-4615-4625-2 ↗