A survey of intrusion detection in Internet of Things

Cyber-Physical Systems Security: Limitations, Issues and Future Trends

Cyber-threat protection is today’s one of the most challenging research branches of information technology, while the exponentially increasing number of tiny, connected devices able to push personal data to the Internet is doing nothing but exacerbating the battle between the involved parties. Thus, this protection becomes crucial with a typical Internet-of-Things (IoT) setup, as it usually involves several IoT-based data sources interacting with the physical world within various application domains, such as agriculture, health care, home automation, critical industrial processes, etc. Unfortunately, contemporary IoT devices often offer very limited security features, laying themselves open to always new and more sophisticated attacks and also inhibiting the expected global adoption of IoT technologies, not to mention millions of IoT devices already deployed without any hardware security support. In this context, it is crucial to develop tools able to detect such cyber threats. In this article, we present Passban, an intelligent intrusion detection system (IDS) able to protect the IoT devices that are directly connected to it. The peculiarity of the proposed solution is that it can be deployed directly on very cheap IoT gateways (e.g., single-board PCs currently costing few tens of U.S. dollars), hence taking full advantage of the edge computing paradigm to detect cyber threats as close as possible to the corresponding data sources. We will demonstrate that Passban is able to detect various types of malicious traffic, including Port Scanning, HTTP and SSH Brute Force, and SYN Flood attacks with very low false positive rates and satisfactory accuracies.

Passban IDS: An Intelligent Anomaly-Based Intrusion Detection System for IoT Edge Devices

Internet of Things (IoT) and its applications are the most popular research areas at present. The characteristics of IoT on one side make it easily applicable to real-life applications, whereas on the other side expose it to cyber threats. Denial of Service (DoS) is one of the most catastrophic attacks against IoT. In this paper, we investigate the prospects of using machine learning classification algorithms for securing IoT against DoS attacks. A comprehensive study is carried on the classifiers which can advance the development of anomaly-based intrusion detection systems (IDSs). Performance assessment of classifiers is done in terms of prominent metrics and validation methods. Popular datasets CIDDS-001, UNSW-NB15, and NSL-KDD are used for benchmarking classifiers. Friedman and Nemenyi tests are employed to analyze the significant differences among classifiers statistically. In addition, Raspberry Pi is used to evaluate the response time of classifiers on IoT specific hardware. We also discuss a methodology for selecting the best classifier as per application requirements. The main goals of this study are to motivate IoT security researchers for developing IDSs using ensemble learning, and suggesting appropriate methods for statistical assessment of classifier’s performance.

Machine Learning Based Intrusion Detection Systems for IoT Applications

Internet of Things (IoT) is widely accepted technology in both industrial as well as academic field. The objective of IoT is to combine the physical environment with the cyber world and create one big intelligent network. This technology has been applied to various application domains such as developing smart home, smart cities, healthcare applications, wireless sensor networks, cloud environment, enterprise network, web applications, and smart grid technologies. These wide emerging applications in variety of domains raise many security issues such as protecting devices and network, attacks in IoT networks, and managing resource-constrained IoT networks. To address the scalability and resource-constrained security issues, many security solutions have been proposed for IoT such as web application firewalls and intrusion detection systems. In this paper, a comprehensive survey on Intrusion Detection System (IDS) for IoT is presented for years 2015–2019. We have discussed various IDS placement strategies and IDS analysis strategies in IoT architecture. The paper discusses various intrusions in IoT, along with Machine Learning (ML) and Deep Learning (DL) techniques for detecting attacks in IoT networks. The paper also discusses security issues and challenges in IoT.

A Review on Machine Learning and Deep Learning Perspectives of IDS for IoT: Recent Updates, Security Issues, and Challenges

6LoWPAN is one of Internet of Things standard, which allows IPv6 over the low-rate wireless personal area networks. All sensor nodes have their own IPv6 address to connect to Internet. Therefore, the challenge of implementing secure communication in the Internet of Things must be addressed. There are various attack in 6LoWPAN, such as Denial-of-service, wormhole and selective forwarding attack methods. And the Dos attack method is one of the major attacks in WSN and 6LoWPAN. The sensor node’s energy will be exhausted by these attacks due to the battery power limitation. For this reason, security has become more important in 6LoWPAN. In this paper, we proposed a lightweight intrusion detection model based on analysis of node’s consumed in 6LowPAN. The 6LoWPAN energy consumption models for mesh-under and route-over routing schemes are also concerned in this paper. The sensor nodes with irregular energy consumptions are identified as malicious attackers. Our simulation results show the proposed intrusion detection system provides the method to accurately and effectively recognize malicious attacks.

A Lightweight Intrusion Detection Scheme Based on Energy Consumption Analysis in 6LowPAN

6L0WPAN is an IPv6 adaptation layer that defines Internet Protocols over low power, low data rate devices such as IEEE 802.15.4. It is difficult to implement because the size of IPv6 packet is much larger than the packet size of IEEE 802.15.4 data link layer. In order to solve this problem, the IETF 6LoWPAN working group introduces the adaptation layer between network and data link layers. It provides header compression to reduce transmission overhead, fragmentation and reassembly of IPv6 packet. In addition, the routing schemes in 6LoWPAN can be divided into two categories: mesh-under and route-over. The main difference between these two schemes depends on how the packets or fragments are processed before being forwarded. In this paper, we present an analysis between these two routing schemes and comparing their IP packet successful transmission probabilities. Moreover, while the number of competing nodes increases, the probability of successful transmission will decrease due to the CSMA/CA mechanism.

Modeling and Performance Analysis of Route-Over and Mesh-Under Routing Schemes in 6LoWPAN

6LoWPAN technology has attracted extensive attention recently. It is because 6LoWPAN is one of Internet of Things standard and it adapts to IPv6 protocol stack over low-rate wireless personal area network, such as IEEE 802.15.4. One view is that IP architecture is not suitable for low-rate wireless personal area network. It is a challenge to implement the IPv6 protocol stack into IEEE 802.15.4 devices due to that the size of IPv6 packet is much larger than the maximum packet size of IEEE 802.15.4 in data link layer. In order to solve this problem, 6LoWPAN provides header compression to reduce the transmission overhead for IP packets. In addition, two selected routing schemes, mesh-under and route-over routing schemes, are also proposed in 6LoWPAN to forward IP fragmentations under IEEE 802.15.4 radio link. The distinction is based on which layer of the 6LoWPAN protocol stack is in charge of routing decisions. In route-over routing scheme, the routing distinction is taken at the network layer and, in mesh-under, is taken by the adaptation layer. Thus, the goal of this research is to understand the performance of two routing schemes in 6LoWPAN under error-prone channel condition.

/pdf/modeling-and-performance-analysis-of-route-over-and-mesh-3jt1abterf.pdf

Modeling and Performance Analysis of Route-Over and Mesh-Under Routing Schemes in 6LoWPAN under Error-Prone Channel Condition

Recently, more and more wireless networks have been deployed and start provide varies services to customers. Such as smart-phones integrate heterogeneous wireless devices, it may cause unintended interactions between multiple radios using difference radio access technologies. Thus, heterogeneous wireless network will be the trend of future network. The Co-channel interference problem in heterogeneous wireless networks is more and more important. This paper focus on the coexistence problem between IEEE 802.11b/g/n and IEEE 802.15.4 protocols in the ISM 2.4 GHz band. The performance impact on IEEE 802.15.4 network under IEEE 802.11 wireless network has been analysis, and results show that IEEE 802.15.4 has serious collision problem if there has no appropriate scheduling mechanisms among two wireless protocols. A CIFS (Coexistence Inter-Frame Space) has been proposed in this paper to effectively enhance the IEEE 802.15.4 transmission probability which is implemented in IEEE 802.11 nodes to observe the transmission opportunity for IEEE 802.15.4 under wireless coexistence environment.

Hung-Shiou Chiang

Papers

A Lightweight Intrusion Detection Scheme Based on Energy Consumption Analysis in 6LowPAN

Modeling and Performance Analysis of Route-Over and Mesh-Under Routing Schemes in 6LoWPAN

Modeling and Performance Analysis of Route-Over and Mesh-Under Routing Schemes in 6LoWPAN under Error-Prone Channel Condition

Avoiding Collisions Between IEEE 802.11 and IEEE 802.15.4 Using Coexistence Inter-Frame Space