Deep learning and big data technologies for IoT security

Distributed Denial of Service (DDoS) attacks are one of the most harmful threats in today’s Internet, disrupting the availability of essential services. The challenge of DDoS detection is the combination of attack approaches coupled with the volume of live traffic to be analysed. In this paper, we present a practical, lightweight deep learning DDoS detection system called Lucid, which exploits the properties of Convolutional Neural Networks (CNNs) to classify traffic flows as either malicious or benign. We make four main contributions; (1) an innovative application of a CNN to detect DDoS traffic with low processing overhead, (2) a dataset-agnostic preprocessing mechanism to produce traffic observations for online attack detection, (3) an activation analysis to explain Lucid’s DDoS classification, and (4) an empirical validation of the solution on a resource-constrained hardware platform. Using the latest datasets, Lucid matches existing state-of-the-art detection accuracy whilst presenting a 40x reduction in processing time, as compared to the state-of-the-art. With our evaluation results, we prove that the proposed approach is suitable for effective DDoS detection in resource-constrained operational environments.

/pdf/lucid-a-practical-lightweight-deep-learning-solution-for-2wl46phf2o.pdf

Lucid: A Practical, Lightweight Deep Learning Solution for DDoS Attack Detection

The Internet of Things (IoT) has lately developed into an innovation for developing smart environments. Security and privacy are viewed as main problems in any technology’s dependence on the IoT model. Privacy and security issues arise due to the different possible attacks caused by intruders. Thus, there is an essential need to develop an intrusion detection system for attack and anomaly identification in the IoT system. In this work, we have proposed a deep learning-based method Deep Belief Network (DBN) algorithm model for the intrusion detection system. Regarding the attacks and anomaly detection, the CICIDS 2017 dataset is utilized for the performance analysis of the present IDS model. The proposed method produced better results in all the parameters in relation to accuracy, recall, precision, F1-score, and detection rate. The proposed method has achieved 99.37% accuracy for normal class, 97.93% for Botnet class, 97.71% for Brute Force class, 96.67% for Dos/DDoS class, 96.37% for Infiltration class, 97.71% for Ports can class and 98.37% for Web attack, and these results were compared with various classifiers as shown in the results.

Effective Attack Detection in Internet of Medical Things Smart Environment Using a Deep Belief Neural Network

Internet-of-Things (IoT) devices are getting more and more popular in recent years and IoT networks play an important role in the industry as well as people’s activities. On the one hand, they bring convenience to every aspect of our daily life; on the other hand, they are vulnerable to various attacks that in turn cancels out their benefits to a certain degree. In this article, we target the defense techniques against IoT Distributed Denial-of-Service (DDoS) attacks and propose an edge-centric IoT defense scheme termed FlowGuard for the detection, identification, classification, and mitigation of IoT DDoS attacks. We present a new DDoS attack detection algorithm based on traffic variations and design two machine learning models for DDoS identification and classification. To demonstrate the effectiveness of the two machine learning models, we generate a large data set by DDoS simulators BoNeSi and SlowHTTPTest, and combine it with the CICDDoS2019 data set, to test the identification and classification accuracy as well as the model efficiency. Our results indicate that the identification accuracy of the proposed long short-term memory is as high as 98.9%, which significantly outperforms the other four well-known learning models mentioned in the most related work. The classification accuracy of the proposed convolutional neural network is up to 99.9%. Besides, our models satisfactorily meet the delay requirements of IoT when deployed in edge servers with computational powers higher than a personal computer.

FlowGuard: An Intelligent Edge Defense Mechanism Against IoT DDoS Attacks

The Internet of Underwater Things (IoUT) is an emerging communication ecosystem developed for connecting underwater objects in maritime and underwater environments. The IoUT technology is intricately linked with intelligent boats and ships, smart shores and oceans, automatic marine transportations, positioning and navigation, underwater exploration, disaster prediction and prevention, as well as with intelligent monitoring and security. The IoUT has an influence at various scales ranging from a small scientific observatory, to a mid-sized harbor, and to covering global oceanic trade. The network architecture of IoUT is intrinsically heterogeneous and should be sufficiently resilient to operate in harsh environments. This creates major challenges in terms of underwater communications, whilst relying on limited energy resources. Additionally, the volume, velocity, and variety of data produced by sensors, hydrophones, and cameras in IoUT is enormous, giving rise to the concept of Big Marine Data (BMD), which has its own processing challenges. Hence, conventional data processing techniques will falter, and bespoke Machine Learning (ML) solutions have to be employed for automatically learning the specific BMD behavior and features facilitating knowledge extraction and decision support. The motivation of this article is to comprehensively survey the IoUT, BMD, and their synthesis. It also aims for exploring the nexus of BMD with ML. We set out from underwater data collection and then discuss the family of IoUT data communication techniques with an emphasis on the state-of-the-art research challenges. We then review the suite of ML solutions suitable for BMD handling and analytics. We treat the subject deductively from an educational perspective, critically appraising the material surveyed. Accordingly, the reader will become familiar with the pivotal issues of IoUT and BMD processing, whilst gaining an insight into the state-of-the-art applications, tools, and techniques. Finally, we analyze the architectural challenges of the IoUT, followed by proposing a range of promising direction for research and innovation in the broad areas of IoUT and BMD. Our hope is to inspire researchers, engineers, data scientists, and governmental bodies to further progress the field, to develop new tools and techniques, as well as to make informed decisions and set regulations related to the maritime and underwater environments around the world.

/pdf/internet-of-underwater-things-and-big-marine-data-analytics-19j7i05tj5.pdf

Internet of Underwater Things and Big Marine Data Analytics—A Comprehensive Survey

In this paper we propose deep learning models for the cyber security in IoT (Internet of Things) networks. IoT network is as a promising technology which connects the living and non-living things around the world. The implementation of IoT is growing fast but the cyber security is still a loophole, so it is susceptible to many cyber-attack and for the success of any network it most important that the network is completely secure, otherwise people could be reluctant to use this technology. DDoS (Distributed Denial of Service) attack has affected many IoT networks in recent past that has resulted in huge losses. We have proposed deep learning models and evaluated those using latest CICIDS2017 datasets for DDoS attack detection which has provided highest accuracy as 97.16% also proposed models are compared with machine learning algorithms. This paper also identifies open research challenges for usage of deep learning algorithm for IoT cyber security.

Deep Learning Models for Cyber Security in IoT Networks

In this paper, we present an Intrusion Detection System (IDS) using the hybridization of the deep learning technique and the multi-objective optimization method for the detection of Distributed Denial of Service (DDoS) attacks in the Internet of Things (IoT) networks is proposed in this paper. IoT networks consist of different devices with unique hardware and software configurations communicating over different communication protocols, which produce huge multidimensional data that make IoT networks susceptible to cyber-attacks. In a network the IDS is a vital tool for securing it from cyber-attacks. Detection of new emerging cyber threats are becoming difficult for existing IDS, and therefore advanced IDS is required. A DDoS attack is a cyber-attack that has posed substantial devastating losses in IoT networks recently. In this paper, we propose an IDS founded on the fusion of a Jumping Gene adapted NSGA-II multi-objective optimization method for data dimension reduction and the Convolutional Neural Network (CNN) integrating Long Short-Term Memory (LSTM) deep learning techniques for classifying the attack. The experimentation is conducted using a High-Performance Computer (HPC) on the latest CISIDS2017 datasets on DDoS attacks and achieved an accuracy of 99.03% with a 5-fold reduction in training time. We evaluated our proposed method by comparing it with other state-of-the-art algorithms and machine learning algorithms, which confirms that the proposed method surpasses other approaches.

An Intrusion Detection System Against DDoS Attacks in IoT Networks

In this study, the authors propose a multi-objective optimisation-based feature selection (FS) method for the detection of distributed denial of service (DDoS) attacks in an internet of things (IoT) network. An intrusion detection system (IDS) is one approach for the detection of cyber-attacks. FS is required to reduce the dimensionality of data and improve the performance of the IDS. One of the reasons for the failure of an IDS is incorrect selection of features because most of the FS methods are based on a limited number of objectives such as accuracy or relevance of data, but these are not enough as they can be misleading for attack detection the contribution of this work is to develop appropriate FS method. They have implemented the nondominated sorting algorithm with its adapted jumping gene operator to solve the optimisation problem and exploited an extreme learning machine as the classifier for FS based on six important objectives for an IoT network. Experimental results verify that the proposed method performs well for FS and have achieved 99.9% and has reduced the total number of features by nearly 90%. The proposed method outperforms other proposed FS methods for the detection of DDoS attacks by an IDS.

https://ietresearch.onlinelibrary.wiley.com/doi/epdf/10.1049/iet-net.2018.5206

Multi-objective-based feature selection for DDoS attack detection in IoT networks

Law enforcement agencies (LEAs) globally are facing high demand to view, process, and analyse digital evidence. Arrests for Indecent Images of Children (IIOC) have risen by a factor of 25 over the previous decade. A case typically requires the use of computing resources for between 2-4 weeks. The lengthy time is due to the sequential ordering of acquiring a forensically sound copy of all data, systematically extracting all images, before finally analysing each to automatically identify instances of known IIOC images (second-generation) or manually identifying new images (first-generation). It is therefore normal practice that an understanding of the image content is only obtained right at the end of the investigative process. A reduction in processing time would have a transformative impact, by enabling timely identification of victims, swift intervention with perpetrators to prevent re-offending, and reducing the traumatic psychological effects of any ongoing investigation for the accused and their families.

In this paper, a new approach to the digital forensic processes containing suspected IIOC content is presented, whereby in-process metrics are used to prioritise case handling, ensuring cases with a high probability of containing IIOC content are prioritised. The use of automated planning (AP) enables a systematic approach to case priorisation. In this paper, a planning approach is presented where AP is used to generate investigative actions in 60-minute segments, before re-planning to account for discoveries made during the execution of planned actions. A case study is provided consisting of 5 benchmark cases, demonstrating on average a reduction of 36% in processing time and a 26% reduction in time required to discover IIOC content.

/pdf/automated-planning-to-prioritise-digital-forensics-3chlltnc.pdf

Monika Roopak

Papers

Deep Learning Models for Cyber Security in IoT Networks

An Intrusion Detection System Against DDoS Attacks in IoT Networks

Multi-objective-based feature selection for DDoS attack detection in IoT networks

Automated Planning to Prioritise Digital Forensics Investigation Cases Containing Indecent Images of Children