Ijraset Journal For Research in Applied Science and Engineering Technology
Authors: Vipul Tiwari, Harini S, Rakshith M
DOI Link: https://doi.org/10.22214/ijraset.2023.49383
Certificate: View Certificate
Integration of the internet into entities of the different domains of human society (such as smart homes, health care, smart grids, manufacturing processes, product supply chains, and environmental monitoring) is emerging as a new paradigm called the internet of things. However .the ubiquitous and wide range iot networks make them prone to cyber attacks. One of the main types of attack is a denial of service, where the attacker floods the network with the large volume of data to prevent nodes from using the services. An intrusion detection mechanism is considered a chief source of protection for information and communication technology. However, conventional intrusion detection methods need to be modified and improved for application to the iot owing to certain limitations, such as resource-constraints devices, the limited memory and battery capacity nodes, and specific protocol stacks.
I. INTRODUCTION
The concept of Internet of Things (IoT) is based on the integration of uniquely identiable heterogeneous physical objects around us (humans, animals, sensors, instant cameras, vehicles etc.) and the cyber world with the ability to transfer data over a network without requiring human-to-human or human-to-computer interfaces. As illustrated in Figure 1, the applications of the IoT may range from a simple appliance for a smart home to a complex apparatus in a smart grid.
A. Testbed For Power Systems
The IoT provides a tremendous opportunity for societies around the world. Even with different objectives, contrasting IoT applications have an intersection set of characteristics. Broadly speaking, a primary node in IoT has capability to perform three distinct actions; data collection, data transmission, and data processing and utilization the data collection stage, small, memory-constrained and low energy-consumption sensors with a short-range communications capability are employed to collect.
Considering that the development of IDSs for the IoT represents a significant challenge for information security, researchers describe Iot networks in terms of specific characteristics as follows:
The characteristics of Iot networks given above limit the design of IDS to an lightweight still efficient enough to secure the network from potential attacks. The term lightweight does not refer to simplicity of the system. It means that the IDS should be able to perform its operations with the available amount of resources in the sensor nodes of the network .Concluding, a lightweight system is the one which can perform in limited energy and computation resources regardless of simplicity .Keeping these definitions in mind,we design a light weight IDS system by avoiding the complex features extraction and feature selection steps. We provide rather uncomplicated and limited number of features to be extracted from raw data .The results show that, this type of system can perform efficiently in discriminating an intrusion in the IOT network.
The proposed scheme is intuitive to perform well in this type of application. However, there is no literature addressing the intrusions detection problem using such a foolproof algorithm. This leaves gap for proposing and analyzing such uncomplicated and intuitive algorithm for these applications rather than utilizing complex statically techniques.
There are many datasets available providing samples DoS attacks under different scenaries including KDD’99, DARPA .CAIDA DDoS, etc. The issue to us these datasets for evaluating our proposed algorithm lies in the attributes in which these datasets are available .the only characteristic of network traffic that is use in our algorithms is the packet arrival rate per node. However, this characteristic of the data is not given in any of the above given dataset. For instance, the dataset KDD’99 represent the data sample in attributes such as protocol type, duration of connection, land etc, but packet arrival rate. This limits our algorithms to be tested utilizing these online available datasets.
A. Motivation
The novelty of this manuscript lies in the design of an ID for IoT networks with the characteristics of lightweight i.e., minimizing cost of system in terms of energy consumption and computational resources. An Ideal IDS system is lightweight enough to be implemented in a sensor node equipped with limited battery capacity and computational resources, still performing efficiently. In this work, this is achieved by elim- inating the complex features extraction from data and the feature selection steps. Instead of taking different charac teristics the proposed IDS rely on only the packet arrival rate attribute of raw data. Moreover, the complexity of an SVM-based classifier directly depends on the dimensions of input vector. The higher the dimensions of input vector the higher the complexity of SVM. Keeping this in mind, we reduce the dimensions by extracting only 2 to 3 features from input vector. In short, we try to develop lightweight IDS by the following way. We are considering only one attribute, i.e., the packet transmission rate, and extract only 2 to 3 features from that attribute. The three features utilized include mean, median and maximum values obtained to perform the classification. Intuitively, these steps reduce the energy and computational cost as compared to a system considering up to 40 complex attributes, such as protocol type, service, land, wrong fragments etc. as given in NSL-KDD dataset. This approach makes the proposed IDS suitable for implementa- tion in sensor nodes of IoT while keeping the efficiency of system satisfactory as illustrated in the experimental results. Furthermore, several researchers have proved that an SVM-based classifier outperform neural networks, k-nearest neighbor, random forest etc. This is the motivation to design our proposed algorithm based on an SVM-based classifier. A performance comparison of SVM-based classifier and other machine learning-based algorithms can also be found in literature supporting this argument.
B. Contributions
Thus, to unlock the IoT potential, we need to improve IoT security and the performance of IDS. In this paper, we are motivated to consider intrusions (and corresponding anomaly-based IDS) accompanied by changes in traffic intensity. This effect is typical for a wide range of attacks in the IoT environment. The main contributions of this paper are as
II. ANALYSIS OF IOT THREATS
A. Typical Attacks In Iot And Concomitant Effect
Considering the specific characteristics of IoT networks, an adversary can launch attacks to disrupt the system in many ways. In this paper, we consider the typical attacks reported in the literature. Remark, there are several projects on, and standardization initiatives for, WSNs, which may eventually converge with the Internet of Things (IoT), for example European Union projects of Internet of Things Architecture (IoT-A) have been addressing the challenges of IoT solutions development from the WSNs perspective. A brief description of the typical attacks follows. A brief description of these attacks follows.
Also, it broadcasts its route to the base station. Other nodes may choose to route data through this new node if the path is shorter. If a malicious node equipped with a power transmitter sends a ‘‘Hello’’ message with attractive conditions, then a lot of nodes choose it for data transmission. However, the packets of these nodes will never be retransmitted. Therefore, the attack decreases general intensity.
Typical Iot attacks and concomitant effects
Thus, the typical attacks in the IoT are accompanied by changes in traffic intensity. As the result of some attacks, the intensity grows; in others, it declines. There are some cases where the same attack leads to traffic increasing in one location yet decreasing in another. In the preliminary stages of the attack, an intruder usually explores the network looking for vulnerabilities, which can be accompanied by an increase in traffic. The relationships of typical IoT attacks to traffic change are shown . The concomitant effect can be inherent in all components of the CIA triad.
DoS attacks, especially distributed DoS (DDoS) are serious problems in the IoT, which have been inherited from traditional IP networks. An efficient protection against these types of attack does not exist yet; for example, the biggest attack ever, recorded in 2016, left hundreds of thousands of connected devices infected [18]. In the IoT, the situation becomes worse due to the limited resources of IoT devices. In the preliminary stages of an attack, an intruder can generate some traffic to explore a network and identify system bottle- necks. Moreover, fundamentally new attacks on the IoT lead to traffic change, as well.
Thus, observations of traffic intensity can be used for IDS. To design an IDS for the IoT, the representative charac- teristics of low computing power, limited memory capacity, and constrained energy capacity in the nodes should be taken into account. In this paper, we investigate a foolproof and
Lightweight IDS based on an SVM. We show in a series of experiments that by extracting only two or three features from an input sample, the SVM can achieve satisfactory results detecting attacks against the network in a timely manner.
A. IOT Traffic Modeling
Generally, to analyze network behavior, a mathematical model of the traffic is used. Real traffic records are available in particular cases. The models are based on sim- plifying assumptions; however, some often provide a basis for adequate approximations of network behavior, as well as worthwhile insights. The scientific and engineering commu- nity has accepted the following fact: the Poisson process (i.e. exponentially distributed times between packet arrivals) is appropriate for traffic modeling in the IoT as well as in WSNs, which are considered an essential part of the IoT.
IV. DISCUSSION
The tradeoff for using only three features as opposed to ‘40 complex attributes’ is related to the issue of feature selection and reduction. The advantage of using only three features is as following:
First, the system processing time can be reduced due to low time consumption of single attribute acquisition from input data instead of multiple attributes.
Secondly, extracting just 2 or 3 features from that single attribute takes lower time as compared to extraction of up to 40 features from the multiple attributes.
Lastly, the complexity of SVM is also reduced because of utilizing a much lower number of dimensions (features) of input samples. Combining all these effects makes a big difference to the complexity of system. Furthermore, the feature selection step is omitted in the case of the proposed algorithm. These points can be considered as the positive effects of utilizing the proposed algorithm along with the proposed signal preprocessing model. Nevertheless, the feature selection and reduction techniques do not necessarily converge to global optimum, and sometimes end up selecting redundant features, which ultimately results in poor performance of classifier
Apparently, the main drawback of the proposed algorithm is that it lacks the ability to detect intrusions which do not have concomitant (increasing or decreasing) effect on the traffic intensity of node. The algorithms which consider the complex 40 features may be able to detect more sophisticated intrusions. This issue is reserved for future works.
In this paper, we have considered the packet arrival rate, which follow the Poisson distribution, of the traffic intensity to the node. The Poisson distribution is just used for performance evaluation. We use this distribution because it had been offered in papers of authoritative journals. It should be noted that, we do not use specific properties of CDF. Therefore, all expenses will be the same for any other traffic pattern followed in practice. However, the selected features such as mean, maximum and median, and the pro- posed detection scheme can be used irrespective of the type of distribution, given the condition that the intrusion or attack has an increasing or decreasing effect on the traffic intensity (packet arrival rate) to the node.
A. Why need to use Packet Arrival rate Attribute?
As we have explained in Section III, the types of intrusions or attacks considered in this paper are the ones which influence the traffic intensity. Either the data rate is decreased (e.g. in case of packets flooding attack, jamming attack etc.) or increased (e.g. black hole attack, wormhole attack) whenever any of these intrusions occur.
This means that if the IDS monitor the traffic intensity alone (or more specifically packet arrival rate measure), it may be able to detect these intrusions most of the time. This is our motivation of proposing an IDS which rely on packet arrival rate attribute exclusively to detect the intrusions. This claim is also supported by experimental results given in the paper.
B. Why Need to Extract min, Max and Median Features?
The packet arrival rate is the only attribute of data which is used for intrusion detection in the network. Now, the question is why needed to extract features from this attribute? Why not use this attribute to detect an intrusion using a threshold value? If the packet arrival rate goes higher than the threshold value, it can be considered as intrusion and vice versa. The answer to these questions can be given in a single argument; the threshold value selection is not an easy and reliable way. To find out a threshold for any system needs a continuous monitoring of the network for a long time to get an estimate of the threshold value. Selecting a sub-optimal value of threshold would result in higher miss-detection or false- alarm instances. Moreover, it is believed that the network conditions are not consistent all the times. The nodes may observe variations in packet arrival rate depending on the network conditions i.e., network may be very busy or idle. Therefore, the threshold selection method is not favored for detection and classification application. On the other hand, the machine learning algorithms try to learn the characteris tics of the network from a handful amount of historical data. At this point, we have two choices; either directly use the only attribute (packet arrival rate attribute value) as the single input, or extract features (minimum, maximum and median values) from this attribute to give input to machine learning- based classifier. In former case, using the single input to the classifier may degrade the performance of system because of two reasons. First, there may be a single value which is included in both classes i.e., intrusion and non-intrusion classes. For instance, depending on the network condition, a specific packet arrival rate may or may not be resulted due to the intrusion in the network. Secondly, if a single value of packet arrival rate attribute is used, the classifier needs to perform detection every time we get a new value. Ultimately, the energy consumption is increased due to the utilization of computational resources more frequently. In this paper, the minimum, maximum and median values are obtained from the packet arrival rate attribute over a window of time to solve both the problems. For instance, a packet of data is arrived every t seconds to the node. If this single value is used, then the classifier will perform the classification task every t seconds. On the contrary, if we use a time window T >> t, then the classifier has to perform classification every T seconds. This leads to reduce the frequency of utilizing computational resources as well as the algorithm converge better as compared to using the first case of utilizing a single attribute alone.
C. Why SVM?
The SVM is favored among other machine learning algorithms because of its efficient performance. The performance comparison among different machine learning algorithms given in the experimental results section confirms our claim. Furthermore, the light weightness of the proposed algorithm is proved in the experimental results as well.
D. How Do We Get Less Training And Testing Times?
The main reason that the proposed algorithm has the lowest training and testing time is that the other algorithms have additional feature selection properties. They try to select the best subset of features using complex optimization techniques. For instance, GA-SVM utilizes genetic algorithm to choose the best features among given set. Similarly, A-IDS and WFS-IDS algorithms analyze and select the best features using wrapper-based feature selection mechanism. A detailed explanation about these algorithms is out of scope of the current work; therefore, readers are suggested to refer these papers for more details. However, the major reason which reduces the computational time of the proposed algorithm is the elimination of the feature selection which is the part of training phase only. The testing phase has no feature selection step, and hence, the difference between the testing times of all these algorithms is very low as given . However, the small differences in training time are reported because of using different algorithms.
E. How do we Get Better Accuracy?
The complexity of the classifier has a direct effect of the complexity and size of input vectors. The simple and small vectors with high discrimination power among different classes are easy to classify by classifier. On the other hand, the higher number of the dimensions with complex relation among features of input vector increases the challenge of classification for classifier. In authors’ opinion, the input vector of only 2 dimensions with comparatively low complexity among features are the key factors which lead the classifier to obtain a highest accuracy of proposed IDS.There are a few control values used in the proposed algorithm. First, the kernel parameter used in the support vector machine. Changing this value may affect the performance of classifier. An optimized value can be obtained by hit and trial. Another value which should be selected carefully is the time window size. As shown in the experimental results, increase in time window size may improve the performance to some extent. Further increase in the time window size may degrade the performance of classifier. ???????
The IoT is a promising technology developed for applications ranging from small smart-home systems to large networks, such as smart grids. However, this vast network is exposed to different types of attacks, compromising its reliability. Furthermore, the limitations in the nodes, including memory, computational resources, and battery capacity, challenge net- work security. It is necessary to design a lightweight system that can efficiently improve the security of the IoT with the available resources. This paper focuses on designing lightweight IDS for anomaly detection in the IoT. A common type of attack, known as DDoS, is the target. The proposed IDS is focuses on two major issues; the attribute of the receiving data used to classify the signal and the machine learning based classifier. The only attributed considered in this paper is the packet arrival rate to the node. For classification purpose, an SVM- based classifier with input given in the form of two or three in complex features is utilized. Through a series of experiments, we prove that these two factors (the packet arrival rate attribute and an SVM-based classifier) can be enough to detect the intrusion in IoT network. Furthermore, we presented a comparative analysis of SVM-based classifier with other machine learning-based classifiers including NN, k-NN and DT to show the advantage of utilizing SVM in terms of accuracy over other techniques. For further proof, we also presented a comparison of pro- posed algorithm with other IDS proposed in literature. The results show that SVM-based IDS can perform satisfactorily in detection of attacks. Also, the lightweightness measure of proposed algorithm is proven in terms of CPU time execution. An investigation of various concomitant effects of attacks and increase in the scope of this IDS system to encompass other types of intrusions, where the effect of changing traffic intensity is not clearly pronounced or masked by intruders, is reserved for future works. Furthermore, concrete details of IDS implementation and intrusions mitigation are defined by application domains and strategy of security perimeter deployment. It is also a direction of our future work.
[1] B. B. Zarpelão, R. S. Miani, C. T. Kawakani, and S. C. de Alvarenga, ‘‘A survey of intrusion detection in Internet of Things,’’ J. Netw. Comput. Appl., Apr. 2017. [2] S. Sicari, A. Rizzardi, L. A. Grieco, and A. Coen-Porisini, ‘‘Security, privacy and trust in Internet of Things: The road ahead,’’ Comput. Netw., vol. 76, pp. 146–164, Jan. 2015. [3] D. Singh, G. Tripathi, and A. J. Jara, ‘‘A survey of Internet-of-Things: Future vision, architecture, challenges and services,’’ in Proc. IEEE World Internet Things (WF-IoT), Mar. 2014, pp. 287–292. [4] A. Meddeb, ‘‘Internet of Things standards: Who stands out from the crowd?’’ IEEE Commun. Mag., vol. 54, no. 7, pp. 40–47, Jul. 2016. [5] H. Sedjelmaci, S. M. Senouci, and T. Taleb, ‘‘An accurate security game for low-resource IoT devices,’’ IEEE Trans. Veh. Technol., vol. 66, no. 10, pp. 9381–9393, Oct. 2017. [6] Y. Fu, Z. Yan, J. Cao, and O. Koné, and X. Cao, ‘‘An automata based intru- sion detection method for internet of things,’’ Mobile Inf. Syst., vol. 2017, May 2017, Art. no. 1750637. [7] M. Roesch et al., ‘‘Snort—Lightweight Intrusion Detection for Networks,’’ in Proc. Lisa, vol. 99, 1999, pp. 229–238. [8] T. H. Hai, E.-N. Huh, and M. Jo, ‘‘A lightweight intrusion detection frame- work for wireless sensor networks,’’ Wireless Commun. Mobile Comput., vol. 10, no. 4, pp. 559–572, 2010. [9] Y. Maleh and A. Ezzati, ‘‘Lightweight intrusion detection scheme for wireless sensor networks,’’ IAENG Int. J. Comput. Sci., vol. 42, no. 4, pp. 347–354, 2015. [10] I. Sharafaldin, A. Gharib, A. H. Lashkari, and A. A. Ghorbani, ‘‘Towards a reliable intrusion detection benchmark dataset,’’ Softw. Netw., vol. 2017, no. 1, pp. 177–200, 2018. [11] KDD’99 Dataset. Accessed: Mar. 10, 2018. [Online]. Available: http://www.unb.ca/cic/datasets/index.html [12] S. U. Jan, V.-H. Vu, and I. Koo, ‘‘Throughput maximization using an SVM for multi-class hypothesis-based spectrum sensing in cognitive radio,’’ Appl. Sci., vol. 8, no. 3, p. 421, 2018. [13] S. U. Jan, Y. D. Lee, J. Shin, and I. Koo, ‘‘Sensor fault classification based on support vector machine and statistical time-domain features,’’ IEEE Access, vol. 5, pp. 8682–8690, May 2017. [14] P. T. Noi and M. Kappas, ‘‘Comparison of random forest, K-nearest neigh- bor, and support vector machine classifiers for land cover classification using sentinel-2 imagery,’’ Sensors, vol. 18, no. 1, p. 18, 2018. [15] J. Deogirikar and A. Vidhate, ‘‘Security attacks in IoT: A survey,’’ in Proc. IEEE Int. Conf. I-SMAC (IoT Social, Mobile, Analytics Cloud) (I-SMAC), Feb. 2017, pp. 32–37. [16] L. Atzori, A. Iera, and G. Morabito, ‘‘The Internet of Things: A survey,’’ [17] Comput. Netw., vol. 54, no. 15, pp. 2787–2805, Oct. 2010. [18] I. Tomi? and J. A. McCann, ‘‘A survey of potential security issues in existing wireless sensor network protocols,’’ IEEE Internet Things J., vol. 4, no. 6, pp. 1910–1923, Dec. 2017. [19] M. D. Donno, N. Dragoni, A. Giaretta, and A. Spognardi, ‘‘DDoS-capable IoT malwares: Comparative analysis and Mirai investigation,’’ Secur. Com- mun. Netw., vol. 2018, Feb. 2018, Art. no. 7178164. [20] V. Shakhov and I. Koo, ‘‘Depletion-of-battery attack: Specificity, mod- elling and analysis,’’ Sensors, vol. 18, no. 6, p. 1849, 2018. [21] F. Farahnakian and J. Heikkonen, ‘‘A deep auto-encoder based approach for intrusion detection system,’’ in Proc. IEEE 20th Int. Conf. Adv. Commun. Technol. (ICACT), Feb. 2018, pp. 178–183. [22] S.-M. Lee, B.-D. Jeong, and S.-B. Suh, ‘‘Method of intrusion detection in terminal device and intrusion detecting apparatus,’’ U.S. Patent 8 701 188, Apr. 15, 2014. [23] J.-P. Ramirez-Paredes, E. A. Doucette, J. W. Curtis, and V. Ayala-Ramirez, ‘‘Sensor compromise detection in multiple-target tracking systems,’’ Sen- sors, vol. 18, no. 2, p. 638, 2018.
Copyright © 2023 Vipul Tiwari, Harini S, Rakshith M. This is an open access article distributed under the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.
Paper Id : IJRASET49383
Publish Date : 2023-03-03
ISSN : 2321-9653
Publisher Name : IJRASET
DOI Link : Click Here