A two-stage intrusion detection approach for software-defined IoT networks

A Lightweight Intelligent Network Intrusion Detection System Using One-Class Autoencoder and Ensemble Learning for IoT

Network intrusion detection technology is key to cybersecurity regarding the Internet of Things (IoT). The traditional intrusion detection system targeting Binary or Multi-Classification can detect known attacks, but it is difficult to resist unknown attacks (such as zero-day attacks). Unknown attacks require security experts to confirm and retrain the model, but new models do not keep up to date. This paper proposes a Lightweight Intelligent NIDS using a One-Class Bidirectional GRU Autoencoder and Ensemble Learning. It can not only accurately identify normal and abnormal data, but also identify unknown attacks as the type most similar to known attacks. First, a One-Class Classification model based on a Bidirectional GRU Autoencoder is introduced. This model is trained with normal data, and has high prediction accuracy in the case of abnormal data and unknown attack data. Second, a multi-classification recognition method based on ensemble learning is proposed. It uses Soft Voting to evaluate the results of various base classifiers, and identify unknown attacks (novelty data) as the type most similar to known attacks, so that exception classification becomes more accurate. Experiments are conducted on WSN-DS, UNSW-NB15, and KDD CUP99 datasets, and the recognition rates of the proposed models in the three datasets are raised to 97.91%, 98.92%, and 98.23% respectively. The results verify the feasibility, efficiency, and portability of the algorithm proposed in the paper.

Deep Learning Approach for SDN-Enabled Intrusion Detection System in IoT Networks

Owing to the prevalence of the Internet of things (IoT) devices connected to the Internet, the number of IoT-based attacks has been growing yearly. The existing solutions may not effectively mitigate IoT attacks. In particular, the advanced network-based attack detection solutions using traditional Intrusion detection systems are challenging when the network environment supports traditional as well as IoT protocols and uses a centralized network architecture such as a software defined network (SDN). In this paper, we propose a long short-term memory (LSTM) based approach to detect network attacks using SDN supported intrusion detection system in IoT networks. We present an extensive performance evaluation of the machine learning (ML) and deep learning (DL) model in two SDNIoT-focused datasets. We also propose an LSTM-based architecture for the effective multiclass classification of network attacks in IoT networks. Our evaluation of the proposed model shows that our model effectively identifies the attacks and classifies the attack types with an accuracy of 0.971. In addition, various visualization methods are shown to understand the dataset’s characteristics and visualize the embedding features.