Anomaly Behavior Analysis for IoT Network Nodes

Cornell University - arXiv, 2022

The Internet of Things (IoT) is a system that connects physical computing devices, sensors, software, and other technologies. Data can be collected, transferred, and exchanged with other devices over the network without requiring human interactions. One challenge the development of IoT faces is the existence of anomaly data in the network. Therefore, research on anomaly detection in the IoT environment has become popular and necessary in recent years. This survey provides an overview to understand the current progress of the different anomaly detection algorithms and how they can be applied in the context of the Internet of Things. In this survey, we categorize the widely used anomaly detection machine learning and deep learning techniques in IoT into three types: clustering-based, classification-based, and deep learningbased. For each category, we introduce some state-of-the-art anomaly detection methods and evaluate the advantages and limitations of each technique.

International Journal of Engineering & Technology, 2018

Conventional intrusion detection mechanisms face serious limitations in identifying heterogeneous and distributed type of intrusions over the IoT environment. This is due to inadequate resources and open deployment environment of IoT. Accordingly, ensuring data security and privacy are tough challenges in the practical context. This manuscript discusses various aspects of networking security and related challenges along with the concepts of system architecture. Further, endeavored to define a machine learning model that outlines two heuristics called Intrusion Scope Heuristic ( ), and benign scope heuristic ( ), which further uses in predictive analysis to identify the IOT network transaction is prone to intrusion or benign. The experimental study revealed the significance of the proposal with maximal detection accuracy, and minimal miss rate.

IEEE Access

The Internet of Things (IoT) represents a mean to share resources (memory, storage computational power, data, etc.) between computers and mobile devices, as well as buildings, wearable devices, electrical grids, and automobiles, just to name few. The IoT is leading to the development of advanced information services that will require large storage and computational power, as well as real-time processing capabilities. The integration of IoT with emerging technologies such as Fog Computing can complement these requirements with pervasive and cost-effective services capable of processing largescale geo-distributed information. In any IoT application, communication availability is essential to deliver accurate and useful information, for instance, to take actions during dangerous situations, or to manage critical infrastructures. IoT components like gateways, also called Fog Nodes, face outstanding security challenges as the attack surface grows with the number of connected devices requesting communication services. These Fog nodes can be targeted by an attacker, preventing the nodes from delivering important information to the final users or to perform accurate automated actions. This paper introduces an Anomaly Behavior Analysis Methodology based on Artificial Neural Networks, to implement an adaptive Intrusion Detection System (IDS) capable of detecting when a Fog node has been compromised, and then take the required actions to ensure communication availability. The experimental results reveal that the proposed approach has the capability for characterizing the normal behavior of Fog Nodes despite its complexity due to the adaptive scheme, and also has the capability of detecting anomalies due to any kind of sources such as misuses, cyber-attacks or system glitches, with high detection rate and low false alarms. INDEX TERMS Anomaly behavior, cyber security, fog computing, IoT, neural networks.

Journal of Sensor and Actuator Networks, 2023

Botnet attacks, such as DDoS, are one of the most common types of attacks in IoT networks. A botnet is a collection of cooperated computing machines or Internet of Things gadgets that criminal users manage remotely. Several strategies have been developed to reduce anomalies in IoT networks, such as DDoS. To increase the accuracy of the anomaly mitigation system and lower the false positive rate (FPR), some schemes use statistical or machine learning methodologies in the anomaly-based intrusion detection system (IDS) to mitigate an attack. Despite the proposed anomaly mitigation techniques, the mitigation of DDoS attacks in IoT networks remains a concern. Because of the similarity between DDoS and normal network flows, leading to problems such as a high FPR, low accuracy, and a low detection rate, the majority of anomaly mitigation methods fail. Furthermore, the limited resources in IoT devices make it difficult to implement anomaly mitigation techniques. In this paper, an efficient anomaly mitigation system has been developed for the IoT network through the design and implementation of a DDoS attack detection system that uses a statistical method that combines three algorithms: exponentially weighted moving average (EWMA), K-nearest neighbors (KNN), and the cumulative sum algorithm (CUSUM). The integration of fog computing with the Internet of Things has created an effective framework for implementing an anomaly mitigation strategy to address security issues such as botnet threats. The proposed module was evaluated using the Bot-IoT dataset. From the results, we conclude that our model has achieved a high accuracy (99.00%) with a low false positive rate (FPR). We have also achieved good results in distinguishing between IoT and non-IoT devices, which will help networking teams make the distinction as well.

2015 IEEE International Conference on Communication Workshop (ICCW), 2015

Internet of Things (IoT) concept provides a number of opportunities to improve our daily lives while also creating a potential risk of increasing the vulnerability of personal information to security and privacy breaches. Data collected from IoT is usually offloaded to the Cloud which may further leave data prone to a variety of attacks if security and privacy issues are not handled properly. Anomaly detection has been one of the widely adopted security measures in wired and wireless networks. However, it is not straight forward to apply most of the anomaly detection techniques to IoT and cloud. One of the main challenges is deriving outlier features from the vast volume of data pumped from IoT to the cloud. Other challenges include the large number of sources generating data, heterogenous connectivity and traffic patterns of IoT devices, cloud services being offered at geographically remote places and causing IoT data to be stored in different countries with different legislations. This paper, for the first time, presents the challenges and opportunities in anomaly detection for IoT and cloud. It first introduces the prominent features and application fields of IoT and Cloud, then discusses security and privacy risks to personal information and finally focuses on solutions from anomaly detection perspective.

Dr.Anil Lamba, 2017

Data Analytics is by far the component with more added value in Internet of Things (IoT) networks. One aspect of data analytics is anomaly detection within data points received in some cases in real time that help to conduct predictive maintenance, weather monitoring or cyber security forensics for instance. Although there exists a number of web dashboards that allow IoT users to visualize data in time domain and perform statistical analysis, anomaly detection is often absent else if present not that straightforward, reliable and accurate. The development and implementation of Anomaly Detection Engine (ADE) poses a number of challenges that are in fact addressed in this paper. The research work exposes the multifaceted aspect of IoT networks and applications based on real life use cases and the difficulties engendered in mounting an ADE from both software system engineering and network convergence perspectives. Moreover a comparative description of diverse time series models adopted in anomaly detection is undertaken. It was noticed that there is neither one size fit all solution nor a plug n play alternative and that the unsupervised mode in machine learning as a model for time series analysis is the most versatile and efficient technique for IoT analytics developers.

Taylor & Francis Group, London, 2025

The rapid expansion of Internet of Things (IoT) devices introduced critical security issues, especially intrusions that target vulnerabilities in IoT devices and systems. This paper analyses IoT intrusions and problems, focusing on advanced detection, prevention, and response methods and identifying the most common threats and attack and their possible result. This paper explores detection techniques, such as machine learning anomaly detection systems, and finds their significance in determining security violations. Device firmware updates, its data encryption, and network segmentation can be used for prevention and robust techniques. Also, we discuss the mechanisms for quick and sufficient response plans and threat intelligence sharing. This provides practical solutions and makes good use of data protection of users data and security measures through literature surveys and case studies. Our analysis finds the need for a protection approach to safeguard IoT ecosystems, providing valuable insights for researchers and industry experts to improve IoT security frameworks.

IEEE, 2019

In recent years, the wide adoption of the modern Internet of Things (IoT) paradigm has led to the invention of smart cities. Smart cities operate in real-world time to promote ease and quality of life in urban cities. The network traffic of a smart city via IoT systems is growing exponentially and introducing new cybersecurity challenges since these IoT devices are being connected to sensors that are directly connected to massive cloud servers. In order to mitigate these cyberattacks, the developers need to enhance new techniques for detecting infected IoT devices. In this paper, to address the IoT cybersecurity threats in a smart city, we propose an Anomaly Detection-IoT (AD-IoT) system, which is an intelligent anomaly detection based on Random Forest machine learning algorithm. The proposed solution can effectively detect compromised IoT devices at distributed fog nodes. To evaluate our model, we utilized modern dataset to illustrate the model's accuracy. Our findings show that the AD-IoT can effectively achieve highest classification accuracy of 99.34% with lowest false positive rate.

ieee international conference on cloud computing technology and science, 2021

The growing use of the Internet of Things (IoT) in different areas implies a proportional growth in threats and attacks on end devices. To solve this problem, the IoT systems must be equipped with an anomaly detection system (ADS). This work introduces the design of a hybrid ADS based on the Software-Defined Network (SDN) architecture, which combines the rule-based and Machine Learning-based detection technique. Whereas the rule-based approach is used to detect known attacks with the help of rules defined by security experts. And the Machine Learning approach is used to detect unknown attacks with the help of Artificial Intelligence techniques.

International Journal of Computer Science and Mobile Computing, 2020

For quite a few years now the name Internet of Things (IoT) has been around. IoT is a technology capable of revolutionizing our way of life, in sectors ranging from transportation to health, from entertainment to our interactions with government. Even this great opportunity presents a number of critical obstacles. As we strive to develop policies, regulations, and governance that form this development without stifling creativity, the increase in the number of devices and the frequency of that increase presents problems to our security and freedom. This work attentions on the security aspect of IoT networks by examining the serviceability of machine learning algorithms in detecting anomalies that are contained within such network data. It discusses (Machine Learning (ML) algorithms which are used effectively in relatively similar situations and compares them using several parameters and methods. The following algorithms are implemented in this work: Random Forest (RF), Naive Bayes (NB), Support Vector Machine (SVM), and Decision tree Algorithm. The Random Forest algorithm obtained the best results, with an accuracy of 99.5 per cent.