A Comprehensive Security Framework for Asymmetrical IoT Network Environments to Monitor and Classify Cyberattack via Machine Learning
Abstract
:1. Introduction
- A PCA technique is used to reduce the dimensionality of data without compromising the information content. Therefore, the reduced IoT data are sent to the cloud for monitoring and visualizing the IoT traffic.
- The inverse PCA is computed to retransform the PCA components to approximate the original data for visualizing the IoT traffic.
- The framework offers an NIDS to detect and classify cyberattacks, which is responsible for sending notifications with the attack type to the cloud in the event of an attack.
- Comparing the performance of NIDS implemented based on various ML models, which are Long Short-Term Memory, Gated Recurrent Unit (GRU), 1D Convolutional Neural Networks (1D-CNN), Feedforward Neural Network (FFNN), Decision Tree (DT), and Random Forest (RF).
2. Literature Review
3. Methodology
3.1. The Proposed Framework Architecture
3.2. IoT Dataset
3.3. Principal Component Analysis
- The principal components (PCs) are uncorrelated.
- The first PC captures the highest variance in the data, followed by the second PC, and so on. All the PCs’ combined variance equals the original variables’ total variance. .
- The PCs are arranged in descending order based on their corresponding eigenvalues, denoted as 0.
3.4. Monitoring of IoT Traffic Algorithms
Algorithm 1: PCA Transformation | |
Input: | |
1: | Load OriginalData.csv, |
2: | data = Read(“OriginalData.csv”), |
3: | numComponents = 20 |
Output: | |
4: | The PCA components data, |
5: | pcaVariance, |
6: | scaler |
Procedure: | |
7: | scaler = StandardScaler() |
8: | normalizedFeatures = scaler.fit_transform(data) |
9: | pcaVariance = PCA(numComponents) |
10: | reducedFeatures = pcaVariance.fit_transform(normalizedFeatures) |
11: | Save reducedFeatures to “PCA_Data.csv” |
12: | Save the pcaVariance and the scaler variables |
End Algorithm |
Algorithm 2: PCA to Original | |
Input: | |
1: | Load PCA_Data.csv, |
2: | data = Read(“PCA_Data.csv”), |
3: | Load pca, |
4: | Load scaler, |
Output: | |
5: | Approximating the orignal data |
Procedure: | |
6: | approxNormalizedFeatures = pca.inverse_transform(data) |
7: | approxOriginalFeatures = scaler.inverse_transform(approxNormalizedFeatures) |
8: | Save approxOriginalFeatures to “approximateOriginalDataset.csv” |
End Algorithm |
Algorithm 3: Send to ThingSpeak | |
Input: | |
1: | Load approximateOriginalDataset.csv, |
2: | data = read (“approximateOriginalDataset.csv”), |
3: | Set channelID, |
4: | Set writeAPIKey, |
5: | Set numRows, |
6: | Set seconds |
Output: | |
7: | Sending data to ThingSpeak |
Procedure: | |
8: | For each iteration (i = 1 to numRows) |
9: | field1 = data.Flow_duration(i) |
10: | field2 = data.Header_Length(i) |
11: | field3 = data.ProtocolType(i) |
12: | ………. |
13: | field46 = data.Weight(i) |
14: | response =thingSpeakWrite(channelID,‘Fields’,[1,…,46],‘Values’, |
15: | [field1,…,field46, ‘WriteKey’, writeAPIKey) |
16: | |
17: | pause(seconds) |
18: | End for |
End Algorithm |
4. Results and Discussion
4.1. Stage 1: Evaluating PCA and Inverse PCA Transformation
4.2. Stage 2: Evaluation of NIDS
4.3. ThingSpeak Dashboard
5. Conclusions
Author Contributions
Funding
Data Availability Statement
Conflicts of Interest
References
- Djenna, A.; Harous, S.; Saidouni, D.E. Internet of Things Meet Internet of Threats: New Concern Cyber Security Issues of Critical Cyber Infrastructure. Appl. Sci. 2021, 11, 4580. [Google Scholar] [CrossRef]
- Sisinni, E.; Saifullah, A.; Han, S.; Jennehag, U.; Gidlund, M. Industrial Internet of Things: Challenges, Opportunities, and Directions. IEEE Trans. Ind. Inf. 2018, 14, 4724–4734. [Google Scholar] [CrossRef]
- Lionel Sujay Vailshery Number of Internet of Things (IoT) Connections Worldwide from 2022 to 2023, with Forecasts from 2024 to 2033. Available online: https://www.statista.com/statistics/1183457/iot-connected-devices-worldwide/ (accessed on 27 July 2024).
- Lu, Y.; Xu, L. Da Internet of Things (IoT) Cybersecurity Research: A Review of Current Research Topics. IEEE Internet Things J. 2019, 6, 2103–2115. [Google Scholar] [CrossRef]
- Kumari, P.; Jain, A.K. A Comprehensive Study of DDoS Attacks over IoT Network and Their Countermeasures. Comput. Secur. 2023, 127, 103096. [Google Scholar] [CrossRef]
- Alam, T. Design a Blockchain-Based Middleware Layer in the Internet of Things Architecture. JOIV Int. J. Inform. Vis. 2020, 4, 28–31. [Google Scholar] [CrossRef]
- Khan, A.R.; Kashif, M.; Jhaveri, R.H.; Raut, R.; Saba, T.; Bahaj, S.A. Deep Learning for Intrusion Detection and Security of Internet of Things (IoT): Current Analysis, Challenges, and Possible Solutions. Secur. Commun. Netw. 2022, 2022, 4016073. [Google Scholar] [CrossRef]
- Ullah, I.; Mahmoud, Q.H. Design and Development of RNN Anomaly Detection Model for IoT Networks. IEEE Access 2022, 10, 62722–62750. [Google Scholar] [CrossRef]
- Vermesan, O.; Friess, P.; Guillemin, P.; Gusmeroli, S.; Sundmaeker, H.; Bassi, A.; Jubert, I.S.; Mazura, M.; Harrison, M.; Eisenhauer, M.; et al. Internet of Things Strategic Research Roadmap. In Internet of Things—Global Technological and Societal Trends from Smart Environments and Spaces to Green Ict; River Publishers: Aalborg, Denmark, 2011. [Google Scholar]
- Bajpai, S.; Sharma, K.; Chaurasia, B.K. Intrusion Detection Framework in IoT Networks. SN Comput. Sci. 2023, 4, 350. [Google Scholar] [CrossRef]
- Panahi Rizi, M.H.; Hosseini Seno, S.A. A Systematic Review of Technologies and Solutions to Improve Security and Privacy Protection of Citizens in the Smart City. Internet Things 2022, 20, 100584. [Google Scholar] [CrossRef]
- Javadpour, A.; Pinto, P.; Ja’fari, F.; Zhang, W. DMAIDPS: A Distributed Multi-Agent Intrusion Detection and Prevention System for Cloud IoT Environments. Clust. Comput. 2023, 26, 367–384. [Google Scholar] [CrossRef]
- Khraisat, A.; Alazab, A. A Critical Review of Intrusion Detection Systems in the Internet of Things: Techniques, Deployment Strategy, Validation Strategy, Attacks, Public Datasets and Challenges. Cybersecurity 2021, 4, 18. [Google Scholar] [CrossRef]
- Nisar, A. Intrusion Detection Systems: Categories, Attack Detection and Response. SSRN Electron. J. 2023. [Google Scholar] [CrossRef]
- Yadav, N.; Pande, S.; Khamparia, A.; Gupta, D. Intrusion Detection System on IoT with 5G Network Using Deep Learning. Wirel Commun. Mob. Comput. 2022, 2022, 9304689. [Google Scholar] [CrossRef]
- Lone, A.N.; Mustajab, S.; Alam, M. A Comprehensive Study on Cybersecurity Challenges and Opportunities in the IoT World. Secur. Priv. 2023, 6, e318. [Google Scholar] [CrossRef]
- Karie, N.M.; Sahri, N.M.; Yang, W.; Valli, C.; Kebande, V.R. A Review of Security Standards and Frameworks for IoT-Based Smart Environments. IEEE Access 2021, 9, 121975–121995. [Google Scholar] [CrossRef]
- Husnain, M.; Hayat, K.; Cambiaso, E.; Fayyaz, U.U.; Mongelli, M.; Akram, H.; Ghazanfar Abbas, S.; Shah, G.A. Preventing MQTT Vulnerabilities Using IoT-Enabled Intrusion Detection System. Sensors 2022, 22, 567. [Google Scholar] [CrossRef]
- Zheng, Y.; Li, Z.; Xu, X.; Zhao, Q. Dynamic Defenses in Cyber Security: Techniques, Methods and Challenges. Digit. Commun. Netw. 2022, 8, 422–435. [Google Scholar] [CrossRef]
- Bai, L.; Hsu, C.; Harn, L.; Cui, J.; Zhao, Z. A Practical Lightweight Anonymous Authentication and Key Establishment Scheme for Resource-Asymmetric Smart Environments. IEEE Trans. Dependable Secur. Comput. 2023, 20, 3535–3545. [Google Scholar] [CrossRef]
- Saba, T.; Rehman, A.; Sadad, T.; Kolivand, H.; Bahaj, S.A. Anomaly-Based Intrusion Detection System for IoT Networks through Deep Learning Model. Comput. Electr. Eng. 2022, 99, 107810. [Google Scholar] [CrossRef]
- Nickolaos Koroniotis, N.M. The Bot-IoT Dataset. Available online: https://research.unsw.edu.au/projects/bot-iot-dataset (accessed on 27 July 2024).
- Sampada Bhosale Network Intrusion Detection. Available online: https://www.kaggle.com/datasets/sampadab17/network-intrusion-detection (accessed on 27 July 2024).
- Asgharzadeh, H.; Ghaffari, A.; Masdari, M.; Soleimanian Gharehchopogh, F. Anomaly-Based Intrusion Detection System in the Internet of Things Using a Convolutional Neural Network and Multi-Objective Enhanced Capuchin Search Algorithm. J. Parallel. Distrib. Comput. 2023, 175, 1–21. [Google Scholar] [CrossRef]
- Kasongo, S.M. A Deep Learning Technique for Intrusion Detection System Using a Recurrent Neural Networks Based Framework. Comput. Commun. 2023, 199, 113–125. [Google Scholar] [CrossRef]
- Latif, S.; Huma, Z.E.; Jamal, S.S.; Ahmed, F.; Ahmad, J.; Zahid, A.; Dashtipour, K.; Aftab, M.U.; Ahmad, M.; Abbasi, Q.H. Intrusion Detection Framework for the Internet of Things Using a Dense Random Neural Network. IEEE Trans. Ind. Inf. 2022, 18, 6435–6444. [Google Scholar] [CrossRef]
- Dina, A.S.; Siddique, A.B.; Manivannan, D. A Deep Learning Approach for Intrusion Detection in Internet of Things Using Focal Loss Function. Internet Things 2023, 22, 100699. [Google Scholar] [CrossRef]
- Thakkar, A.; Lohiya, R. Attack Classification of Imbalanced Intrusion Data for IoT Network Using Ensemble-Learning-Based Deep Neural Network. IEEE Internet Things J. 2023, 10, 11888–11895. [Google Scholar] [CrossRef]
- Altunay, H.C.; Albayrak, Z. A Hybrid CNN+LSTM-Based Intrusion Detection System for Industrial IoT Networks. Eng. Sci. Technol. Int. J. 2023, 38, 101322. [Google Scholar] [CrossRef]
- Awajan, A. A Novel Deep Learning-Based Intrusion Detection System for IoT Networks. Computers 2023, 12, 34. [Google Scholar] [CrossRef]
- Zhao, R.; Huang, Y.; Deng, X.; Shi, Y.; Li, J.; Huang, Z.; Wang, Y.; Xue, Z. A Novel Traffic Classifier With Attention Mechanism for Industrial Internet of Things. IEEE Trans. Ind. Inf. 2023, 19, 10799–10810. [Google Scholar] [CrossRef]
- Alghamdi, R.; Bellaiche, M. An Ensemble Deep Learning Based IDS for IoT Using Lambda Architecture. Cybersecurity 2023, 6, 5. [Google Scholar] [CrossRef]
- Abusitta, A.; de Carvalho, G.H.S.; Wahab, O.A.; Halabi, T.; Fung, B.C.M.; Mamoori, S. Al Deep Learning-Enabled Anomaly Detection for IoT Systems. Internet Things 2023, 21, 100656. [Google Scholar] [CrossRef]
- Alrowais, F.; Althahabi, S.; Alotaibi, S.S.; Mohamed, A.; Ahmed Hamza, M.; Marzouk, R. Automated Machine Learning Enabled Cybersecurity Threat Detection in Internet of Things Environment. Comput. Syst. Sci. Eng. 2023, 45, 687–700. [Google Scholar] [CrossRef]
- Yazdinejad, A.; Kazemi, M.; Parizi, R.M.; Dehghantanha, A.; Karimipour, H. An Ensemble Deep Learning Model for Cyber Threat Hunting in Industrial Internet of Things. Digit. Commun. Netw. 2023, 9, 101–110. [Google Scholar] [CrossRef]
- Sharma, B.; Sharma, L.; Lal, C.; Roy, S. Anomaly Based Network Intrusion Detection for IoT Attacks Using Deep Learning Technique. Comput. Electr. Eng. 2023, 107, 108626. [Google Scholar] [CrossRef]
- Almiani, M.; AbuGhazleh, A.; Al-Rahayfeh, A.; Atiewi, S.; Razaque, A. Deep Recurrent Neural Network for IoT Intrusion Detection System. Simul. Model. Pract. Theory 2020, 101, 102031. [Google Scholar] [CrossRef]
- Jullian, O.; Otero, B.; Rodriguez, E.; Gutierrez, N.; Antona, H.; Canal, R. Deep-Learning Based Detection for Cyber-Attacks in IoT Networks: A Distributed Attack Detection Framework. J. Netw. Syst. Manag. 2023, 31, 33. [Google Scholar] [CrossRef]
- ThingSpeak. Available online: https://www.mathworks.com/products/thingspeak.html (accessed on 12 August 2024).
- Faruqui, N.; Yousuf, M.A.; Whaiduzzaman, M.; Azad, A.; Alyami, S.A.; Liò, P.; Kabir, M.A.; Moni, M.A. SafetyMed: A Novel IoMT Intrusion Detection System Using CNN-LSTM Hybridization. Electronics 2023, 12, 3541. [Google Scholar] [CrossRef]
- Akash Dogra CIC IoT Dataset 2023. Available online: https://www.kaggle.com/datasets/akashdogra/cic-iot-2023 (accessed on 26 July 2024).
- Jolliffe, I. Principal Component Analysis. In International Encyclopedia of Statistical Science; Springer: Berlin/Heidelberg, Germany, 2011; pp. 1094–1096. [Google Scholar]
- Hoang, D.H.; Nguyen, H.D. A PCA-Based Method for IoT Network Traffic Anomaly Detection. In Proceedings of the 2018 20th International Conference on Advanced Communication Technology (ICACT), Chuncheon, Republic of Korea, 11–14 February 2018; pp. 381–386. [Google Scholar]
- StandardScaler. Available online: https://scikit-learn.org/stable/modules/generated/sklearn.preprocessing.StandardScaler.html (accessed on 12 August 2024).
- Sklearn. Decomposition. Available online: https://scikit-learn.org/stable/api/sklearn.decomposition.html (accessed on 12 August 2024).
- Atoum, I. Scaled Pearson’s Correlation Coefficient for Evaluating Text Similarity Measures. Mod. Appl. Sci. 2019, 13, 10. [Google Scholar] [CrossRef]
- Alsulami, A.A.; Abu Al-Haija, Q.; Alturki, B.; Alqahtani, A.; Binzagr, F.; Alghamdi, B.; Alsemmeari, R.A. Exploring the Efficacy of GRU Model in Classifying the Signal to Noise Ratio of Microgrid Model. Sci. Rep. 2024, 14, 15591. [Google Scholar] [CrossRef]
- TS, P.; Shrinivasacharya, P. Evaluating Neural Networks Using Bi-Directional LSTM for Network IDS (Intrusion Detection Systems) in Cyber Security. Glob. Transit. Proc. 2021, 2, 448–454. [Google Scholar] [CrossRef]
- De Brouwer, E.; Simm, J.; Arany, A.; Moreau, Y. GRU-ODE-Bayes: Continuous Modeling of Sporadically-Observed Time Series. arXiv 2019, arXiv:1905.12374. [Google Scholar]
- Azizjon, M.; Jumabek, A.; Kim, W. 1D CNN Based Network Intrusion Detection with Normalization on Imbalanced Data. In Proceedings of the 2020 International Conference on Artificial Intelligence in Information and Communication (ICAIIC), Fukuoka, Japan, 19–21 February 2020; pp. 218–224. [Google Scholar]
- Gowda, T.; You, W.; Lignos, C.; May, J. Macro-Average: Rare Types Are Important Too. In Proceedings of the 2021 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, Online, 6–11 June 2021. [Google Scholar] [CrossRef]
- Bonfietti, A.; Lombardi, M. The Weighted Average Constraint. In Lecture Notes in Computer Science (Including Subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Springer: Berlin/Heidelberg, Germany, 2012; Volume 7514, pp. 191–206. [Google Scholar]
- Khedkar, S.P.; Canessane, R.A.; Najafi, M.L. Prediction of Traffic Generated by IoT Devices Using Statistical Learning Time Series Algorithms. Wirel. Commun. Mob. Comput. 2021, 2021, 5366222. [Google Scholar] [CrossRef]
Study | Techniques | Dataset | Key Findings |
---|---|---|---|
[21] | CNN | BoT-IoT and network intrusion detection (NID) | Accuracy of 92.85% and 99.51% |
[24] | CNN | NSL-KDD and TON-IoT | 99.85% and 99.99% |
[25] | Simple RNN, GRU RNNs and LSTM | UNSW NB15 and NSL KDD | NSL-KDD dataset and XGBoost-LSTM with TAC of 88.13% and VAC of 99.49%. TAC of 87.07% with UNSW-NB15 dataset and the XGBoost-Simple-RNN XGBoost-LSTM achieved a TAC of 86.93% with NSL-KDD XGBoost-GRU has achieved a TAC of 78.40% with UNSW-NB15 |
[26] | Lightweight Random Neural Network | TON-IoT | Accuracy of 99.14% in binary and an accuracy of 99.05% in multiclass |
[27] | Feed Forward Neural Networks (FNNs) and Convolutional Neural Networks (CNNs) | BoT-IoT WUSTL-EHMS-2020 WUSTL-IIoT-2021 | FNN focal: accuracy of 91.55% CNN focal: accuracy of 86.77% FNN focal: accuracy of 98.95% CNN focal: accuracy of 98.21% FNN focal: accuracy of 93.26% CNN focal: accuracy of 93.08% |
[28] | Deep Neural Network | NSL-KDD UNSW-NB15 CIC-IDS-2017 BoT-IoT | accuracy of 98.9% accuracy of 96.7% accuracy of 98.74% accuracy of 98.99% |
[29] | LSTM and CNN | UNSW-NB15 | Accuracy of 92.9% for multiclass and 93.1% for binary class |
[10] | Random Forest | IoTID20 | Accuracy of 98.68% |
[30] | FCFFN | Generated IoT dataset | Accuracy of 93.74% |
[31] | Flow Transformer | CIC-IoT-2022 | Accuracy of 98.5% |
[32] | Ensemble ANN CNN LSTM | Accuracy in batch mode Ensemble: 99.6% ANN: 96.9% CNN: 97.0% LSTM: 98.2 | |
[33] | DNN | DS2OS Traffic | Accuracy of 94.9% |
[34] | MFO-RELM | N-BaIoT | Accuracy of 99.8% |
[35] | Ensemble LSTM-Auto Encoder (AE) | GP and SWaT | Accuracy of 99.3% and 99.7% |
[36] | DNN GAN | UNSW-NB15 | DNN: Accuracy of 84% GAN: Accuracy of 91% |
[37] | RNN | NSL-KDD | Accuracy of 92.18% |
[38] | FFNN LSTM | NSL-KDD BoT-IoT | FFNN: accuracy of 98.67% LSTM: accuracy of 96.44% FFNN: accuracy of 99.97% LSTM: accuracy of 99.95% |
Component Name | Purpose of Use | Specifications |
---|---|---|
MATLAB | It is used to preprocess the dataset and connect to ThingSpeak. | Version R2023b. |
Python | It is used to compute PCA transformation, compute inverse PCA, and implement and evaluate NIDS. | PyCharm version 2023.3.2, Python version 3.8. |
ThingSpeak | It is used to monitor and visualize the IoT data. | A platform. |
Desktop Computer | It is used to perform the experiments. | GPU: NVIDIA® GeForce RTX™ 4090, Processor: Intel Core i9, RAM 32 GB, Hard disk 1TB SSD. |
Model # | Precision | Recall | F1-Score |
---|---|---|---|
LSTM | 97.47% | 97.29% | 97.29% |
GRU | 95.71% | 95.79% | 95.79% |
1D-CNN | 91.53% | 90.56% | 90.15% |
FFNN | 78.82% | 76.24% | 76.53% |
DT | 87.32% | 87.26% | 87.24% |
RF | 91.79% | 84.59% | 86.82% |
Model # | Precision | Recall | F1-Score |
---|---|---|---|
LSTM | 98.23% | 98.20% | 98.14% |
GRU | 96.91% | 96.83% | 96.94% |
1D-CNN | 95.24% | 94.25% | 93.96% |
FFNN | 89.03% | 89.27% | 88.98% |
DT | 93.73% | 93.68% | 93.63% |
RF | 94.32% | 94.39% | 94.25% |
Disclaimer/Publisher’s Note: The statements, opinions and data contained in all publications are solely those of the individual author(s) and contributor(s) and not of MDPI and/or the editor(s). MDPI and/or the editor(s) disclaim responsibility for any injury to people or property resulting from any ideas, methods, instructions or products referred to in the content. |
© 2024 by the authors. Licensee MDPI, Basel, Switzerland. This article is an open access article distributed under the terms and conditions of the Creative Commons Attribution (CC BY) license (https://creativecommons.org/licenses/by/4.0/).
Share and Cite
Alqahtani, A.; Alsulami, A.A.; Alqahtani, N.; Alturki, B.; Alghamdi, B.M. A Comprehensive Security Framework for Asymmetrical IoT Network Environments to Monitor and Classify Cyberattack via Machine Learning. Symmetry 2024, 16, 1121. https://doi.org/10.3390/sym16091121
Alqahtani A, Alsulami AA, Alqahtani N, Alturki B, Alghamdi BM. A Comprehensive Security Framework for Asymmetrical IoT Network Environments to Monitor and Classify Cyberattack via Machine Learning. Symmetry. 2024; 16(9):1121. https://doi.org/10.3390/sym16091121
Chicago/Turabian StyleAlqahtani, Ali, Abdulaziz A. Alsulami, Nayef Alqahtani, Badraddin Alturki, and Bandar M. Alghamdi. 2024. "A Comprehensive Security Framework for Asymmetrical IoT Network Environments to Monitor and Classify Cyberattack via Machine Learning" Symmetry 16, no. 9: 1121. https://doi.org/10.3390/sym16091121