Get 20M+ Full-Text Papers For Less Than $1.50/day. Start a 14-Day Trial for You or Your Team.

Learn More →

On-device context-aware misuse detection framework for heterogeneous IoT edge

On-device context-aware misuse detection framework for heterogeneous IoT edge Traditional AI techniques for offline misuse network intrusion detection have performed well, assuming that the traffic from the datasets is sufficiently large for generalization, balanced, independently and identically distributed—exhibiting homogeneous behavior with little to no context change. However, the rapidly expanding IoT network is an ensemble of proliferating internet-connected devices catering to the growing need for handling highly distributed, heterogeneous, and time-critical workloads that conform to none of the above assumptions. Moreover, the evolving Botnet-based attack vectors exploit the non-standardized and poorly scrutinized architectural vulnerabilities of such devices—leading to compounding threat intensity, rapidly rendering the network defenseless. Furthermore, the memory, processor, and energy resource constraints of the IoT devices necessitate lightweight device-specific intrusion detection policies for effective and updated rule learning in real-time through the edge infrastructures. However, the existing methods proposed to solve such issues are either centralized, data and resource-intensive, context-unaware, or inefficient for online rule learning with smaller and imbalanced data samples. Thus, this paper addresses such issues through a context-aware expert system-based feature subset framework with minimal processing overhead and a decentralized on-device misuse detection scheme for IoT—called HetIoT-NIDS, capable of efficiently inferring over smaller data samples, tolerant to class imbalance, and deployable on the low-memory and low-power edge of IoT devices. Furthermore, HetIoT-NIDS facilitates threat localization within the deployed device, preventing threat progression and intensity compounding. The experiments and analyses of the propounded algorithms and the resulting training times and model sizes prove that the proposed approach is efficient and adaptable to online and offline misuse intrusion detection, especially on smaller data sample sizes. http://www.deepdyve.com/assets/images/DeepDyve-Logo-lg.png Applied Intelligence Springer Journals

On-device context-aware misuse detection framework for heterogeneous IoT edge

Download PDF
27 pages

Loading next page...
 
/lp/springer-journals/on-device-context-aware-misuse-detection-framework-for-heterogeneous-v3U2EHFT11

References (53)

Publisher
Springer Journals
Copyright
Copyright © The Author(s), under exclusive licence to Springer Science+Business Media, LLC, part of Springer Nature 2022. Springer Nature or its licensor holds exclusive rights to this article under a publishing agreement with the author(s) or other rightsholder(s); author self-archiving of the accepted manuscript version of this article is solely governed by the terms of such publishing agreement and applicable law.
ISSN
0924-669X
eISSN
1573-7497
DOI
10.1007/s10489-022-04039-5
Publisher site
See Article on Publisher Site

Abstract

Traditional AI techniques for offline misuse network intrusion detection have performed well, assuming that the traffic from the datasets is sufficiently large for generalization, balanced, independently and identically distributed—exhibiting homogeneous behavior with little to no context change. However, the rapidly expanding IoT network is an ensemble of proliferating internet-connected devices catering to the growing need for handling highly distributed, heterogeneous, and time-critical workloads that conform to none of the above assumptions. Moreover, the evolving Botnet-based attack vectors exploit the non-standardized and poorly scrutinized architectural vulnerabilities of such devices—leading to compounding threat intensity, rapidly rendering the network defenseless. Furthermore, the memory, processor, and energy resource constraints of the IoT devices necessitate lightweight device-specific intrusion detection policies for effective and updated rule learning in real-time through the edge infrastructures. However, the existing methods proposed to solve such issues are either centralized, data and resource-intensive, context-unaware, or inefficient for online rule learning with smaller and imbalanced data samples. Thus, this paper addresses such issues through a context-aware expert system-based feature subset framework with minimal processing overhead and a decentralized on-device misuse detection scheme for IoT—called HetIoT-NIDS, capable of efficiently inferring over smaller data samples, tolerant to class imbalance, and deployable on the low-memory and low-power edge of IoT devices. Furthermore, HetIoT-NIDS facilitates threat localization within the deployed device, preventing threat progression and intensity compounding. The experiments and analyses of the propounded algorithms and the resulting training times and model sizes prove that the proposed approach is efficient and adaptable to online and offline misuse intrusion detection, especially on smaller data sample sizes.

Journal

Applied Intelligence – Springer Journals

Published: Jun 1, 2023

Keywords: Botnet-based attacks; Context-awareness; Expert knowledge correlation; Heterogeneous IoT edge; On-device misuse intrusion detection; Root cause analysis; Threat intensity compounding; Threat localization

There are no references for this article.