Source-linked AI summary
Threat analysis of IoT networks Using Artificial Neural Network Intrusion Detection System
Elike Hodo, Xavier Bellekens, Andrew Hamilton, Pierre-louis Dubouilh, Ephraim Iorkyase, Christos Tachtatzis, Robert Atkinson
TL;DR
IoT networks face multiple intrusion threats, motivating methods that can distinguish normal from threat traffic. This paper uses a supervised ANN-based offline IDS, validated on a simulated IoT network, to detect DDoS/DoS attacks. The model achieves 99.4% overall classification accuracy and successfully detects various DDoS/DoS attacks.
Problem
IoT networks are susceptible to significant intrusion threats, including DoS, malware, data breaches, and weakened security perimeters.
Method
The paper uses an ANN-based offline IDS to analyze IoT network information and classify normal and threat patterns, including a supervised multi-layer perceptron approach.
Results
99.4% overall accuracy was achieved in classifying normal and threat traffic, with successful detection of DDoS/DoS attacks against legitimate IoT traffic.
Takeaways & Limitations
The ANN procedure successfully identifies different DDoS/DoS attacks in the simulated IoT-network evaluation.
Abstract
from arXiv · showhide
The Internet of things (IoT) is still in its infancy and has attracted much interest in many industrial sectors including medical fields, logistics tracking, smart cities and automobiles. However as a paradigm, it is susceptible to a range of significant intrusion threats. This paper presents a threat analysis of the IoT and uses an Artificial Neural Network (ANN) to combat these threats. A multi-level perceptron, a type of supervised ANN, is trained using internet packet traces, then is assessed on its ability to thwart Distributed Denial of Service (DDoS/DoS) attacks. This paper focuses on the classification of normal and threat patterns on an IoT Network. The ANN procedure is validated against a simulated IoT network. The experimental results demonstrate 99.4% accuracy and can successfully detect various DDoS/DoS attacks.
I. INTRODUCTION
IoT connects distributed sensing, cloud, and software systems but faces rising intrusion threats across several attack categories. The paper applies ANN-based offline intrusion detection to classify normal and threat patterns, with prior ANN work motivating the approach.
- IoT combines distributed sensor nodes, cloud servers, and software to sense and process measurements in real time.
- Threats arise from both external intruders lacking network permissions and internal intruders misusing authorized access.
- IoT threats include DoS, malware, data breaches, and weakened security perimeters.
- Prior ANN intrusion-detection studies using the KDD99 dataset reported promising performance.
- The paper uses an ANN as an offline IDS to analyze information from IoT network components and identify DoS attacks.
II. INTRUSION DETECTION
The paper describes IDSs as systems that monitor networks and computer systems, distinguishing host-based and network-based deployments. It introduces a performance comparison between these two categories.
- An IDS monitors networks and computer systems to detect security threats.
- Table I compares the performance of Host-Based IDS and Network-Based IDS.
- Host-Based IDS software monitors traffic, application files, and operating-system activity on an individual host.
- Network-Based IDS captures and analyzes packet streams across an entire network.
B. Intrusion patterns
Intrusion detection uses misuse and anomaly patterns. Systems may combine them, while false positives influence their typical use across commercial and research settings.
- Misuse detection matches observed network traffic against known intruder patterns and can detect known threats.
- Anomaly detection builds a profile of normal system behavior and observes deviations from that profile.
- Many systems combine misuse and anomaly detection because the two patterns are complementary.
- False-positive concerns are associated with misuse-based systems, which are commonly used commercially, whereas anomaly detection is found in research systems.
C. Intrusion Detection Techniques
The paper surveys intrusion-detection techniques based on intrusion patterns, including statistical, evolutionary, protocol-verification, rule-based, and ANN approaches. ANN classification propagates inputs through neurons and uses back propagation to reduce output error.
- Statistical analysis compares current data trends with baseline criteria to identify deviations from normal behavior.
- Evolutionary algorithms model normal behavior, errors, and attempted intrusions as application paths classified under different conditions.
- Protocol verification checks protocol fields against established standards but can produce false positives for unspecified protocols.
- Rule-based detection applies packet data to a finite-state machine whose transitions support attack detection.
- ANNs form complex hypotheses, propagate event streams from input nodes to classified outputs, and use back propagation to estimate output error.
III. ARTIFICIAL NEURAL NETWORK LEARNING PROCEDURE
The paper presents ANN learning procedures, emphasizing supervised learning and a three-layer MLP architecture for classifying network patterns. The model uses labelled inputs and outputs and is trained through feed-forward and backward learning.
- Supervised learning maps labelled inputs x to corresponding outputs y using a training set.
- The multi-layer perceptron is an ANN trained with supervised learning procedures.
- The MLP architecture contains three layers with six input units, three hidden units, and one output unit.
- The network uses unipolar sigmoid transfer functions in hidden and output neurons, with stochastic learning and mean square error.
- The network is trained using feed-forward and backward learning algorithms.
A. Feed forward Learning Algorithm
The feed-forward algorithm computes activations layer by layer from weighted inputs and bias terms, producing the network’s hypothesis output.
- Each non-input unit computes an activation from weighted connections to the preceding layer and an associated bias.
- For the first layer, the input activations are represented by the input values x_i.
- The network’s hypothesis h_w,b(x) outputs a real number from the input vector.
- The feed-forward procedure applies the activation function to weighted sums to compute successive layer activations.
B. The Backward Learning Algorithm
The backward learning algorithm computes output and hidden-layer errors, then derives partial derivatives for gradient descent optimization. Repeated updates reduce the cost function.
- The feed-forward step computes activations for every network layer before error calculation.
- The output layer is used to compute the output error term through the sigmoid activation.
- Errors are computed for layers 3 and 2 at each node.
- The algorithm calculates the desired partial derivatives after propagating errors through the network.
- Training uses repeated gradient-descent steps to reduce the cost function J(w,b).
IV. EXPERIMENTAL SCENARIO
The experimental scenario simulates an IoT sensor network with a server relay and evaluates attacks targeting that server. DoS and DDoS traffic can make the server unresponsive and disrupt sensor adaptation.
- The simulated IoT network contains five sensor nodes: four clients and one server relay for data analytics.
- Network traffic is captured through a network tap, while the server acknowledges sensor data and replies based on received data.
- DoS attacks use one host sending over 10 million packets, whereas DDoS attacks use up to three hosts sending over 10 million packets each.
- The attacks target the server node with UDP packets crafted by a custom C script.
- When the server becomes unresponsive, sensor nodes cannot adapt their behavior, ultimately causing a fault in the monitored system.
- Attack detection is presented as crucial for avoiding disruption of the sensor network and maintaining network stability.
V. RESULTS AND DISCUSSIONS
The ANN was evaluated using separate training, validation, and testing samples, with confusion matrices summarizing classification performance. Overall accuracy reached 99.4%, and the model detected DDoS/DoS attacks against legitimate IoT traffic.
- The network used 2,313 training samples, 496 validation samples, and 496 test samples.
- 99.4% overall accuracy was achieved across the neural network classification performance.The overall confusion matrix appears in the lower-right of Fig. 3.
- Fig. 3 presents confusion matrices for the training, testing, validation, and overall datasets.
- The ANN successfully detected DDoS/DoS attacks amid legitimate IoT network traffic.The paper links this detection to early warnings for the response team and avoidance of major network disruptions.
VI. CONCLUSION AND FUTURE WORK
The paper concludes that a neural-network intrusion-detection approach can classify normal and threat patterns in IoT networks and identify DDoS/DoS attacks. It reports over 99% accuracy on a simulated IoT network while identifying different attack types.
- The ANN-based approach classified normal and threat patterns to identify DDoS/DoS attacks on an IoT network.
- Over 99% accuracy was demonstrated when the ANN model was validated against a simulated IoT network.
- The model successfully identified different attack types with good true-positive and false-positive rates.
- Future work will introduce more attacks and investigate recurrent and convolutional neural networks.These developments are intended to test reliability against additional attacks and improve framework accuracy.