Machine Learning DDoS Detection for Consumer Internet of Things Devices

By Rohan Doshi, Noah J. Apthorpe, N. Feamster. 2018 IEEE Security and Privacy Workshops (SPW), 2018

697 citations recorded by the source corpus.

An increasing number of Internet of Things (IoT) devices are connecting to the Internet, yet many of these devices are fundamentally insecure, exposing the Internet to a variety of attacks. Botnets such as Mirai have used insecure consumer IoT devices to conduct distributed denial of service (DDoS) attacks on critical Internet infrastructure. This motivates the development of new techniques to automatically detect consumer IoT attack traffic. In this paper, we demonstrate that using IoT-specific network behaviors (e.g., limited number of endpoints and regular time intervals between packets) to inform feature selection can result in high accuracy DDoS detection in IoT network traffic with a variety of machine learning algorithms, including neural networks. These results indicate that home gateway routers or other network middleboxes could automatically detect local IoT device sources of DDoS attacks using low-cost machine learning algorithms and traffic data that is flow-based and protocol-agnostic.

Subfields: Artificial Intelligence, Computer Networks and Communications

View Paper: https://www.semanticscholar.org/paper/400081ba358663ca24365044e5e818638c439e1d

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

Citations in the corpus

A Review of Intrusion Detection Systems Using Machine and Deep Learning in Internet of Things: Challenges, Solutions and Future Directions (2020, background): “Moreover, another study [152] has shown RF to be better than KNN, artificial neural network (ANN) and SVM at DDoS detection in IoT networks because it requires fewer input features and can bypass heavy computations required for feature selection in real-time IDS [153].”
Machine Learning and Deep Learning Methods for Intrusion Detection Systems: A Survey (2019, background): “For speciﬁc application scenarios, such as cloud computing [82,83], IoT [84–86], and smart grids [87,88], domain knowledge can be used to provide the environmental characteristics that are helpful in data collection and data preprocessing.”
FLAME: Taming Backdoors in Federated Learning (2022, methodology): “We test backdoor attacks on IoT anomaly-based intrusion detection systems that often represent critical security applications [5, 16, 27, 30, 44, 45, 55].”
A Survey of Machine and Deep Learning Methods for Internet of Things (IoT) Security (2018, methodology): “study [163], RF, SVM, KNN and ANN were trained to detect DDoS in IoT systems, and RF provided slightly better clas-”
Towards the Development of Realistic Botnet Dataset in the Internet of Things for Network Forensic Analytics: Bot-IoT Dataset (2018, background): “• Denial of Service [26][20][3][56]- are malicious activities that attempt to disrupt a service, thus making it unavailable to legitimate users.”
A Supervised Intrusion Detection System for Smart Home IoT Devices (2019, methodology): “[29], also employ machine learning algorithms in IoT networks to detect distributed DoS (DDoS) attacks.”
Machine Learning in IoT Security: Current Solutions and Future Challenges (2019, background): “the existing ML mechanisms for DDoS detection in IoT networks [146].”
Variational LSTM Enhanced Anomaly Detection for Industrial Big Data (2021, background): “For example, Doshi et al. [18] employed several machine learning methods to detect distributed denial of service (DoS) attacks in IoT networks.”
A Review on Machine Learning and Deep Learning Perspectives of IDS for IoT: Recent Updates, Security Issues, and Challenges (2020, methodology): “The RF algorithm has been applied in IDS for selecting relevant features as well as attack classification [108].”
Internet of Things (IoT) Security Intelligence: A Comprehensive Overview, Machine Learning Solutions and Research Directions (2022, methodology): “is used to detect anomalies [39] [103], denial of service attack [41], IoT intrusion detection service [106] [96], smart city anomaly detection [28] etc.”
Machine Learning Based Solutions for Security of Internet of Things (IoT): A Survey (2020, methodology): “They compared a variety of clas-siﬁers for attack detection, including KNN, KDTree al-gorithm, SVM with the linear kernel (LSVM), DT using Gini impurity scores, RF using Gini impurity scores, NN.”