N-BaIoT—Network-Based Detection of IoT Botnet Attacks Using Deep Autoencoders

By Yair Meidan, Michael Bohadana, Yael Mathov, Yisroel Mirsky, Dominik Breitenbacher, Asaf Shabtai, Yuval Elovici. IEEE pervasive computing, 2018

1,390 citations recorded by the source corpus.

The proliferation of IoT devices that can be more easily compromised than desktop computers has led to an increase in IoT-based botnet attacks. To mitigate this threat, there is a need for new methods that detect attacks launched from compromised IoT devices and that differentiate between hours- and milliseconds-long IoT-based attacks. In this article, we propose a novel network-based anomaly detection method for the IoT called N-BaIoT that extracts behavior snapshots of the network and uses deep autoencoders to detect anomalous network traffic from compromised IoT devices. To evaluate our method, we infected nine commercial IoT devices in our lab with two widely known IoT-based botnets, Mirai and BASHLITE. The evaluation results demonstrated our proposed methods ability to accurately and instantly detect the attacks as they were being launched from the compromised IoT devices that were part of a botnet.

Subfields: Artificial Intelligence, Computer Networks and Communications, Signal Processing

View Paper: https://www.semanticscholar.org/paper/6b8aec2a36d28f32b85163c7b1107767405d678a

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Signal Processing

Citations in the corpus

Decentralized Federated Learning: Fundamentals, State of the Art, Frameworks, Trends, and Challenges (2022, methodology): “[124] 2021 Anomaly detection ML models in non-IID scenarios, including mechanisms to locally rebalance training datasets Cross-device Decentralized Simulation Four-layered FCNN P2PK-SMOTE Synchronous Asynchronous Random N-BaIoT [180]”
Passban IDS: An Intelligent Anomaly-Based Intrusion Detection System for IoT Edge Devices (2020, methodology): “There exist IoT datasets publicly available in the literature, such as the ones used in [44], [45], and [62].”
Analysis of Dimensionality Reduction Techniques on Big Data (2020, methodology): “Then experimentation is repeated on two other datasets namely, Diabetic Retinopathy Dataset from UCI machine learning repository [10] and Intrusion Detection Dataset from UCI machine learning repository [11].”
Internet of Things Applications, Security Challenges, Attacks, Intrusion Detection, and Future Visions: A Systematic Review (2021, methodology): “Usually, the same set of features are extracted for different time windows to create a real-time scenario [97].”
Edge-IIoTset: A New Comprehensive Realistic Cyber Security Dataset of IoT and IIoT Applications for Centralized and Federated Learning (2022, background): “Created by Meidan et al. [9] as a way to evaluate a proposed network-based anomaly detection scheme that retrieves behavioral snapshots out of the network, and leverages deep autoencoders for detecting abnormal network trafﬁc originating from exploited IoT devices.”
Machine Learning in IoT Security: Current Solutions and Future Challenges (2019, methodology): “[141] used deep autoencoders to detect Botnet attacks in IoT.”
CICIoT2023: A Real-Time Dataset and Benchmark for Large-Scale Attacks in IoT Environment (2023, background): “The authors in [34] propose a novel network-based dataset for detecting botnet attacks in the IoT environment called N-BaioT (2018).”
CorrAUC: A Malicious Bot-IoT Traffic Detection Method in IoT Network Using Machine-Learning Techniques (2021, methodology): “[33] studied the detection of attacks in IoT network and proposed a new technique to overcome the problem of attacks which is initiated by the Internet of Things (IoT) devices and then”
A Supervised Intrusion Detection System for Smart Home IoT Devices (2019, neutral): “[31] and McDermott et al.”
Making AI Forget You: Data Deletion in Machine Learning (2019, neutral): “…= 15 , 120 , D = 52 , K = 7 ) [12], MNIST ( N = 60 , 000 , D = 784 , K =10 ) [51], Postures ( N =74 , 975 , D =15 , K =5 ) [35, 34] , Botnet ( N =1 , 018 , 298 , D =115 , K =11 )[56], and a synthetic dataset made from a Gaussian mixture model which we call Gaussian ( N =100 , 000 , D =25 , K =5 ).”
Cellular, Wide-Area, and Non-Terrestrial IoT: A Survey on 5G Advances and the Road Toward 6G (2021, methodology): “[320] AE Generic Intrusion detection using AEs to learn normal behaviors of the IoT devices”
Federated Learning for Malware Detection in IoT Devices (2021, methodology): “The choice of 29 coding dimensions corresponds to what is used in [17].”
Explainable Artificial Intelligence Applications in Cyber Security: State-of-the-Art in Research (2022, background): “Malware [94] N- BaIoT 2018 644 N-BaIoT contains real traffic (115 numerical features) of 9 commercial IoT devices infected with 2 IoT-based botnets, Mirai and BASHLITE.”