A Two-Layer Dimension Reduction and Two-Tier Classification Model for Anomaly-Based Intrusion Detection in IoT Backbone Networks

By Hamed Haddad Pajouh, R. Javidan, R. Khayami, Ali Dehghantanha, Kim-Kwang Raymond Choo. IEEE Transactions on Emerging Topics in Computing, 2019

452 citations recorded by the source corpus.

With increasing reliance on Internet of Things (IoT) devices and services, the capability to detect intrusions and malicious activities within IoT networks is critical for resilience of the network infrastructure. In this paper, we present a novel model for intrusion detection based on two-layer dimension reduction and two-tier classification module, designed to detect malicious activities such as User to Root (U2R) and Remote to Local (R2L) attacks. The proposed model is using component analysis and linear discriminate analysis of dimension reduction module to spate the high dimensional dataset to a lower one with lesser features. We then apply a two-tier classification module utilizing Naïve Bayes and Certainty Factor version of K-Nearest Neighbor to identify suspicious behaviors. The experiment results using NSL-KDD dataset shows that our model outperforms previous models designed to detect U2R and R2L attacks.

Subfields: Artificial Intelligence, Computer Networks and Communications, Signal Processing

View Paper: https://www.semanticscholar.org/paper/bdee2db0e7d29989acfd4114a4299fe9a585db3f

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Signal Processing

Citations in the corpus

An Ensemble Intrusion Detection Technique Based on Proposed Statistical Flow Features for Protecting Network Traffic of Internet of Things (2019, unknown): “[20]”
A Review of Intrusion Detection Systems Using Machine and Deep Learning in Internet of Things: Challenges, Solutions and Future Directions (2020, methodology): “Some researches [116–118] have used KNN based classification for anomaly and intrusion detection in general and IoT based network intrusion detection in particular [119,120] with reasonable accuracy in detecting User to Root (U2R) and Remote to Local (R2L) attacks.”
A Survey of Machine and Deep Learning Methods for Internet of Things (IoT) Security (2018, methodology): “Considering the IoT environment, a study [157] proposed a model for the detection of U2R and R2L attacks.”
Network Intrusion Detection for IoT Security Based on Learning Techniques (2019, methodology): “[147] presented an anomaly IDS built with Two-layer Dimension Reduction and Two-tier Classification (TDTC) for IoT Backbone.”
TON_IoT Telemetry Dataset: A New Generation Dataset of IoT and IIoT for Data-Driven Intrusion Detection Systems (2020, background): “Even though several studies did use such datasets to evaluate their IoT-related intrusion detection solutions [24]–[28], one can argue that these datasets do not reﬂect IIoT characteristics since none of which contains any IoT device in their testbeds.”
A Review on Machine Learning and Deep Learning Perspectives of IDS for IoT: Recent Updates, Security Issues, and Challenges (2020, background): “For protecting IoT infrastructure from DDoS attack, a framework is proposed in [92].”
Machine Learning at the Network Edge: A Survey (2019, background): “proposed a model to identify suspicious behaviors such as a user-to-root attack or a remote-to-local attack within IoT networks [83].”
Robust Malware Detection for Internet of (Battlefield) Things Devices Using Deep Eigenspace Learning (2019, background): “[24] to propose a two-layer dimension reduction and two-tier classification module to detect malicious activities.”
Machine Learning in IoT Security: Current Solutions and Future Challenges (2019, background): “Anomaly/Intrusion Detection • K-means clustering and Decision Tree [94] • Artificial Neural Network ANN [95] • Novelty and Outlier Detection [96] • Decision Tree [97] • Naive Bayes [97], [98]”
TSE-IDS: A Two-Stage Classifier Ensemble for Intelligent Anomaly-Based Intrusion Detection System (2019, methodology): “Similar to [48], since the proposed classifiers are applied only on a single dataset (UNSW-NB15) the generalizability of the proposedmethods is still debatable.”