Ensemble IoT Intrusion Detection for Constrained Devices
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
IoT devices, particularly constrained devices, lack built-in security protection due to power and memory limitations, making them vulnerable to hacking and cyber-attacks, and existing intrusion detection systems are inadequate for resource-constrained environments.
Innovation Solution
A computer-automated method and system utilizing an ensemble machine learning (ML) based Intrusion Detection System (IDS) with preprocessing and ensemble ML classifiers to identify and mitigate various attacks on IoT networks, employing a novel packet capture (PCAP) parsing tool and ML techniques to process large data volumes efficiently.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional intrusion detection systems are deployed in IoT environments, then detection capability is improved, but device complexity and resource consumption increase
Solution Approach 1:
The intrusion detection system is segmented into multiple independent components: data collection module, data preprocessing module, feature extraction module, and classification module. Each component processes specific tasks separately, reducing the complexity burden on any single component while maintaining overall detection capability.
Solution Approach 2:
A cloud-based preprocessing system acts as an intermediary between IoT devices and the intrusion detection system. The cloud server performs heavy preprocessing and feature extraction tasks, while edge devices only need to send raw data, significantly reducing local resource requirements and device complexity.
2Reliability
If comprehensive security protection is implemented on constrained devices, then security reliability is improved, but power consumption increases
Solution Approach 1:
Constrained devices perform minimal local processing and self-monitoring using their existing resources, while relying on the cloud-based system for comprehensive security analysis. This allows devices to maintain security without consuming excessive power for complex detection algorithms.
Solution Approach 2:
The cloud server serves as an intermediary that handles energy-intensive security analysis tasks remotely. Constrained devices only transmit data to the cloud, avoiding local execution of power-consuming intrusion detection algorithms while still benefiting from comprehensive security protection.
3Speed
If real-time intrusion detection is implemented, then response speed is improved, but processing time and computational resources increase
Solution Approach 1:
The system performs preliminary data collection and basic preprocessing at the edge device level before transmission to the cloud. This preliminary action reduces the volume of data requiring processing in real-time, enabling faster intrusion detection while minimizing computational resource consumption during critical response periods.
Solution Approach 2:
Processing is segmented between edge devices (data collection and basic preprocessing) and cloud servers (feature extraction and classification). This segmentation allows real-time detection at the edge level while heavy computational tasks are handled asynchronously in the cloud, balancing speed and resource consumption.
4Reliability
If existing intrusion detection systems are used, then detection functionality is provided, but adaptability to new attack vectors is insufficient
Solution Approach 1:
The system incorporates feedback mechanisms where detection results and new attack patterns are continuously fed back into the feature extraction and classification models. This enables the system to learn from new attack vectors and update its detection capabilities dynamically, improving adaptability while maintaining core detection functionality.
Solution Approach 2:
The intrusion detection system uses dynamic classification models that can adapt to changing attack patterns. The machine learning models are continuously trained on new data and can adjust their detection parameters in real-time, providing both existing detection functionality and adaptability to emerging threats.
Data Source
AI summary
An automated method and system for modeling intrusion detection on an Internet of Things network preprocess received raw data packets. The raw data packets are converted to a packet capture file, which is converted to a comma separated value (CSV) file. The CSV file is filtered to create normal and abnormal CSV files. An attack is identified in the abnormal CSV file. Features associated with the attack are labeled and classified as an attack type. The abnormal and normal CSV files are merged. Redundant data is removed from the merged file, which is added to a concatenated file with other merged files. Features are extracted from the concatenated file and a machine language (ML) model is built using the extracted features. ML classifiers are determined for each merged file for the ML model to build an ensemble ML model. A dynamic ensemble of ML classifiers detects evolving attack types.