Distributed IoT Attack Detection Using Edge CNN and Cloud LSTM
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security solutions for IoT devices are inadequate in detecting distributed attacks, particularly phishing and botnets, due to their decentralized nature and the evolving tactics employed by attackers, with existing methods often requiring significant computational resources and failing to provide on-device security.
Innovation Solution
A distributed deep learning framework combining a Convolutional Neural Network (CNN) micro-security add-on on IoT devices for real-time phishing and application layer DDoS detection, and a cloud-based Long-Short Term Memory (LSTM) network for botnet detection, enabling simultaneous detection across multiple devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing security solutions are deployed on IoT devices, then device security is improved, but computational resource consumption increases significantly
Solution Approach 1:
The security system is segmented into two parts: a lightweight CNN model deployed on resource-constrained IoT devices for local phishing and DDoS detection, and a more comprehensive LSTM-based model deployed on cloud servers for botnet detection. This segmentation allows each component to operate within its resource constraints while maintaining overall system effectiveness.
Solution Approach 2:
A distributed deep learning framework acts as an intermediary between IoT devices and cloud servers, coordinating the detection efforts. The framework manages data flow, model inference, and result aggregation, enabling collaborative security detection without overloading individual devices.
2Measurement precision
If centralized security detection is used, then detection accuracy is improved, but response time to distributed attacks increases
Solution Approach 1:
The detection system is divided into edge computing (on-device CNN) and cloud computing (server-based LSTM) components. The CNN on IoT devices provides immediate local detection for phishing and DDoS attacks, while the LSTM on servers handles botnet detection. This segmentation enables parallel processing and reduces the time required for comprehensive security detection.
Solution Approach 2:
The system transitions from a single centralized detection dimension to a multi-dimensional distributed architecture. Detection occurs simultaneously at the device level (local network traffic analysis) and cloud level (cross-device pattern recognition), adding spatial and temporal dimensions to the detection process.
3Productivity
If on-device security is implemented, then real-time detection is improved, but device complexity increases
Solution Approach 1:
Complex security analysis functions are extracted from IoT devices and relocated to cloud servers. The devices retain only the essential lightweight CNN model for basic detection, while more complex botnet detection algorithms run on servers. This extraction reduces device complexity while preserving real-time detection capabilities for critical threats.
Solution Approach 2:
Different parts of the security system have different levels of complexity tailored to their specific functions. The on-device CNN uses a simplified architecture optimized for resource-constrained environments, while the server-based LSTM employs a more complex structure suitable for handling aggregated data from multiple devices. Each component's complexity is optimized for its specific role.
Data Source
AI summary
The present disclosure presents distributed attack detection systems and related methods. One such method comprises executing, by a client computing device, a convolutional neural network model that is configured to detect a network attack on the client computing device; receiving an HTTP request; extracting a uniform resource locator contained within the HTTP request; inputting the uniform resource locator in the convolutional neural network model; receiving an output from the convolutional neural network model that classifies the uniform resource locator as being directed to a network attack on the client computing device; and transmitting, by the client computing device, embeddings of a hidden layer of the convolutional neural network model to one or more computer servers that are hosting a recurrent neural network model for detecting a distributed network attack across a plurality of client computing devices.