Deep learning based intelligent IDS for Large-scale IoT networks
Authors: Isha Andrade, Shalaka S Mahadik, Mithun Mukherjee, Pranav M Pawar, Raja Muthalagu
Organizations: Department of Computer Science, Birla Institute of Technology and Science, Pilani, Dubai Campus, Dubai International Academic City, Dubai, United Arab Emirates
The proliferation of large-scale IoT networks has been both a blessing and a curse. Not only has it revolutionized the way organizations operate by increasing the efficiency of automated procedures, but it has also simplified our daily lives. However, while IoT networks have improved convenience and connectivity, they have also increased security risk due to unauthorized devices gaining access to these networks and exploiting existing weaknesses with specific attack types. The research proposes two lightweight deep learning (DL)-based intelligent intrusion detection systems (IDS). to enhance the security of IoT networks: the proposed convolutional neural network (CNN)-based IDS and the proposed long short-term memory (LSTM)-based IDS. The research evaluated the performance of both intelligent IDSs based on DL using the CICIoT2023 dataset. DL-based intelligent IDSs successfully identify and classify various cyber threats using binary, grouped, and multi-class classification. The proposed CNN-based IDS achieves an accuracy of 99.34%, 99.02% and 98.6%, while the proposed LSTM-based IDS achieves an accuracy of 99.42%, 99.13%, and 98.68% for binary, grouped, and multi-class classification, respectively.
Figures & tables
Fig. 1: Example of large-scale IoT and its features
Type of classifications
Binary
Grouped
Multi-Class
FL + client DNN [ 6 ]
99%
-
-
DNN-BiLSTM [ 7 ]
-
-
93.13%
DNN [ 8 ]
99.71%
98.76%
98.81%
MLP-CNN [ 9 ]
-
-
99.95%
DL + (ADASYN and SMOTE) [ 10 ]
99.97%
-
99.99%
TABLE I: Comparison of various state-of-the-art DL methods used for detecting IoT network attacks from three classifications perspectives
Fig. 2: Feature importance graph [ 30 ]
Sr.no
Feature name
Sr.no
Feature name
Sr.no
Feature name
1
Srate
8
Header_Length
15
syn_flag_number
2
Rate
9
flow_duration
16
rst_count
3
Duration
10
Max
17
UDP
4
syn_count
11
HTTP
18
fin_count
5
Weight
12
Protocol Type
19
Variance
6
ack_flag_number
13
urg_count
20
IAT
TABLE II: Top 20 selected features [ 30 ]
Attack Name
Total Samples
Training Samples
Testing Samples
Dataset_Binary [ 30 ]
4,668,653
3,734,922
933,731
Dataset_Group [ 30 ]
4,668,653
3,734,921
933,732
Dataset_Multi [ 30 ]
4,570,593
3,656,475
914,118
TABLE III: Dataset Details
Fig. 3: Architecture of proposed CNN-based IDS
Fig. 4: Architecture of proposed LSTM-based IDS
Software specification:
Software Tool
Jupyter Notebook 6.5.4
Programming Language
Python 3.11.4, Sklearn library, Matplotlib 3.7.1
API Tool
Keras on TensorFlow 2.14.0
Hardware specification:
Processor
Processor Intel(R) Core(TM) i7-8550U CPU @ 1.80 GHz, Windows 11 64-bit OS