An enhanced intrusion detection system for routing attacks in MANET

Abstract Internet of Things (IoT) is the powerful latest trend that allows communications and networking of many sources over the internet. Routing protocol for low power and lossy networks (RPL) based IoT networks may be exposed to many routing attacks due to resource-constrained and open nature of the IoT nodes. Hence, there is a need for network intrusion detection system (NIDS) to protect RPL based IoT networks from routing attacks. The existing techniques for anomaly-based NIDS (ANIDS) subjects to high false alarm rate (FAR). Therefore, a novel bio-inspired voting ensemble classifier with feature selection technique is proposed in this paper to improve the performance of ANIDS for RPL based IoT networks. The proposed voting ensemble classifier combines the results of various base classifiers such as logistic Regression, support vector machine, decision tree, bidirectional long short-term memory and K-nearest neighbor to detect the attacks accurately based on majority voting rule. The optimized weights of base classifiers are obtained by using the feature selection method called simulated annealing based improved salp swarm algorithm (SA-ISSA), which is the hybridization of particle swarm optimization, opposition based learning and salp swarm algorithm. The experiments are performed with RPL-NIDDS17 dataset that contains seven types of attack instances. The performance of the proposed model is evaluated and compared with existing feature selection and classification techniques in terms of accuracy, attack detection rate (ADR), FAR and so on. The proposed ensemble classifier shows better performance with higher accuracy (96.4%), ADR (97.7%) and reduced FAR (3.6%).

Download Full-text

ELNIDS: Ensemble Learning based Network Intrusion Detection System for RPL based Internet of Things

10.36227/techrxiv.11454321 ◽

2020 ◽

Author(s):

Abhishek Verma ◽

Virender Ranga

Keyword(s):

Internet Of Things ◽

Intrusion Detection ◽

Ensemble Learning ◽

Intrusion Detection System ◽

Detection System ◽

Smart Devices ◽

Network Intrusion Detection ◽

The Internet ◽

Routing Attacks ◽

Network Intrusion

Internet of Things is realized by a large number of heterogeneous smart devices which sense, collect and share data with each other over the internet in order to control the physical world. Due to open nature, global connectivity and resource constrained nature of smart devices and wireless networks the Internet of Things is susceptible to various routing attacks. In this paper, we purpose an architecture of Ensemble Learning based Network Intrusion Detection System named ELNIDS for detecting routing attacks against IPv6 Routing Protocol for Low-Power and Lossy Networks. We implement four different ensemble based machine learning classifiers including Boosted Trees, Bagged Trees, Subspace Discriminant and RUSBoosted Trees. To evaluate proposed intrusion detection model we have used RPL-NIDDS17 dataset which contains packet traces of Sinkhole, Blackhole, Sybil, Clone ID, Selective Forwarding, Hello Flooding and Local Repair attacks. Simulation results show the effectiveness of the proposed architecture. We observe that ensemble of Boosted Trees achieve the highest Accuracy of 94.5% while Subspace Discriminant method achieves the lowest Accuracy of 77.8% among classifier validation methods. Similarly, an ensemble of RUSBoosted Trees achieves the highest Area under ROC value of 0.98 while lowest Area under ROC value of 0.87 is achieved by an ensemble of Subspace Discriminant among all classifier validation methods. All the implemented classifiers show acceptable performance results.

Download Full-text

Routing Attacs pada Internet Of Things Berbasis Smart Intrution Detecion System

Jurnal Teknologi Informasi dan Ilmu Komputer ◽

10.25126/jtiik.2020721926 ◽

2020 ◽

Vol 7 (2) ◽

pp. 329

Author(s):

Eka Lailatus Sofa ◽

Subiyanto Subiyanto

Keyword(s):

Machine Learning ◽

Feature Selection ◽

Internet Of Things ◽

Intrusion Detection ◽

Intrusion Detection System ◽

Learning Algorithm ◽

Detection System ◽

Machine Learning Algorithms ◽

Machine Learning Algorithm ◽

Routing Attacks

Internet of Things (IoT) telah memasuki berbagai aspek kehidupan manusia, diantaranya smart city, smart home, smart street, dan smart industry yang memanfaatkan internet untuk memantau informasi yang dibutuhkan. Meskipun sudah dienkripsi dan diautentikasi, protokol jaringan <a title="IPv6" href="https://en.wikipedia.org/wiki/IPv6">IPv6</a> over Low-Power Wireless <a title="Personal area network" href="https://en.wikipedia.org/wiki/Personal_area_network">Personal Area Networks</a> (6LoWPAN) yang dapat menghubungkan benda-benda yang terbatas sumber daya di IoT masih belum dapat diandalkan. Hal ini dikarenakan benda-benda tersebut masih dapat terpapar oleh routing attacks yang berasal dari jaringan 6LoWPAN dan internet. Makalah ini menyajikan kinerja Smart Intrusion Detection System berdasarkan Compression Header Analyzer untuk menganalisis model routing attacks lainnya pada jaringan IoT. IDS menggunakan compression header 6LoWPAN sebagai fitur untuk machine learning algorithm dalam mempelajari jenis routing attacks. Skenario simulasi dikembangkan untuk mendeteksi routing attacks berupa selective forwarding attack dan sinkhole attack. Pengujian dilakukan menggunakan feature selection dan machine learning algorithm. Feature selection digunakan untuk menentukan fitur signifikan yang dapat membedakan antara aktivitas normal dan abnormal. Sementara machine learning algorithm digunakan untuk mengklasifikasikan routing attacks pada jaringan IoT. Ada tujuh machine learning algorithm yang digunakan dalam klasifikasi antara lain Random Forest, Random Tree, J48, Bayes Net, JRip, SMO, dan Naive Bayes. Hasil percobaan disajikan untuk menunjukkan kinerja Smart Intrusion Detection System berdasarkan Compression Header Analyzer dalam menganalisis routing attacks. Hasil evaluasi menunjukkan bahwa IDS ini dapat mendeteksi antara serangan dan non-serangan. AbstractInternet of Things (IoT) has entered various aspects of human life including smart city, smart home, smart street, and smart industries that use the internet to get the information they need. Even though it's encrypted and authenticated, Internet protocol <a title="IPv6" href="https://en.wikipedia.org/wiki/IPv6">IPv6</a> over Low-Power Wireless <a title="Personal area network" href="https://en.wikipedia.org/wiki/Personal_area_network">Personal Area Networks</a> (6LoWPAN) networks that can connect limited resources to IoT are still unreliable. This is because these objects can still be exposed to attacks from 6LoWPAN and the internet. This paper presents the performance of an Smart Intrusion Detection System based on Compression Header Analyzer to analyze other routing attack models on IoT networks. IDS uses a 6LoWPAN compression header as a feature for machine learning algorithms in learning the types of routing attacks. Simulation scenario was developed to detect routing attacks in the form of selective forwarding and sinkhole. Testing is done using the feature selection and machine learning algorithm. Feature selection is used to determine significant features that can distinguish between normal and abnormal activities. While machine learning algorithm is used to classify attacks on IoT networks. There were seven machine learning algorithms used in the classification including Random Forests, Random Trees, J48, Bayes Net, JRip, SMO, and Naive Bayes. Experiment Results to show the results of the Smart Intrusion Detection System based on Compression Header Analyzer in analyzing routing attacks. The evaluation results show that this IDS can protect between attacks and non-attacks.

Download Full-text

ELNIDS: Ensemble Learning based Network Intrusion Detection System for RPL based Internet of Things

10.36227/techrxiv.11454321.v1 ◽

2020 ◽

Author(s):

Abhishek Verma ◽

Virender Ranga

Keyword(s):

Internet Of Things ◽

Intrusion Detection ◽

Ensemble Learning ◽

Intrusion Detection System ◽

Detection System ◽

Smart Devices ◽

Network Intrusion Detection ◽

The Internet ◽

Routing Attacks ◽

Network Intrusion

Internet of Things is realized by a large number of heterogeneous smart devices which sense, collect and share data with each other over the internet in order to control the physical world. Due to open nature, global connectivity and resource constrained nature of smart devices and wireless networks the Internet of Things is susceptible to various routing attacks. In this paper, we purpose an architecture of Ensemble Learning based Network Intrusion Detection System named ELNIDS for detecting routing attacks against IPv6 Routing Protocol for Low-Power and Lossy Networks. We implement four different ensemble based machine learning classifiers including Boosted Trees, Bagged Trees, Subspace Discriminant and RUSBoosted Trees. To evaluate proposed intrusion detection model we have used RPL-NIDDS17 dataset which contains packet traces of Sinkhole, Blackhole, Sybil, Clone ID, Selective Forwarding, Hello Flooding and Local Repair attacks. Simulation results show the effectiveness of the proposed architecture. We observe that ensemble of Boosted Trees achieve the highest Accuracy of 94.5% while Subspace Discriminant method achieves the lowest Accuracy of 77.8% among classifier validation methods. Similarly, an ensemble of RUSBoosted Trees achieves the highest Area under ROC value of 0.98 while lowest Area under ROC value of 0.87 is achieved by an ensemble of Subspace Discriminant among all classifier validation methods. All the implemented classifiers show acceptable performance results.

Download Full-text