ML-Based Intrusion Detection Systems in IoT Networks: A Survey
Dina Mohamed Abdelhameed, Abdel-Rahman Hedar, Basem Mohamed Elomda, Hesham Ahmed Hassan · 2023
The Internet of Things (IoT) is a network that connects numerous autonomous and heterogeneous smart nodes, enabling them to interact with each other autonomously, without requiring human intervention. In recent times, there has been a growing use of IoT systems to augment the overall user experience in multiple industries such as education, transportation, traffic management, monitoring, and utility services. However, the presence of node heterogeneity has given rise to security concerns, which pose significant challenges within the realm of the IoT. The utilization of intrusion detection systems (IDS) has significantly contributed to the enhancement of network and information system security. However, the IoT presents several distinctive characteristics, such as resource limitations in devices, diverse protocol stacks, and varying standards. Consequently, the application of a conventional IDS strategy to the IoT context becomes a tough task. This paper presents the different types of IoT and related networks and discusses the characteristics of IoT network types, structures, types of attacks, and how to prevent attacks. Moreover, the paper discusses the advantages and disadvantages of IoT architectures, IoT networks’ cyber-attack vulnerabilities, and how to secure the IoT. Characteristics detection methods, IDS deployment strategies, security threats, and validation strategies are also categorized as suggested in the literature. The paper also discusses a range of potential outcomes for IoT characteristics and provides in-depth analysis of studies that either propose particular IDS frameworks for IoT or devise ways for detecting IoT threats that IDSs may obscure. The results obtained include an assessment of multiple machine learning algorithms on the CICIDS2017 dataset, with a specific emphasis on comparing their accuracy and investigating innovative combinations of algorithms for the purpose of intrusion detection.