ML-Augmented Network Packet Broker based Anomaly Detection at IIoT-Edge Egress Port
Sasirekha GVK, Annapoorna GH, Madhav Rao, Jyotsna L. Bapat, Debabrata Das · 2023
Industrial Internet of Things (IIoT) refers to networked entities like smart sensors, actuators, computers, etc., deployed to enhance the manufacturing and industrial processes. However, an IIoT system needs to be ethically designed to build the trust of the users. Privacy and security form the technological basis for trustworthiness of any IoT system. One of the important security tools is an Intrusion Detection System (IDS), and it involves detection of system’s deviations from expected behavior. In this paper, a novel Network Packet Broker (NPB) based anomaly detector positioned at the egress port of the edge device of an IoT system is proposed. The proposed system combines the advantages of an NPB capable of detecting signature based anomalies on high speed zero packet dropped data, with the flexibility of adding ML algorithms applied on the features extracted from the captured data. The proposed anomaly detector system has been tested successfully for monitoring the egress traffic of the edge for a client-server REST application, using an experimental setup in a lab. An ingenious feature of the setup is that the anomalies in the normal traffic have been introduced using an off the shelf Ethernet tester. The performance of the system has been evaluated with varying severity levels of anomalies, measured in terms of bandwidth of the traffic generated by the Ethernet tester. The results showing the accuracies of the anomaly detection using a set of ML classifiers, are presented, to demonstrate the feasibility of the system for any vertical of IIoT.