Towards a Lightweight Detection System for Cyber Attacks in the IoT Environment Using Corresponding Features
Towards a Lightweight Detection System for Cyber Attacks in the IoT Environment Using Corresponding Features
复制标题
DOI：
10.3390/electronics9010144
复制
发表时间：
2020-01-01
期刊：
影响因子：
2.9
通讯作者：
Sakurai, Kouichi
中科院分区：
文献类型：
--
作者：
Soe, Yan Naung;Feng, Yaokai;Sakurai, Kouichi
大量物联网（IoT）设备的应用使我们的生活更加便利，行业更加高效。然而，这也使得网络攻击更容易发生，因为部署了如此多的物联网设备，其中大多数没有足够的资源（即，计算和存储容量）来执行普通的入侵检测系统（IDS）。在这项研究中，一个轻量级的基于机器学习的IDS使用一种新的特征选择算法的设计和实现树莓派，其性能进行了验证，使用从物联网环境收集的公共数据集。为了使系统的轻量级，我们提出了一个新的算法进行特征选择，称为相关集阈值增益比（CST-GR）算法，选择真正必要的功能。由于特征选择是在三种特定类型的网络攻击上进行的，因此所选特征的数量可以显着减少，这使得分类器非常小和快速。因此，我们的检测系统足够轻量级，可以在Raspberry Pi系统中实现和执行。更重要的是，由于利用了对应于每种攻击的真正必要的特征，因此可以预期良好的检测性能。我们使用不同的机器学习算法详细检查了我们的建议的性能，以便了解其中哪一个是我们系统的最佳选择。实验结果表明，新的特征选择算法可以选择只有很少的特征，每种攻击。因此，检测系统足够轻量级，可以在Raspberry Pi环境中实现，几乎不会牺牲检测性能。
The application of a large number of Internet of Things (IoT) devices makes our life more convenient and industries more efficient. However, it also makes cyber-attacks much easier to occur because so many IoT devices are deployed and most of them do not have enough resources (i.e., computation and storage capacity) to carry out ordinary intrusion detection systems (IDSs). In this study, a lightweight machine learning-based IDS using a new feature selection algorithm is designed and implemented on Raspberry Pi, and its performance is verified using a public dataset collected from an IoT environment. To make the system lightweight, we propose a new algorithm for feature selection, called the correlated-set thresholding on gain-ratio (CST-GR) algorithm, to select really necessary features. Because the feature selection is conducted on three specific kinds of cyber-attacks, the number of selected features can be significantly reduced, which makes the classifiers very small and fast. Thus, our detection system is lightweight enough to be implemented and carried out in a Raspberry Pi system. More importantly, as the really necessary features corresponding to each kind of attack are exploited, good detection performance can be expected. The performance of our proposal is examined in detail with different machine learning algorithms, in order to learn which of them is the best option for our system. The experiment results indicate that the new feature selection algorithm can select only very few features for each kind of attack. Thus, the detection system is lightweight enough to be implemented in the Raspberry Pi environment with almost no sacrifice on detection performance.