IoTBoT-IDS: A novel statistical learning-enabled botnet detection framework for protecting networks of smart cities. (September 2021)

• Record Type: Journal Article
• Authors: Ashraf, Javed; Keshk, Marwa; Moustafa, Nour; Abdel-Basset, Mohamed; Khurshid, Hasnat; Bakhshi, Asim D.; Mostafa, Reham R.
• Is Part Of: Sustainable cities and society. Volume 72(2021)
• Publication Date: 2021-09
• Subjects: IoT -- Sustainable smart cities -- Statistical learning -- Botnet attacks -- Intrusion detection system -- Anomaly detection -- Beta mixture model -- Correntropy; Sustainable urban development -- Periodicals; Sustainable buildings -- Periodicals; Urban ecology (Sociology) -- Periodicals; 307.76
• DOI: 10.1016/j.scs.2021.103041
• Languages: English
• ISSNs: 2210-6707

Abstract

Highlights: We propose a statistical learning-based anomaly detection framework, named IoTBoT-IDS, which can effectively discover botnets from networks of smart cities. We develop a lightweight statistical feature extraction model that represents the network data and improves botnet classification. We develop a BMM-Correntropy method for efficiently discovering botnets from IoT-based networks of smart cities. We evaluated the proposed framework using three benchmark network datasets gathered from IoT devices, infected by various types of malware including BASHLITE and Mirai botnets. Abstract: The rapid proliferation of the Internet of Things (IoT) systems, has enabled transforming urban areas into smart cities. Smart cities' paradigm has resulted in improved quality of life and better services to citizens, like smart healthcare, smart parking, smart transport, smart buildings, smart homes, and so on. One of the major challenges of IoT devices is the limited capacity of their battery because the devices consume a large amount of energy once they communicate with each other. Furthermore, the IoT-based smart systems would contain sensitive data about network systems, introducing serious privacy and security issues. IoT-based smart systems are highly exposed to botnet attacks. Examples of such attacks are Mirai and BASHLITE malware launched from compromised surveillance devices, which are common in smart cities, resulting in paralysis of Internet-based services through distributed denial of service (DDoS) attacks. Such DDoS attacks on IoT devices and their networks further threaten the emerging concept of sustainable smart cities. To discover such cyberattacks, this paper proposes a novel statistical learning-based botnet detection framework, called IoTBoT-IDS, which protects IoT-based smart networks against botnet attacks. IoTBoT-IDS captures the normal behavior of IoT networks by applying statistical learning-based techniques, using Beta Mixture Model (BMM) and a Correntropy model. Any deviation from the normal behavior is detected as an anomalous event. To evaluate IoTBoT-IDS, three benchmark datasets generated from realistic IoT networks were used. The evaluation results showed that IoTBoT-IDS effectively identifies various types of botnets with an average detection accuracy of 99.2%, which is higher by about 2–5% compared with compelling intrusion detection methods, namely AdaBoost ensemble learning, fuzzy c-means, and deep feed forward neural networks.