Authorisation, attack detection and avoidance framework for IoT devices. Issue 5 (1st September 2020)

• Record Type: Journal Article
• Authors: Sudhakaran, Pradeep; Malathy, Chidambaranathan
• Is Part Of: IET networks. Volume 9:Issue 5(2020)
• Page Start: 209
• Page End: 214
• Publication Date: 2020-09-01
• Subjects: Internet of Things -- computer network security -- support vector machines -- authorisation -- learning (artificial intelligence); traffic collection agent -- packet level -- flow level information -- detection agent -- attack rules table -- matching attack pattern -- response agent -- attack frequency -- detection accuracy -- IoT devices -- anomaly detection techniques -- supervised machine learning technique -- Internet of Things -- high false positives -- authorisation, attack detection and avoidance framework -- AAA framework -- multiclass support vector machine algorithm; Computer network architectures -- Periodicals; Computer network protocols -- Periodicals; Information networks -- Periodicals; Telecommunication systems -- Periodicals; 004.605
• DOI: 10.1049/iet-net.2019.0167
• Languages: English
• ISSNs: 2047-4954

Abstract

Abstract : Internet of Things (IoT) involve large volumes of data generated from the interactions between devices and people, and security is a main alarm in IoT. Most of the anomaly detection techniques in IoT use supervised machine learning technique which involve huge overhead and high false positives. It is observed that severity of attack response was not considered. In this study, the authors propose to develop an authorisation, attack detection and avoidance framework for IoT devices. Initially, traffic collection agent continuously gathers packet level and flow level information for a given time interval. Then detection agent (DA) first checks the collected information with the attack rules table. If any matching attack pattern is found, it informs the attack type to response agent (RA). On the other hand, if no matching pattern is found, then the classification agent applies multi‐class support vector machine algorithm. Once the RA obtains the attack type from DA, then it estimates the severity of attack by computing the attack frequency over different time windows and appropriate action will be performed. Experimental results show that the proposed framework reduces 13% of unauthorised access and 19% false positive rate thereby increasing the detection accuracy by 0.6% and throughput.