Abstract

     Today, industry 4.0 is becoming a major target for cybercriminals due to its hyper-connectivity. Fortunately, there are several advanced means of securing industrial systems such as Intrusion Detection Systems (IDS). However, one of the main limitations of industrial IDS is the high rate of false positives and how to distinguish a real attack from an industrial failure. This paper deals precisely with the two latter points and proposes a way to reduce the rate of false positives and to distinguish attacks from industrial failures. The proposed approach combines two kinds of IDS using Neural Network (NN) through a Decision Making System (DMS). It was tested on a real industrial environment. The performance results are promising with a high percentage of accuracy and a low false positive rate.

Introduction

     Nowadays, Industrial Control Systems (ICS) exist in many different industrial sectors such as meatpacking, chemistry, construction, automotive, electronics industry. But also in vital industrial sectors such as energy, health, military and food sectors. Therefore, the suspension or the stopping of these systems could be costly for industrialists and cause consequent damage. Today, securing such equipment becomes more than necessary. Over the past decade, industry has become the center of attackers’ focus and has been the victim of several attacks starting with Stuxnet, Black Energy, WannaCry. This wave of attacks has been succeeded by several ransomware attacks in 2020 during the coronavirus pandemic, especially with the increase in the number of remote workers and a lack of security in this new working model [1]. Kaspersky’s ICS CERT researchers forecast a list of attacks likely to target industries in 2023 [2]. Among these attacks are phishing pages and emails, Torjans, N-day vulnerabilities, attacks on cloud services, exploiting vulnerabilities in legitimate software, the spread of malware via removable media …

This cyber-criminality phenomenon is favored with the emergence of the industry 4.0. This 4th industrial revolution is characterized by the convergence of the worlds of Information Technology (IT) and Operation Technology (OT), the huge amount of generated data, the use of Cloud as new storage means. All these reasons increase the risk of cyber attacks in industry.

Fortunately, there are several solutions to secure the industry and its equipment. Among these mechanisms, we mention firewalls, anti-virus, auditing processes and IDS. Each of these securing mechanisms has a specific role such as detecting and removing malware, preventing unauthorized access or detecting intrusions by IDS. These latter give visibility to the system’s activities, which allows a timely detection and response to any suspicious events [3], [4].

Conclusions

     BIANO-IDS is a new intrusion detection approach combining two kinds of IDS: anomaly-based IDS and specification-based IDS. The approach has been tested on a real environment and the detection accuracy rate is high in addition to the different performance metrics. However, to further improve performance metrics, we intend to explore other traces such as system logs and apply reduction or selection features methods in the future to improve the computation and training time of neural networks.

Abstract

     Technology is pivotal in the rapid growth of services and intensifying the quality of life. Recent technology, like the Internet of Things (IoT), demonstrates an impressive performance in fast-forward development. Intrusion Detection System (IDS) is used as a lifeline to prevent attacks by classifying the activities as normal and suspicious. In this paper, we propose a two-phase IDS for IoT. In the first phase, we categorize data into four sections according to the data types (i.e., nominal, integer, binary, and float). We then classify them using different versions of the Naive Bayes classifier. After that, we use majority voting to choose the final result of the classification. In the second phase, we pass those data which behave normally or are benign in the first phase and classify them using an unsupervised elliptic envelope. We validated our work using the standard NSL-KDD, UNSW_NB15, and CIC-IDS2017 datasets. We found the proposed method more efficient than existing IDS techniques and achieved reasonable accuracy in the first phase. Furthermore, the benign data is sent to the second phase of the analysis. After the second phase, we achieved a 97% accuracy in the NSL-KDD dataset, 86.9% in the UNSW_NB15 dataset, and 98.59% accuracy in the CIC-IDS2017 dataset.

Introduction

     In the evolutionary era, the Internet has always been performing a most significant role. Globally, the total estimate of Internet users is projected to increase from 3.9 billion in 2018 to 5.3 billion by 2023, as stated by Cisco Annual Internet Report [1]. Furthermore, the Internet of Things (IoT) is becoming increasingly widespread. IoT integrates many heterogeneous objects (such as in a smart home: intelligent bulbs, refrigerators, fans, air conditioners, automated doors, and TVs.) with various connecting technologies such as Bluetooth Low Energy (BLE), WiFi, and ZigBee. There are also other domains and applications in which the IoT can play an important role and enhance our lives quality. These applications include smart transportation, industrial automation, agriculture, and healthcare [2].

     The IoT model [3] has been emerging towards formulating a cyber–physical environment where everything can be found, operated, investigated, and modernized. Because of being connected, the chances of attacks on the network increase. Many attacks and malicious incidents can affect different layers of the IoT architecture, creating security concerns. Makhdoom et al. [4] discussed the commonly known attacks on different layers, depending on the anatomy of the malware, and IoT-enabled cyber-attacks are also illustrated in a survey [5]. Similarly, Zarpel et al. [6] elaborated on intrusion detection systems in IoT. They have classified IDS based on placement strategies, detection methods, security threats, and validation strategies. Zargar et al. [7] explained in detail about Distributed Denial of Service (DDoS) attacks and also classified the countermeasures.

Conclusion

     This paper presents a machine learning-based two-phase IDS. Firstly, we categorize data into four sections according to the data types (e.g., nominal, integer, binary, and float). Then classify them using different versions of the Naive Bayes classifier. After that, with the help of majority voting, we choose the final result of the classification. In the second phase, we pass those data which behave like normal in the first stage, and these data are classified using an unsupervised elliptic envelope. It draws an imaginary envelope and assigns value 1, which lies inside the Envelope, and −1 outside the Envelope. Our proposed model is also performing very well in the imbalanced distribution of the data by providing the weight initialization to each class. Finally, we got an overall 97% accuracy with a meager false positive rate. The drawback of this model is that it does not work pretty in multiclass classification.

     In future work, we will improve the multiclass classification and feature engineering techniques model, expand this procedure in real-time for network traffic analysis, and evaluate performance. We will further attempt to capture network data by deploying IoT devices in the real world. Moreover, the IDS system will detect malicious incidents in real-time and immediately take appropriate action to prevent damage.

Abstract

The use of computers and the internet has spread rapidly over the course of the past few decades. Every day, more and more people are coming to rely heavily on the internet. When it comes to the field of information security, the subject of security is one that is becoming an increasingly important focus. It is vital to design a powerful intrusion detection system in order to prevent computer hackers and other intruders from effectively getting into computer networks or systems. This can be accomplished by: (IDS). The danger and attack detection capabilities of the computer system are built into the intrusion detection system. Abuse has occurred and can be used to identify invasions when there is a deviation between a preset pattern of intrusion and an observed pattern of intrusion. An intrusion detection system (IDS) is a piece of hardware (or software) that is used to generate reports for a Management Station as well as monitor network and/or system activities for unethical behaviour or policy violations. In the current study, an approach known as machine learning is suggested as a possible paradigm for the development of a network intrusion detection system. The results of the experiment show that the strategy that was suggested improves the capability of intrusion detection.

Introduction

Over the past few years, there has been an increase in the usage of computer systems to make the lives of consumers easier and more convenient. When people try to takeadvantage of the amazing capabilities and processing capacity of computer systems, however, security has been one of the most significant problems in the field of computer science. This is because attackers frequently try to break into systems and act maliciously, such as stealing vital information from a corporation, rendering the systems useless, or even destroying the systems. Internal attacks, such as pharming, distributed denial-of-service (DDoS), eavesdropping, and spear-phishing attempts, are often among the most difficult to identify of all well-known attacks. This is due to the fact that firewalls and intrusion detection systems (also known as IDSs) often guard against attacks from the outside. At this time, the majority of systems authenticate users by analysing a login pattern consisting of the user ID and password. As a result of this, we have proposed in this study a security solution that we have dubbed the Internal Intrusion Detection and Protection System (IIDPS) [1]. This solution recognises hostile or malicious behaviour carried out against a system at the System call level. IIDPS uses data mining and forensic profiling techniques in order to mine system call patterns, also known as SC-patterns, which are the longest system call sequences (SC-sequences) that have repeatedly appeared numerous times in a user’s log file for the user. SC-patterns can be used to identify malicious activity. The user’s computer usage history is used to compile the user’s forensic features, which are then defined as a SCpattern that commonly appears in the user’s own submitted SCsequences but is rarely utilised by other users. This information is gleaned from the user’s computer.

Conclusion

As a consequence of this, within this work, we suggest asecurity system that we refer to as the Internal Intrusion Detection and Protection System (IIDPS). This system is capable of identifying hostile behaviour that is aimed towardsa system at the SC level. The IIDPS minessystem call patterns, also known as SC-patterns, which are defined as the longest system call sequences (System Call-sequences) that have repeatedly appeared numerous times in a user’s log file for the user. These are the operations carried out by the user, such as sending a file, updating a file, or viewing a file, and they are validated by an administrator. The user’s computer usage history is used to compile the user’s forensic features, which are then defined as a SC-pattern that commonly appearsin the user’s own submitted SC-sequences but is rarely utilised by other users. This information is gleaned from the user’s computer.

Abstract

     With the rapid development of the Internet of Things (IoT), there are several challenges pertaining to security in IoT applications. Compared with the characteristics of the traditional Internet, the IoT has many problems, such as large assets, complex and diverse structures, and lack of computing resources. Traditional network intrusion detection systems cannot meet the security needs of IoT applications. In view of this situation, this study applies cloud computing and machine learning to the intrusion detection system of IoT to improve detection performance. Usually, traditional intrusion detection algorithms require considerable time for training, and these intrusion detection algorithms are not suitable for cloud computing due to the limited computing power and storage capacity of cloud nodes; therefore, it is necessary to study intrusion detection algorithms with low weights, short training time, and high detection accuracy for deployment and application on cloud nodes. An appropriate classification algorithm is a primary factor for deploying cloud computing intrusion prevention systems and a prerequisite for the system to respond to intrusion and reduce intrusion threats. This paper discusses the problems related to IoT intrusion prevention in cloud computing environments. Based on the analysis of cloud computing security threats, this study extensively explores IoT intrusion detection, cloud node monitoring, and intrusion response in cloud computing environments by using cloud computing, an improved extreme learning machine, and other methods. We use the Multi-Feature Extraction Extreme Learning Machine (MFE-ELM) algorithm for cloud computing, which adds a multi-feature extraction process to cloud servers, and use the deployed MFE-ELM algorithm on cloud nodes to detect and discover network intrusions to cloud nodes. In our simulation experiments, a classical dataset for intrusion detection is selected as a test, and test steps such as data preprocessing, feature engineering, model training, and result analysis are performed. The experimental results show that the proposed algorithm can effectively detect and identify most network data packets with good model performance and achieve efficient intrusion detection for heterogeneous data of the IoT from cloud nodes. Furthermore, it can enable the cloud server to discover nodes with serious security threats in the cloud cluster in real time, so that further security protection measures can be taken to obtain the optimal intrusion response strategy for the cloud cluster.

Introduction

     With the extension and expansion of Internet technology, the Internet of Things (IoT), as an important information technology, promotes the intelligent development of modern society. Intelligent IoT applications are being gradually popularized in daily life and industrial development, such as intelligent logistics, transportation, security, medical treatment, homes, and agriculture. The centralized processing mode of cloud computing is to upload all pending transactions to the cloud for execution, and the cloud uses computing resources, storage capacity, and transmission bandwidth to process all service requests sent by end users. The IoT refers to connecting any object with the network through information sensing equipment and according to the agreed protocol. Objects exchange and communicate information through information media to realize the functions of intelligent identification, positioning, tracking, supervision, and so on. The number of global IoT device connections has increased annually, and according to forecasts, the growth rate will gradually stabilize at 15%. Furthermore, data transmission, processing, and storage will add more load to cloud services. Mobile and sensor devices connected to the edge of the Internet are constantly generating new data with diverse data types [1], which will lead to great challenges in the computing resources and transmission bandwidth of traditional network architecture. At the same time, for IoT applications that require low network latency, such as automatic driving, if the traditional calculation is used as the operation model, low latency cannot be achieved, and thus the vehicle cannot make real-time decisions to avoid risk in the case of emergency braking. The tasks to be processed by the terminal equipment require strong real-time performance, i.e., the tasks must complete data transmission, analysis, and processing with minimum delay, which conflicts with the processing method of the traditional computing model. In summary, in this highly information-based era, the IoT faces multiple severe challenges: a large amount of data redundancy, cloud processing capacity bottlenecks, network bandwidth limits, data security and privacy, increased cloud power load, and increased task processing delays [2]. Intrusion detection technology is an active security protection technology. According to the different methods of data analysis, IoT intrusion detection systems can be divided into anomaly intrusion detection and misuse intrusion detection. Anomaly intrusion detection is an attack or malicious behavior that occurs when the host data in the network or the entire network does not conform to normal data specifications. Misuse intrusion detection refers to modeling certain specific attack models, determining the characteristic behavior of the attack, and matching it with the current behavior. A successful match represents malicious behavior [3]. The above problems are caused by limitations in the development of the IoT data processing mode and the increasing requirements for service quality for processing operations. The cloud collaborative network architecture has brought the terminal service quality to a new development stage and promoted fast-paced technology development. The optimization of task scheduling and application module mapping is a key problem in cloud computing, which plays an important role in the performance and power optimization of network architecture. Therefore, designing an efficient scheme and algorithm for IoT intrusion detection, task scheduling, and application module mapping is the key to improving the overall performance of the IoT architecture, which is of great research significance.

Conclusion and future work

     The IoT is a complex, dynamic environment, which poses new challenges to the deployment and algorithm performance of IoT intrusion detection. Based on the research of cloud-based IoT defense architecture, this study focused on cloud computing intrusion detection algorithms and measurement models. Considering the resource constraints of cloud nodes and the high complexity of the network environment, a measurement model of IoT intrusion detection in a cloud computing environment is proposed, and an MFE-ELM algorithm of a limit learning machine with multi-feature extraction is proposed. Experimental simulations verified the training time and detection accuracy of the proposed algorithm. In the experiment, the MFE-ELM algorithm showed good performance in cloud computing, especially in terms of accuracy and time efficiency. Through several experiments, it was proved that the MFE-ELM is an intrusion detection algorithm suitable for cloud computing environments.

Abstract

Modern wireless technology demands the implementation of preset Sensor nodes for a structured wireless network. The network has sensor nodes for surveillance or environmental sensing, which wirelessly transmit data to a collection point. Therefore, data transfer must be protected by preventing external intrusion attacks. This will be handled by designing an effective intrusion detection system proposed as a Composite Intrusion detection system (CIDS). It is suitable for a network in heterogeneous network structure with a capable of identifying externals attacks like flooding of data’s, sending unwanted data packets and changing the destination node. For routing of data packets between the nodes, minimum power utilization with changeable cluster heading method is used. The activities of sensor nodes will be monitored and a dataset is formed on the basis of the node’s activity. It is known as Network Databases (NDB). Using this dataset, the intrusion attacks will be identified by using Artificial Neural Network (ANN). ANN will be trained with a predefined dataset for the effective identification of external attacks. The proposed CIDS methodology shows the high accuracy of identifying the external attacks on the sensor networks when comparing to the previous designed system in all the types of attacks.

INTRODUCTION

Wireless based sensors networks is a revolutionary invention in the modern era used for all types of application like surveillance in military application, collection of healthrelated data in medical field [1]. It has set of distribution sensor nodes in an application area for sensing the data with a predefined geographic location. The location of nodes will be decided on the basis of XY co-ordinates. The sensor nodes have to collect the sensing data from their corresponding location and passed to a cluster head. The head nodes will make effective data aggregation method and passed the concern data to base station [2]. The data transmission will be done by using any of the routing protocols and it should be secured from the external threat. Also, the power backup of the sensor is a tradeoff between the data transmission and securing the data from the threats [4]. The data packets routing is depicted in figure 1.

As the sensor nodes are in open area and the data transmission will be carried over in an open platform with limited network resources, the chances on injection of threats will be high. In spite the position of nodes is a heterogeneous network, chances on threats will be high [5].

CONCLUSION

The fundamental purpose of the CIDS is to identify external threats and their nature before they penetrate the network’s structure. As a result of the excellent implementation of data packet routing, detection is performed efficiently with the aid of a changing cluster heading node and low power consumption of sensor nodes. As the CIDS identify risks utilizing artificial neural networks, its efficiency is superior to that of existing specified research networks. The sort of external attacks recognized by the planned CIDS flooding of Data’s unscheduled data transmission is a significant factor. This is because data flooding reduces network efficiency and causes a significant amount of network resources to be squandered. By providing the correct data set during the training phase of neural networks, this threat detection can be modified. This is done on a periodic basis to acquire the node activity dataset. Therefore, the suggested system is capable of identifying external threats and their categories in the shortest time possible, with advance notification to all other networks on the sorts of threats found.

Abstract

1. Introduction

2. Related work

3. Phases of filtered deep learning model for intrusion detection

4. Result and discussion

5. Conclusion

Declaration of Competing Interest

References

Abstract

     Distributed Sensor Networks play a vital role in the day-to-day world of computing applications, from the cloud to the Internet of Things (IoT). These computing applications devices are normally attached with the microcontrollers like Sensors, actuators, and Adriano network connectivity. Defensive network with an Intrusion Detection System thus serves as the need of modern networks. Despite decades of inevitable development, the Intrusion Detection System is still a challenging research area as the existing Intrusion Detection System operates using signature-based techniques rather than anomaly detection. The existing Intrusion Detection System are thus facing challenges for improvement in Intrusion Detection, Handling heterogeneous data sources is hard for discovering zero-day attacks in IoT networks. This paper presents Filtered Deep Learning Model for Intrusion Detection with a Data Communication approach. The proposed model is composed of five phases: Initialization of Sensor Networks, Cluster Formation in addition to Cluster Head Selection, Connectivity, Attack Detection, and Data Broker. The proposed Model for Intrusion Detection was found to outperform the existing Deep Learning Neural Network and Artificial Neural Network. Experimental results showed a better result of 96.12% accuracy than the dominant algorithms.

Introduction

     In current years, cloud computing (CC) is getting increasingly well-liked in educational along with commercial places [1], in addition, its function is also largely accepted for data storage along with retrieval on the cloud environment [2]. For the basis of increasing the number of data on the Cloud servers(CS), the cloud storage consent to store data in numerous inaccessible sites typically hold by “top” business and running their owner solutions, e.g., Google Drive, Dropbox, Amazon Simple Cloud Storages Service (S3) [3] that means the data is amassed distributive. Even if numerous attractive advances to data gathering were developed in the past decade, it still stays as a research focus in full sway with several significant challenges. Certainly, the incessant decrease in sensor size along with cost, the diversity of sensors present on the marketplace together with the incredible progress on Sensor Node communication technologies have expanded potentially the effect of IoT [4].

     IoT comprises SN that is able to compute, sense together with communicate the data by particular communication [5]. For sensing, the SN are utilized, in addition, for computation, numerous algorithms are utilized, at last, for the communication, disparate communication protocols are utilized, for instance, Building Automations and Control Network (BACnet), Distributed Network Protocols version 3 (DNP3) [6], Constrained Application Protocol (CoAP) [7], Message Queue Telemetry Transports (MQTT) [8], together with XMPP (Extensible Messaging and Presences Protocol), AQMP, et cetera, [9]. By utilizing these protocols, the data is amassed.

Conclusion

     DC and effective cloud storage is a challenging one. Many existing works are putting their effort to give a better system. This paper presented a DC and effective distributed cloud storage system centered on the IDS using the FDLNN algorithm. For IDS, the proposed system uses the FDLNN algorithm, and for the data broker, uses the LFEHO algorithm, and for DC, the MQTT and AQMP connectivity are used. The MQTT is best for lightweight devices, and the AQMP is best for the heavyweight devices. For the IDS analysis, the TON_IoT datasets is taken and the performance of the FDLNN is compared with the existing DLNN and ANN algorithms based on the precision, recall, F-Measure, and accuracy. Then, the performance of the data broker is analyzed, for which the proposed LFEHO is compared with the existing IANFIS and ANFIS algorithm based on average turnaround time, throughput, process time, response time as well as AWT. The IDS performance is analyzed based on SNs count and the data broker is analyzed grounded on the number of data. For 500 nodes, the FDLNN has 96.12% accuracy. In data broker analysis for all data count, the proposed LFEHO attained better performance. Hence, the proposed system is found to attain excellent performance on considering the existing algorithms.

Abstract

     Sharing threat events and Indicators of Compromise (IoCs) enables quick and crucial decision making relative to effective countermeasures against cyberattacks. However, the current threat information sharing solutions do not allow easy communication and knowledge sharing among threat detection systems (in particular Intrusion Detection Systems (IDS)) exploiting Machine Learning (ML) techniques. Moreover, the interaction with the expert, which represents an important component to gather verified and reliable input data for the ML algorithms, is weakly supported. To address all these issues, ORISHA, a platform for ORchestrated Information SHaring and Awareness enabling the cooperation among threat detection systems and other information awareness components, is proposed here. ORISHA is backed by a distributed Threat Intelligence Platform based on a network of interconnected Malware Information Sharing Platform instances, which enables the communication with several Threat Detection layers belonging to different organizations. Within this ecosystem, Threat Detection Systems mutually benefit by sharing knowledge that allows them to refine the underlying predictive accuracy. Uncertain cases, i.e. examples with low anomaly scores, are proposed to the expert, who acts with the role of oracle in an Active Learning scheme. By interfacing with a honeynet, ORISHA allows for enriching the knowledge base with further positive attack instances and then yielding robust detection models. An experimentation conducted on a well-known Intrusion Detection benchmark demonstrates the validity of the proposed architecture.

Introduction

     Nowadays, organizations and users face an enormous amount of sophisticated, targeted and widespread cyberattacks. Malicious actors were proven able to compromise government computer systems as well user devices causing various types of damages. Phishing, identity theft, information leakage, DDOS and botnet represent some examples of popular threat occurred in 2020 [1]. The outbreak of COVID-19 has further exacerbated this situation. As the virus spread during the early part of the 2020, the number of cyberattacks against organizations grew exponentially, reaching a peak in April [2], [3]. The pandemic unveiled different vulnerabilities of well-known platforms, applications and systems, and simultaneously stimulated the interest for promoting the usage of information sharing technologies to increase the degree of security for enterprises and organizations.

Conclusions

     Security intelligence and data analytics techniques can be used to strengthen the capabilities of cybersecurity applications in various vertical domains and use cases. These techniques can largely benefit from mechanisms to share digital evidence and ensure interoperability. The current Threat Intelligence platforms do not provide native mechanisms to incorporate such mechanisms, especially when data-driven and AI powered threat detection systems are involved. ORISHA is a first attempt to enable a sharing and interoperability protocol among such components, based solely on a data-oriented approach. This simple, flexible strategy and data formats for collaborative threat intelligence can trigger specific advantages: Improving the alert effectiveness by reducing the amount of false positive alerts; better contextualizing threat data with the contribution of multiple actors; boosting trust among producers and consumers of threat intelligence information; and strengthening the robustness of machine learning and deep learning models adopted by security applications. An experimental evaluation, conducted on a well-known IDS benchmark, demonstrates how merging data sharing and active learning strategies can improve the detection capabilities of the MISP network allowing to discover undetected attacks.

Abstract

Keywords

1. Introduction

2. Background

3. Materials and methods

4. Classifiers evaluation and discussion

5. RF-Based Intrusion Detection System for RPL (RF-IDSR)

6. Related works

7. Conclusion

Declaration of Competing Interest

Acknowledgements

References

Abstract

Internet of Things (IoT) has emerged as a key component of all advanced critical infrastructures. However, with the challenging nature of IoT, new security breaches have been introduced, especially against the Routing Protocol for Low-power and Lossy Networks (RPL). Artificial-Intelligence-based technologies can be used to provide insights to deal with IoT’s security issues. In this paper, we describe the initial stages of developing, a new Intrusion Detection System using Machine Learning (ML) to detect routing attacks against RPL. We first simulate the routing attacks and capture the traffic for different topologies. We then process the traffic and generate large 2-class and multi-class datasets. We select a set of significant features for each attack, and we use this set to train different classifiers to make the IDS. The experiments with 5-fold cross-validation demonstrated that decision tree (DT), random forests (RF), and K-Nearest Neighbours (KNN) achieved good results of more than 99% value for accuracy, precision, recall, and F1-score metrics, and RF has achieved the lowest fitting time. On the other hand, Deep Learning (DL) model, MLP, Naïve Bayes (NB), and Logistic Regression (LR) have shown significantly lower performance.

1. Introduction

Critical infrastructures (CIs) cover various socio-economic sectors such as healthcare, agriculture, industry, gas and water distribution, transportation, energy, communications, information technology, etc. CIs are continuously changing and adapting to changes in technology. Indeed, Cyber-Physical Systems (CPS) and the Internet of Things (IoT) have emerged as core components in all advanced Cis, such as Industry 4.0 [1,2]. Since CIs are vital to daily human lives, their protection from cyber-attacks by malicious entities that cause significant impacts on the targeted CIs and their services is a serious concern. Consequently, to secure CIs, it is necessary to secure IoT networks [3].

IoT [4] consists of physical objects, usually known as things (devices) that sense, collect, and might process CIs related information. On one side, these objects are resource-constrained as they are powered by batteries and have limited computation and storage capability. On the other side, billions of these devices are interconnected and connected to the Internet under lossy and noisy communication environments such as Wi-Fi, ZigBee, Bluetooth, LoRa, GSM, WiMAX or GPRS. IoT applications have emerged in several aspects. Nevertheless, the IoT’s networks rise challenges in designing efficient and secure routing protocols [5,6]. Several efforts have been made by standardisation entities to specify efficient routing protocols for the IoT. Finally, the IPv6 Routing Protocol for Low Power and Lossy Networks (RPL) [7] was designed and standardised by the IETF ROLL working group to overcome the routing challenges underpinning IoT networks. RPL specification considers limitations in both the energy power and the computational capabilities of such networks

Highlights

Abstract

Keywords

1. Introduction

2. Background

3. Proposed system

4. Evaluation results

5. Related works

Conclusion

CRediT authorship contribution statement

Declaration of Competing Interest

Acknowledgments

References

Vitae

Abstract

Internet of Things (IoT) constitutes a pivotal contributor to the Industry 4.0 (I 4.0) vision, technologically transforming production and societies. It enables novel services through the seamless integration of devices, such as motes carrying sensors, with the Internet. However, the broad adoption of IoT technologies is facing security issues due to the direct access to the devices from the Internet, the broadcasting nature of the wireless media, and the potential unattended operation of relevant deployments. In particular, the Routing over Low Power and Lossy Networks (RPL) protocol, a prominent IoT solution, is vulnerable to a large number of attacks, both of general-purpose and RPL-specific nature, while the resource-constraints of the corresponding devices are making attack mitigation even more challenging, e.g., in terms of involved control overhead and detection accuracy.

In this paper, we introduce ASSET, a novel Intrusion Detection System (IDS) for RPL with diverse profiles to tackle the above issues that mitigate at least 13 attacks. At the same time, other solutions go up to eight. ASSET, inspired by the network softwarization paradigm, supports a novel, extendable workflow, bringing together three anomaly-detection and four RPL specification-based mechanisms, a novel attacker identification process, as well as multiple attack mitigation strategies. Our IDS also supports an adaptable control & monitoring protocol, trading overhead for accuracy, depending on the network conditions. The proof-of-concept experiments show that ASSET entails a low overhead for the different modes of operation it supports (i.e., 6.28 percent on average) compared to other solutions reaching up to 30 percent. At the same time, it also keeps the power consumption at acceptable levels (from 0.18 up to 1.54 percent more). Moreover, it provides 100 percent accuracy for specific attacks and can identify the attacker in far more attacks than any other similar solution.

1. Introduction

Internet of Things (IoT) does rapidly develop and, among others, is the technological enabler for smart-x ecosystems and the next-generation advanced manufacturing, referred to as I 4.0 (Industry 4.0), that includes smart products, smart production, and smart services. Indeed, recent advances in communication technology, e.g., 5G Networks, along with the Industrial IoT (IIoT), evolve the request for mass production and automation from the principle idea to connect everything in the production chain to the more sophisticated context of broader and more fine-grained interconnections [1]. For example, a network of geographically distributed factory branches requires sharing resources and assets to improve orders’ fulfillment.

1- Introduction

2- Related work

3- System model

4- The probabilistic IDS

5- Experimental evaluation

6- Discussion

7- Conclusions

References

Abstract

The Electric Vehicles (EVs) market has seen rapid growth recently despite the anxiety about driving range. Recent proposals have explored charging EVs on the move, using dynamic wireless charging that enables power exchange between the vehicle and the grid while the vehicle is moving. Specifically, part of the literature focuses on the intelligent routing of EVs in need of charging. Inter-Vehicle communications (IVC) play an integral role in intelligent routing of EVs around a static charging station or dynamic charging on the road network. However, IVC is vulnerable to a variety of cyber attacks such as spoofing. In this paper, a probabilistic cross-layer Intrusion Detection System (IDS), based on Machine Learning (ML) techniques, is introduced. The proposed IDS is capable of detecting spoofing attacks with more than 90% accuracy. The IDS uses a new metric, Position Verification using Relative Speed (PVRS), which seems to have a significant effect in classification results. PVRS compares the distance between two communicating nodes that is observed by On-Board Units (OBU) and their estimated distance using the relative speed value that is calculated using interchanged signals in the Physical (PHY) layer.

Introduction

Two of the main prohibiting factors for the adoption of the Electric Vehicles (EVs) across Europe are the driving range (i.e. the distance the vehicle can cover before it needs to recharge), and the lack of supporting charging infrastructure. One solution to these pivotal factors would be the implementation of stochastic optimisation techniques for the charging procedure of EVs [1]. However, this research area has specific limitations regarding the optimal placement of charging stations in a city, queue stability issues, especially when few charging stations must facilitate a large number of requests, among others. Furthermore, the deployment of charging infrastructure requires changes to the existing civil infrastructure, which are costly and take a long time to implement. To overcome these prohibiting factors, it is important that novel and cost-effective approaches to help in the adoption of EVs are proposed. A novel solution initially proposed in Refs. [2,3] to increase the driving range of EVs is the use of city buses as energy sources on the move. The EVs can make efficient use of Mobile Energy Disseminators (MED), which operate as mobile charging stations, and Static Charging Stations (SCS) [2]. The role of a MED can be taken over by city buses that follow a predefined route across the city. Inner-city busses repeatedly move along a predefined route. An EV can establish a communication with a MED and approach it at a specific location along the predefined route to complete the charging process. The proposed method exploits Inter-Vehicle Communication (IVC) in order to eco-route EVs. This innovative approach drives the investigation towards integrated solutions that allow EVs to charge while moving through the city, without the need for a significant change in the existing road infrastructure.

As Software-Defined Networking (SDN) is getting popular, its security issue is being magnified as a new controversy, and this trend can be found from recent studies of presenting possible security vulnerabilities in SDN. Understanding the attack surface of SDN is necessary, and it is the starting point to make it more secure. However, most existing studies depend on empirical methods in different environments, and thus they have stopped short of converging on a systematic methodology or developing automated systems to rigorously test for security flaws in SDNs. Therefore, we need to disclose any possible attack scenarios in diverse SDN environments and examine how these attacks operate in those environments. Inspired by the necessity for disclosing the vulnerabilities in diverse SDN operating scenarios, we suggest an SDN penetration tool, DELTA, to regenerate known attack scenarios in diverse test cases. Furthermore, DELTA can even provide a chance of discovering unknown security problems in SDN by employing a fuzzing module. In our evaluation, DELTA successfully reproduced 26 known attack scenarios, across diverse SDN controller environments, and also discovered 9 novel SDN application mislead attacks.

Introduction

Security has been a subject of controversy in many newly emerged networked systems, such as peer-to-peer networks and cloud networks. After their appearance, researchers and practitioners have examined their security issues from various angles to verify their safeness, and this process makes them more secure so that they can be adapted in a real-world system. Software-Defined Networking (SDN), which manages a network in a centralized way, is a recently proposed networking technology, and now it is endorsed by both industry and academia. As SDN technology is getting popular, its security problem is being at issue, and thus researchers are investigating its security issues as they have conducted in other networked systems [26, 46, 39, 20, 25, 1]. Such security-critical reviews of SDNs offer a view into various breaches, but overall, the attack surfaces thus far explored have been quite limited to either highly targeted exploits, such as ARP spoofing or specific vulnerabilities that arise in various SDN components. Each previous result may not be applicable to other SDN environments (e.g., different control planes). Hence, operators seeking to assess security issues in their SDN environments need to survey existing SDN security-related studies and determine relevance on a case-by-case basis. Furthermore, an operator may have to adapt or redesign deployment-specific security test suites. This paper introduces a new SDN security evaluation framework, called DELTA, which can automatically instan- ∗Corresponding author ORCID(s): tiate attack cases against SDN elements across diverse environments, and which may assist in uncovering unknown security problems within an SDN deployment. Motivated by security testing tools in the traditional network security domain [45, 15], DELTA represents the first security assessment tool for SDN environments. Furthermore, we enhanced our tool with a specialized fuzzing module [30] to exploit opportunities for discovering unknown security flaws in SDNs.