Abstract:The Internet of Things (IoT) offers unprecedented opportunities to access anything from anywhere and at any time. It is, therefore, not surprising that the IoT acts as a paramount infrastructure for most modern and envisaged systems, including but not limited to smart homes, e-health, and intelligent transportation systems. However, the prevalence of IoT networks and the important role they play in various critical aspects of our lives make them a target for various types of advanced cyberattacks: Dyn attack, BrickerBot, Sonic, Smart Deadbolts, and Silex are just a few examples. Motivated by the need to protect IoT networks, this paper proposes SEHIDS: Self Evolving Host-based Intrusion Detection System. The underlying approach of SEHIDS is to equip each IoT node with a simple Artificial Neural Networks (ANN) architecture and a lightweight mechanism through which an IoT device can train this architecture online and evolves it whenever its performance prediction is degraded. By this means, SEHIDS enables each node to generate the ANN architecture required to detect the threats it faces, which makes SEHIDS suitable for the heterogeneity and turbulence of traffic amongst nodes. Moreover, the gradual evolution of the SEHIDS architecture facilitates retaining it to its near-minimal configurations, which saves the resources required to compute, store, and manipulate the model's parameters and speeds up the convergence of the model to the zero-classification regions. It is noteworthy that SEHIDS specifies the evolving criteria based on the outcomes of the built-in model's loss function, which is, in turn, facilitates using SEHIDS to develop the two common types of IDS: signature-based and anomaly-based. Where in the signature-based IDS version, a supervised architecture (i.e., multilayer perceptron architecture) is used to classify different types of attacks, while in the anomaly-based IDS version, an unsupervised architecture (i.e., replicator neuronal network) is used to distinguish benign from malicious traffic. Comprehensive assessments for SEHIDS from different perspectives were conducted with three recent datasets containing a variety of cyberattacks targeting IoT networks: BoT-IoT, TON-IOT, and IoTID20. These results of assessments demonstrate that SEHIDS is able to make accurate predictions of 1 True Positive and is suitable for IoT networks with the order of small fractions of the resources of typical IoT devices.

Deployment of IoT-based honeynet model

An IoT Honeynet Based on Multiport Honeypots for Capturing IoT Attacks

HADES-IoT: A Practical Host-Based Anomaly Detection System for IoT Devices (Extended Version)

Hybrid Intrusion Detection System for Internet of Things (IoT)

An Intelligent Honeynet Architecture Based on Software Defined Security.

Stories from a Customized Honeypot for the IoT

A decentralized honeypot for IoT Protocols based on Android devices

A Survey of Honeypots and Honeynets for Internet of Things, Industrial Internet of Things, and Cyber-Physical Systems

What are Attackers after on IoT Devices? An approach based on a multi-phased multi-faceted IoT honeypot ecosystem and data clustering

Automated Honeynet Deployment for Dynamic Network Environment

A Survey of Industrial Control System Devices on the Internet

Security Analysis for Smart Healthcare Systems

SEHIDS: Self Evolving Host-Based Intrusion Detection System for IoT Networks

Reconfigurable and Scalable Honeynet for Cyber-Physical Systems

Toward an Improved Security Performance of Industrial Internet of Things Systems

A High-interaction Physics-aware ICS Honeypot for Industrial Environments

Design of Network Security Experiment Teaching System Based on Honeypot Technology.

Study on the intelligent honeynet model for containing the spread of industrial viruses

Early Intrusion Detection System using honeypot for industrial control networks

Understanding IoT Security with HoneyCloud

A new model for security analysis of network anomalies for IoT devices