Abstract:The Internet of Things (IoT) has gained popularity with interconnected devices and diverse network applications, leading to increased vulnerability of sensitive data to security threats. Many researchers have focused on intrusion detection without considering prevention mechanisms. To overcome these issues, we propose the honeypot and blockchain-based intrusion detection and prevention (HB-IDP) model, in which edge computing is introduced to reduce the latency during communication. Initially, three-fold authentication is performed for entities (users, devices, and gateway) to ensure legitimacy using the camellia encryption algorithm (CEA), which provides secret keys. The proposed datasets (i.e., UNSW-NB15 and BoT-IoT) are pre-processed at the gateway using min–max normalization to reduce redundancy and complexity during feature extraction and classification. Signature-based intrusion detection is performed on the pre-processed data, with known attacks classified into three classes (normal, malicious, and suspicious) using the improved isolation forest (IIF) algorithm. Suspicious data are forwarded for anomaly detection to the edge level; here, a honeypot is deployed to attract the attacker’s patterns. Ensemble learning technique, including multi-layer perceptron (MLP), general adversarial network (GAN), and lightweight convolutional neural Network (LCNN), is applied to classify suspicious packet behaviors. Once intrusions are detected, the proposed work prevents future intrusions by generating reports, which are then encrypted by the CEA algorithm and provided to legitimate users. All transactions (i.e., key generation, report generation, and attacker patterns) are stored in the blockchain. The HB-IDP model’s performance and effectiveness were evaluated using network simulator 3.26 (NS-3.26), showcasing its superiority over existing approaches.

Honeypot-like Moving-target Defense for secure IoT Operation

What are Attackers after on IoT Devices? An approach based on a multi-phased multi-faceted IoT honeypot ecosystem and data clustering

HoneyIoT: Adaptive High-Interaction Honeypot for IoT Devices Through Reinforcement Learning

Proactive Defense Mechanism: Enhancing IoT Security through Diversity-based Moving Target Defense and Cyber Deception

A decentralized honeypot for IoT Protocols based on Android devices

An IoT Honeynet Based on Multiport Honeypots for Capturing IoT Attacks

AIIPot: Adaptive Intelligent-Interaction Honeypot for IoT Devices

Stories from a Customized Honeypot for the IoT

Proactive Defense for Internet-of-Things: Integrating Moving Target Defense with Cyberdeception

Deceptive Attack and Defense Game in Honeypot-Enabled Networks for the Internet of Things.

IoTCMal: Towards A Hybrid IoT Honeypot for Capturing and Analyzing Malware

Detection and Mitigation of IoT-Based Attacks Using SNMP and Moving Target Defense Techniques

A First Step Towards Understanding Real-world Attacks on IoT Devices

Deployment of IoT-based honeynet model

Securing IoT Networks from DDoS Attacks Using a Temporary Dynamic IP Strategy

Intelligent Threat Detection—AI-Driven Analysis of Honeypot Data to Counter Cyber Threats

Understanding IoT Security with HoneyCloud

Artificial Intelligence in Identifying or Mitigating Threats in Internet of Things

Analyzing IoT-Based Botnet Malware Activity with Distributed Low Interaction Honeypots

Honey-block: Edge Assisted Ensemble Learning Model for Intrusion Detection and Prevention Using Defense Mechanism in IoT

Cryptanalysis of a Honeyword System in the IoT Platform