Abstract:The pernicious impact of malicious Slow DoS (Denial of Service) attacks on the application layer and web-based Open Systems Interconnection model services like Hypertext Transfer Protocol (HTTP) has given impetus to a range of novel detection strategies, many of which use machine learning (ML) for computationally intensive full packet capture and post-event processing. In contrast, existing detection mechanisms, such as those found in various approaches including ML, artificial intelligence, and neural networks neither facilitate real-time detection nor consider the computational overhead within resource-constrained Internet of Things (IoT) networks. Slow DoS attacks are notoriously difficult to reliably identify, as they masquerade as legitimate application layer traffic, often resembling nodes with slow or intermittent connectivity. This means they often evade detection mechanisms because they appear as genuine node activity, which increases the likelihood of mistakenly being granted access by intrusion-detection systems. The original contribution of this paper is an innovative Guardian Node (GN) Slow DoS detection model, which analyses the two key network attributes of packet length and packet delta time in real time within a live IoT network. By designing the GN to operate within a narrow window of packet length and delta time values, accurate detection of all three main Slow DoS variants is achieved, even under the stealthiest malicious attack conditions. A unique feature of the GN model is its ability to reliably discriminate Slow DoS attack traffic from both genuine and slow nodes experiencing high latency or poor connectivity. A rigorous critical evaluation has consistently validated high, real-time detection accuracies of more than 98% for the GN model across a range of demanding traffic profiles. This performance is analogous to existing ML approaches, whilst being significantly more resource efficient, with computational and storage overheads being over 96% lower than full packet capture techniques, so it represents a very attractive alternative for deployment in resource-scarce IoT environments.

Detecting malicious proxy nodes during IoT network joining phase

Detection of malicious nodes based on consortium blockchain

An IoT Architecture Leveraging Digital Twins: Compromised Node Detection Scenario

Employing blockchain and IPFS in WSNs for malicious node detection and efficient data storage

Exploiting Machine Learning to Detect Malicious Nodes in Intelligent Sensor-Based Systems Using Blockchain

Blockchained service provisioning and malicious node detection via federated learning in scalable Internet of Sensor Things networks

SECURE TRUST: a blockchain-enabled trust and reputation system for malicious node detection in IOT networks

A lightweight and anti‐collusion trust model combined with nodes dynamic relevance for the power internet of things

Blockchain Trust Model for Malicious Node Detection in Wireless Sensor Networks

An artificial immune system‐based algorithm for selfish node detection in Mobile Ad Hoc Networks (MANETs)

IoT-KEEPER: Detecting Malicious IoT Network Activity Using Online Traffic Analysis at the Edge

Security at the Edge for Resource-Limited IoT Devices

Machine Learning Based Malicious Node Detection in IoT Environment

A Blockchain-Based Multi-Mobile Code-Driven Trust Mechanism for Detecting Internal Attacks in Internet of Things

Detection of Cooperative Black Hole Attack in Wireless Ad Hoc Networks

The Guardian Node Slow DoS Detection Model for Real-Time Application in IoT Networks

Strengthening network DDOS attack detection in heterogeneous IoT environment with federated XAI learning approach

SybilPSIoT: Preventing Sybil attacks in signed social internet of things based on web of trust and smart contract

An Artificial Immune Based Approach for Detection and Isolation Misbehavior Attacks in Wireless Networks

An Adaptive Real-Time Malicious Node Detection Framework Using Machine Learning in Vehicular Ad-Hoc Networks (VANETs)