Journal:
IEEE Access 2023. Vol. 11. 2023

Authors:
Gelenbe E, Nakip M.

Abstract:

This paper proposes a method to assess the security of an n device, or IP address, IoT network by simultaneously identifying all the compromised IoT devices and IP addresses. It uses a specific Random Neural Network (RNN) architecture composed of two mutually interconnected sub-networks that complement each other in a recurrent structure, called the Associated RNN (ARNN). For each of the n devices or IP addresses in the IoT network, two distinct neurons of the ARNN advocate opposite views: compromised or not compromised. The fully interconnected 2n neuron ARNN structure of paired neurons learns offline from ground truth data. Thus rather than requiring a separate attack detector at each network node, the ARNN offers a single overall attack detector that observes the incoming traffic at each node, learns about the interdependencies between network nodes, and formulates a recommendation for each device or IP address in an IoT network. The ARNN weight initialization and learning algorithm are discussed, and the ARNN performance is evaluated using real attack data, and compared against several learning and testing techniques. Results are obtained both for off-line learning with ground truth data, and for on-line incremental learning using a simplified average metric measured from incoming packet traffic. Comparisons with the best state-of-the-art techniques show that the ARNN significantly outperforms previously known approaches.

Conference:
IEEE International Symposium on Local and Metropolitan Area Networks 2023 (IEEE  LANMAN 2023), 10-11 July 2023, London, UK.

Authors:
Gelenbe E, Nakip M.

Abstract:
This paper presents several novel algorithms for real-time cyberattack detection using the Auto-Associative Deep Random Neural Network. Some of these algorithms require offline learning, while others allow the algorithm to learn during its normal operation while it is also testing the flow of incoming traffic to detect possible attacks. Most of the methods we present are designed to be used at a single node, while one specific method collects data from multiple network ports to detect and monitor the spread of a Botnet. The evaluation of the accuracy of all these methods is carried out with real attack traces. The novel methods presented here are compared with other state-of-the-art approaches, showing that they offer better or equal performance, with lower learning times and shorter detection times, as compared to the existing state-of-the-art approaches.

Journal:
IEEE Access 2022. Vol. 10.

Authors:
Gelenbe E, Nakip M.

Abstract:
A novel online Compromised Device Identification System (CDIS) is presented to identify IoT devices and/or IP addresses that are compromised by a Botnet attack, within a set of sources and destinations that transmit packets. The method uses specific metrics that are selected for this purpose and which are easily extracted from network traffic, and trains itself online during normal operation with an Auto-Associative Dense Random Neural Network (AADRNN) using traffic metrics measured as traffic arrives. As it operates, the AADRNN is trained with auto-associative learning only using traffic that it estimates as being benign, without prior collection of different attack data. The experimental evaluation on publicly available Mirai Botnet attack data shows that CDIS achieves high performance with Balanced Accuracy of 97%, despite its low on-line training and execution time. Experimental comparisons show that the AADRNN with sequential (online) auto-associative learning, provides the best performance among six different state-of-the-art machine learning models. Thus CDIS can provide crucial effective information to prevent the spread of Botnet attacks in IoT networks having multiple devices and IP addresses.

Conference:
IEEE MASCOTS 2022

Authors:
Gelenbe E, Nakip M.

Abstract:
Malicious network attacks are a serious source of concern, and machine learning techniques have been widely used to build Attack Detectors. In particular, network based attacks have been widely studied since attacks try to compromise systems as network packets that enter network ports. Attack Detectors are trained off-line with real attack data as well as with real non-attack data, and used online to monitor system entry points connected to networks, so that an alarm is raised when the arrival of attack traffic is detected. Many machine learning based Attack Detectors are typically trained to identify certain specific attacks, and the training of such algorithms to cover many different types of attacks may be excessively time consuming. G-Networks are queueing networks with product form solution, which were proven to be universal approximators of continuous and bounded functions. In this paper a specific instance of the “G-Network with triggers” is organized as a multilayer network, then trained with “normal” (non-attack) traffic from a well known DARPA attack traffic data repository. It is then shown to accurately detect several different attack types contained in the same DARPA traffic repository.

Conference:
EuroCybersec2021

Authors:
Nakip M, Gelenbe E.

Abstract:
In recent years, IoT devices have often been the target of Mirai Botnet attacks. This paper develops an intrusion detection method based on Auto-Associated Dense Random Neural Network with incremental online learning, targeting the detection of Mirai Botnet attacks. The proposed method is trained only on benign IoT traffic while the IoT network is online; therefore, it does not require any data collection on benign or attack traffic. Experimental results on a publicly available dataset have shown that the performance of this method is considerably high and very close to that of the same neural network model with offline training. In addition, both the training and execution times of the proposed method are highly acceptable for real-time attack detection.

Conference:
2021 IEEE Global Communications Conference

Authors:
Nakip M, Gelenbe E.

Abstract:
Internet connected IoT devices have often been particularly vulnerable to Botnet attacks of the Mirai family in recent years. Thus we develop an attack detection scheme for Mirai Botnets, using the Auto-Associative Dense Random Neural Network that has recently been successful for other attacks such as the SYN attack. The resulting method is trained with normal traffic and tested with attack traffic, and shown to result in high accuracy detection of attacks with low false alarms. The approach is compared on the same data set with two other common Machine learning methods (Lasso and KNN) and shown to have higher accuracy, and much lower computation times than KNN and slightly higher (but comparable) computation times with respect to Lasso.

Conference:
2021 IEEE World Forum on Internet of Things (WF-IoT)

Authors:
Nakıip M, Gelenbe E.

Abstract:
Input traffic from Internet of Things (IoT) devices is often both periodic and requires to be received by a given deadline. This can create congestion at instants of time when traffic flowing from multiple devices arrives at a shared input port or gateway, resulting in missed deadlines at the receiver. As a consequence, scheduling techniques such as the “Earliest Deadline First” (EDF) and “Priority based on Average Load” (PAL) are used to schedule the flow from different devices so as to try to satisfy the needs of the largest number of traffic flows
in a timely fashion. In this paper, we propose the Randomization of flow Genaration Times (RGT) in order to smooth the total incoming traffic to the input port or gateway, on top of the use of EDF and PAL. We then evaluate the performance of RGT together with PAL and EDP, for traffic load with a varying number of up to 6400 IoT devices. Our simulation results show that RGT provides significantly better performance when added to EDF and PAL. Also, the additional computation required by RGT at each device can be quite small, suggesting that RGT is a very useful addition for improving the performance of IoT networks.