Traffic Based Sequential Learning During Botnet Attacks to Identify Compromised IoT Devices

TitleTraffic Based Sequential Learning During Botnet Attacks to Identify Compromised IoT Devices
Publication TypeJournal Article
Year of Publication2022
AuthorsGelenbe E, Nakip M
JournalIEEE Access
Volume10
Start Page126536
Date Published10/2022
Keywordsattack detection and prevention, autoassociative deep random neural network, botnets, compromised device identification, Internet of Things (IoT), Mirai, Random Neural Network
Abstract

A novel online Compromised Device Identification System (CDIS) is presented to identify IoT devices and/or IP addresses that are compromised by a Botnet attack, within a set of sources and destinations that transmit packets. The method uses specific metrics that are selected for this purpose and which are easily extracted from network traffic, and trains itself online during normal operation with an Auto-Associative Dense Random Neural Network (AADRNN) using traffic metrics measured as traffic arrives. As it operates, the AADRNN is trained with auto-associative learning only using traffic that it estimates as being benign, without prior collection of different attack data. The experimental evaluation on publicly available Mirai Botnet attack data shows that CDIS achieves high performance with Balanced Accuracy of 97%, despite its low on-line training and execution time. Experimental comparisons show that the AADRNN with sequential (online) auto-associative learning, provides the best performance among six different state-of-the-art machine learning models. Thus CDIS can provide crucial effective information to prevent the spread of Botnet attacks in IoT networks having multiple devices and IP addresses.

URLhttps://ieeexplore.ieee.org/document/9969594
DOI10.1109/ACCESS.2022.3226700

PDF version: 

Historia zmian

Data aktualizacji: 04/01/2023 - 15:10; autor zmian: Mert Nakip (mnakip@iitis.pl)