Traffic Based Sequential Learning During Botnet Attacks to Identify Compromised IoT Devices

TytułTraffic Based Sequential Learning During Botnet Attacks to Identify Compromised IoT Devices
Publication TypeJournal Article
Rok publikacji2022
AutorzyGelenbe E, Nakip M
JournalIEEE Access
Start Page126536
Date Published10/2022
Słowa kluczoweattack detection and prevention, autoassociative deep random neural network, botnets, compromised device identification, Internet of Things (IoT), Mirai, Random Neural Network

A novel online Compromised Device Identification System (CDIS) is presented to identify IoT devices and/or IP addresses that are compromised by a Botnet attack, within a set of sources and destinations that transmit packets. The method uses specific metrics that are selected for this purpose and which are easily extracted from network traffic, and trains itself online during normal operation with an Auto-Associative Dense Random Neural Network (AADRNN) using traffic metrics measured as traffic arrives. As it operates, the AADRNN is trained with auto-associative learning only using traffic that it estimates as being benign, without prior collection of different attack data. The experimental evaluation on publicly available Mirai Botnet attack data shows that CDIS achieves high performance with Balanced Accuracy of 97%, despite its low on-line training and execution time. Experimental comparisons show that the AADRNN with sequential (online) auto-associative learning, provides the best performance among six different state-of-the-art machine learning models. Thus CDIS can provide crucial effective information to prevent the spread of Botnet attacks in IoT networks having multiple devices and IP addresses.


Plik PDF: 

Historia zmian

Data aktualizacji: 04/01/2023 - 15:10; autor zmian: Mert Nakip (