IoT 네트워크 상의 머신러닝 기반 DoS 및 DRDoS 탐지연구
Machine Learning-based Detection of DoS and DRDoS Attacks in IoT Networks
1
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
본 논문은 다수의 사물인터넷 단말에서 보편적으로 수집할 수 있는 시스템 및 네트워크 메트릭을학습하여 각 사물의 경험데이터를 기반으로 서비스거부 및 분산반사 서비스거부 공격을 탐지하는침입 탐지 모델을 제안한다. 먼저, 공격 시나리오 유형별로 각 사물에서 37종의 시스템 및 네트워크메트릭을 수집하고, 이를 6개 유형의 머신러닝 모델을 기반으로 학습하여 사물인터넷 공격 탐지 및분류에 가장 효과적인 모델 및 메트릭을 분석한다. 본 논문의 실험을 통해, 랜덤 포레스트 모델이96% 이상의 정확도로 가장 높은 공격 탐지 및 분류 성능을 보이는 것을 확인하였고, 그 다음으로는K-최근접 이웃 모델과 결정트리 모델의 성능이 우수한 것을 확인하였다. 37종의 메트릭 중에는 모든공격 시나리오에서 공격의 특징을 가장 잘 반영하는 CPU, 메모리, 네트워크 메트릭 5종을 발견하였으며 큰 사이즈의 패킷보다는 빠른 전송속도를 갖는 패킷이 사물인터넷 네트워크에서 서비스거부및 분산반사 서비스거부 공격 특징을 더욱 명확히 나타내는 것을 실험을 통해 확인하였다.
Abstract
We propose an intrusion detection model that detects denial-of-service(DoS) and distributed reflection denial-of-service(DRDoS) attacks, based on the empirical data of each internet of things(IoT) device by training system and network metrics that can be commonly collected from various IoT devices. First, we collect 37 system and network metrics from each IoT device considering IoT attack scenarios; further, we train them using six types of machine learning models to identify the most effective machine learning models as well as important metrics in detecting and distinguishing IoT attacks. Our experimental results show that the Random Forest model has the best performance with accuracy of over 96%, followed by the K-Nearest Neighbor model and Decision Tree model. Of the 37 metrics, we identified five types of CPU, memory, and network metrics that best imply the characteristics of the attacks in all the experimental scenarios. Furthermore, we found out that packets with higher transmission speeds than larger size packets represent the characteristics of DoS and DRDoS attacks more clearly in IoT networks.
참고문헌 (24)
- Patel Keyur, "Internet of Things-IOT: Definition, Characteristics, Architecture, Enabling Technologies, Application & Future Challenges", IJESC, 6(5) (2016)[DOI]
- "State of the IoT 2020: 12 billion IoT connections, surpassing non-IoT for the first time"[URL]
- "2020 Unit 42 IoT Threat Report" (2020)[URL]
- "Kaspersky: Attacks on IoT devices double in a year" (2021)[URL]
- "KDD Cup 1999 Data"[URL]
- "NSL-KDD dataset"[URL]
- "FrancoisXA, DS2OS traffic traces"[URL]
- Koroniotis Nickolaos, "Towards the Development of Realistic Botnet Dataset in the Internet of Things for Network Forensic Analytics: Bot-IoT Dataset", Future Generation Computer Systems, 100, pp.779~796 (2019)
- "IoT-23: A labeled dataset with malicious and benign IoT network traffic"[URL]
- Damasevicius Robertas, "LITNET-2020: An Annotated Real-World Network Flow Dataset for Network Intrusion Detection", Electronics, 9(5) (2020)[DOI]
- Ullah Imtiaz, "A Scheme for Generating a Dataset for Anomalous Activity Detection in IoT Networks", Advances in Artificial Intelligence, pp.508~520 (2020)[DOI]
- Booij Tim, "ToN_IoT: The Role of Heterogeneity and the Need for Standardization of Features and Attack Types in IoT Network Intrusion Datasets", IEEE Internet of Things Journal, 9(1), pp.485~496 (2022)[DOI]
- Strecker Sam, "A Modern Analysis of Aging Machine Learning Based IoT Cybersecurity Methods", Journal of Computer Sciences and Applications, 9(1), pp.16~22 (2021)[DOI]
- Nicolas-Alin Stoian, "Machine Learning for Anomaly Detection in IoT networks: Malware analysis on the IoT-23 Data set", ~ (2020)
- Islam Nahida, "Towards Machine Learning Based Intrusion Detection in IoT Networks", Computers, Materials and Continua, 69(2), pp.1801~1821 (2021)[DOI]
- Raneem Qaddoura, "A Multi-Layer Classification Approach for Intrusion Detection in IoT Networks Based on Deep Learning", Sensors, 21(9) (2021)[DOI]
- Hasan Alkahtani, "Intrusion Detection System to Advance Internet of Things Infrastructure-Based Deep Learning Algorithms", Complexity, 2021(3) (2021)[DOI]
- Shahin Rawan, "A Secure IoT Framework Based on Blockchain and Machine Learning", International Journal of Computing and Digital Systems, 11(1), pp.671~683 (2022)[DOI]
- Hasan Mahmudul, "Attack and Anomaly Detection in IoT Sensors in IoT Sites Using Machine Learning Approaches", Internet of Things (2019)[DOI]
- Reddy Dukka, "Deep neural network based anomaly detection in Internet of Things network traffic tracking for the applications of future smart cities", Transactions on Emerging Telecommunications Technologies, 32(6) (2020)[DOI]
- Shafiq Muhammad, "Selection of effective machine learning algorithm and Bot-IoT attacks traffic identification for internet of things in smart city", Future Generation Computer Systems, 107(4) (2020)[DOI]
- Satish Pokhrel, "IoT Security:Botnet detection in IoT using Machine learning", ~ (2021)
- Churcher Andrew, "An Experimental Analysis of Attack Classification Using Machine Learning in IoT Networks", Sensors, 21(2), pp.1~32 (2021)[DOI]
- Das Anurag, "A Comprehensive Analysis of Accuracies of Machine Learning Algorithms for Network Intrusion Detection", Machine Learning for Networking, pp.40~57 (2020)[DOI]