Given the increasing rate of cyber attacks, specifically Denial of Service (DoS) attacks, there is a growing need for fast and efficient Intrusion Detection Systems (IDS). In this work, we studied the implementation of real-time IDS within resource constrained environments like Internet of Things (IoT) networks. We studied and tested a wide range of Machine Learning and Deep Learning models applied to the CICIDS2017 dataset, a commonly used benchmarking tool for network intrusion detection. We compared the results of models such as Logistic Regression, Random Forest, XGBoost, K-Nearest Neighbors, Support Vector Machines, Single-layer Perceptron (SLP), Multi-layer Perceptron (MLP), Deep Convolutional Neural Network (DCNN), ResNet, and DenseNet. We focused our investigation on performance metrics such as accuracy, precision, recall, F1-score, and inference time, trying to find the model with the best trade-off between detection capability and computation overhead considering the constrained resources of IoT devices. The results highlight that real-time security of IoT infrastructures with minimal resource consumption is possible with simple models such as XGBoost, SLP, or MLP.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Lightweight Anomaly Detection for IoT: Evaluating Machine Learning and Deep Learning Models on CICIDS2017

  • Emanuele Iacobelli,
  • Valerio Ponzi,
  • Adriano Puglisi,
  • Oleksandr Kuznetsov,
  • Katarzyna Nieszporek,
  • Cristian Randieri,
  • Christian Napoli

摘要

Given the increasing rate of cyber attacks, specifically Denial of Service (DoS) attacks, there is a growing need for fast and efficient Intrusion Detection Systems (IDS). In this work, we studied the implementation of real-time IDS within resource constrained environments like Internet of Things (IoT) networks. We studied and tested a wide range of Machine Learning and Deep Learning models applied to the CICIDS2017 dataset, a commonly used benchmarking tool for network intrusion detection. We compared the results of models such as Logistic Regression, Random Forest, XGBoost, K-Nearest Neighbors, Support Vector Machines, Single-layer Perceptron (SLP), Multi-layer Perceptron (MLP), Deep Convolutional Neural Network (DCNN), ResNet, and DenseNet. We focused our investigation on performance metrics such as accuracy, precision, recall, F1-score, and inference time, trying to find the model with the best trade-off between detection capability and computation overhead considering the constrained resources of IoT devices. The results highlight that real-time security of IoT infrastructures with minimal resource consumption is possible with simple models such as XGBoost, SLP, or MLP.