IoT 네트워크 상의 머신러닝 기반 DoS 및 DRDoS 탐지연구 = Machine Learning-based Detection of DoS and DRDoS Attacks in IoT Networks

다국어 초록 (Multilingual Abstract)

We propose an intrusion detection model that detects denial-of-service(DoS) and distributed reflection denial-of-service(DRDoS) attacks, based on the empirical data of each internet of things(IoT) device by training system and network metrics that can be commonly collected from various IoT devices. First, we collect 37 system and network metrics from each IoT device considering IoT attack scenarios; further, we train them using six types of machine learning models to identify the most effective machine learning models as well as important metrics in detecting and distinguishing IoT attacks. Our experimental results show that the Random Forest model has the best performance with accuracy of over 96%, followed by the K-Nearest Neighbor model and Decision Tree model. Of the 37 metrics, we identified five types of CPU, memory, and network metrics that best imply the characteristics of the attacks in all the experimental scenarios. Furthermore, we found out that packets with higher transmission speeds than larger size packets represent the characteristics of DoS and DRDoS attacks more clearly in IoT networks.

국문 초록 (Abstract)

본 논문은 다수의 사물인터넷 단말에서 보편적으로 수집할 수 있는 시스템 및 네트워크 메트릭을학습하여 각 사물의 경험데이터를 기반으로 서비스거부 및 분산반사 서비스거부 공격을 탐지하는침입 탐지 모델을 제안한다. 먼저, 공격 시나리오 유형별로 각 사물에서 37종의 시스템 및 네트워크메트릭을 수집하고, 이를 6개 유형의 머신러닝 모델을 기반으로 학습하여 사물인터넷 공격 탐지 및분류에 가장 효과적인 모델 및 메트릭을 분석한다. 본 논문의 실험을 통해, 랜덤 포레스트 모델이96% 이상의 정확도로 가장 높은 공격 탐지 및 분류 성능을 보이는 것을 확인하였고, 그 다음으로는K-최근접 이웃 모델과 결정트리 모델의 성능이 우수한 것을 확인하였다. 37종의 메트릭 중에는 모든공격 시나리오에서 공격의 특징을 가장 잘 반영하는 CPU, 메모리, 네트워크 메트릭 5종을 발견하였으며 큰 사이즈의 패킷보다는 빠른 전송속도를 갖는 패킷이 사물인터넷 네트워크에서 서비스거부및 분산반사 서비스거부 공격 특징을 더욱 명확히 나타내는 것을 실험을 통해 확인하였다.

참고문헌 (Reference)

1 Koroniotis Nickolaos, "Towards the Development of Realistic Botnet Dataset in the Internet of Things for Network Forensic Analytics: Bot-IoT Dataset" 100 : 779-796, 2019

2 Islam Nahida, "Towards Machine Learning Based Intrusion Detection in IoT Networks" 69 (69): 1801-1821, 2021

3 Booij Tim, "ToN_IoT: The Role of Heterogeneity and the Need for Standardization of Features and Attack Types in IoT Network Intrusion Datasets" 9 (9): 485-496, 2022

4 Knud Lasse Lueth, "State of the IoT 2020: 12 billion IoT connections, surpassing non-IoT for the first time"

5 Shafiq Muhammad, "Selection of effective machine learning algorithm and Bot-IoT attacks traffic identification for internet of things in smart city" 107 (107): 2020

6 "NSL-KDD dataset"

7 Nicolas-Alin Stoian, "Machine Learning for Anomaly Detection in IoT networks: Malware analysis on the IoT-23 Data set"

8 Damasevicius Robertas, "LITNET-2020: An Annotated Real-World Network Flow Dataset for Network Intrusion Detection" 9 (9): 2020

9 IoTnews, "Kaspersky: Attacks on IoT devices double in a year"

10 "KDD Cup 1999 Data"

11 Sebastian Garcia, "IoT-23: A labeled dataset with malicious and benign IoT network traffic"

12 Satish Pokhrel, "IoT Security:Botnet detection in IoT using Machine learning"

13 Hasan Alkahtani, "Intrusion Detection System to Advance Internet of Things Infrastructure-Based Deep Learning Algorithms" 2021 (2021): 2021

14 Patel Keyur, "Internet of Things-IOT: Definition, Characteristics, Architecture, Enabling Technologies, Application & Future Challenges" 6 (6): 2016

15 "FrancoisXA, DS2OS traffic traces"

16 Reddy Dukka, "Deep neural network based anomaly detection in Internet of Things network traffic tracking for the applications of future smart cities" 32 (32): 2020

17 Hasan Mahmudul, "Attack and Anomaly Detection in IoT Sensors in IoT Sites Using Machine Learning Approaches" 2019

18 Churcher Andrew, "An Experimental Analysis of Attack Classification Using Machine Learning in IoT Networks" 21 (21): 1-32, 2021

19 Shahin Rawan, "A Secure IoT Framework Based on Blockchain and Machine Learning" 11 (11): 671-683, 2022

20 Ullah Imtiaz, "A Scheme for Generating a Dataset for Anomalous Activity Detection in IoT Networks" 508-520, 2020

21 Raneem Qaddoura, "A Multi-Layer Classification Approach for Intrusion Detection in IoT Networks Based on Deep Learning" 21 (21): 2021

22 Strecker Sam, "A Modern Analysis of Aging Machine Learning Based IoT Cybersecurity Methods" 9 (9): 16-22, 2021

23 Das Anurag, "A Comprehensive Analysis of Accuracies of Machine Learning Algorithms for Network Intrusion Detection" 40-57, 2020

24 Paloaltonetworks, "2020 Unit 42 IoT Threat Report"