A hybrid ensemble framework for unknown attack detection in IoT networks

초록

The Internet of Things (IoT) comprises interconnected physical devices, ranging from smartphones to household appliances, that communicate wirelessly over the internet. As IoT networks grow in complexity, new cybersecurity risks continue to emerge, with cybercriminals exploiting unprotected vulnerabilities. While various security solutions have been developed, traditional network intrusion detection systems (NIDS) often struggle to detect novel cyberattacks, limiting their adaptability to evolving cyberattacks. This paper addresses these limitations by proposing a decision framework that integrates three models to classify IoT traffic as benign, a known attack and type, or a novel attack. The framework consists of: 1) a binary neural network that distinguishes benign traffic from any attack, 2) a multi-class neural network that classifies traffic as benign or one of known attack types, and 3) a k-Nearest Neighbors (KNN) model that assesses packet similarity to known attack patterns. By combining these models through ensemble voting and leveraging distance metrics, the proposed framework effectively identifies known and novel attacks. Using two benchmark datasets, the framework demonstrated considerable detection rates for novel attacks, which conventional supervised baseline models failed to achieve, while retaining strong performance in known attack detection and categorization. These findings offer valuable insights for both academia and industry, contributing to the development of more adaptive IoT security solutions.

키워드