Lightweight Network Context Change Detection for Online Defense Against Heterogeneous IoT Attacks

The heterogeneous resource-constrained IoT devices with their edge associations-called the edge-of-things (EoT), handle dynamic, time-critical, distributed workloads and are susceptible to proliferating time-bound, multivector Botnet attacks, resulting in unauthorized device or service discovery, service denial, and information leakage or theft-leading to degraded network availability. Several existing AI-based attack detection techniques analyze the traffic data, providing network-context-unaware statistical decisions that increase misclassifications and diminish EoT availability. However, addressing short-burst, dynamic, and latency-sensitive Botnet attacks requires a context change detection system of network topological parameters with low processing footprints, supplementing real-time threat assessment of IoT edge-constituting the proposed CCDS framework to differentiate between the threat and HetIoT (network) operational contexts. Additionally, the high-level CCDS framework parameters minimize referencing low-level network component logs for faster, reliable troubleshooting. It is also suitable for online and offline threat assessment and is deployable on resource-constrained EoT infrastructures. The proposed work results in an average detection rate increase of 9.6% on 10
¹
and 10
²
samples and 14.3 % on 10
³
samples compared to the state-of-the-art for online (real-time) intrusion detection.