An Intelligent Mechanism for Monitoring and Detecting Intrusions in IoT Devices

The current amount of IoT devices and their limitations has come to serve as a motivation for malicious entities to take advantage of such devices and use them for their own gain. To protect against cyberattacks in IoT devices, Machine Learning techniques can be applied to Intrusion Detection Systems. Moreover, privacy related issues associated with centralized approaches can be mitigated through Federated Learning. This work proposes a Host-based Intrusion Detection Systems that leverages Federated Learning and Multi-Layer Perceptron neural networks to detected cyberattacks on IoT devices with high accuracy and enhancing data privacy protection.

I. Introduction and Background

Intrusion Detection Systems (IDS) are an indispensable form of defence mechanisms that examine activities within a system or a network, to identify and alert about incoming attacks. IDS have been studied extensively, however, little work has been done with HIDS for IoT, which we aim to tackle in this work. Traditional IDS are not suitable for IoT for many reasons, such as the limited resources on such devices and their decentralization. In addition, there is considerable heterogeneity in the devices, technologies and network protocols used in IoT. In HIDS, the data from the host system's audit and logging mechanisms are analysed to look for signs of intrusions. System call traces in particular are often used in detecting intrusions with HIDS. System call traces are used to find behavioural patterns, enabling intrusion detection during execution. A system call trace refers to the system call sequences that have been ordered, performed by a process that a program (i.e., process) ran during execution. The system call analysis approach to intrusion detection was first proposed by Forrest et al. [1], where short sequences of system calls are used to generate profiles of normal program behaviour. Other works [2] [3] tried to improve on the results obtained by Forrest by using machine learning algorithms to extract information from normal and abnormal sequences of system call traces.