Identification of DDoS Attack Using Activity Pattern of IoT Devices Preserving Data Privacy

The paper presents a novel method to identify DDoS attack in IoT network by analyzing the activity patterns of devices in distributed environment preserving privacy of the data exchanged. An architecture is proposed where IoT gateways behave as clients and locally analyze the activities of the devices and run conditional entropy based change point detection algorithm. The detected change points are shared with a trusted server. The server aggregates the change points reported by multiple gateways. A new aggregation algorithm combining votes and averaging is proposed to find global change points indicating possibility of DDoS attack. This information is shared by the server with all the clients. The accuracy of the proposed technique is ascertained on real dataset. The results are found to be in close agreement with the actual occurrence of DDoS attack.