Sketch-based Real-time Intrusion Detection Framework for Industrial Internet of Things

Intrusion detection technology is of great significance to enhance the network security protection of industrial Internet of Things (IIoT) and ensure the efficient implementation of the production process. Aiming at the problems of poor real-time performance and high false positive rate (FPR) of existing intrusion detection methods in IIoT, a sketch-based intrusion detection framework is proposed. The framework employs an improved sketch algorithm as a primary classification module, which is able to process raw traffic in real-time, and perform traffic splitting and filtering efficiently. To improve accuracy, the filtered traffic is fed into a machine learning (ML) based secondary classification module for further analysis. Compared to direct analysis, the sketch can filter out a portion of the benign traffic, thus improving the efficiency of the secondary module. Our framework can work as a pre-module for existing ML based intrusion detection methods, giving them the ability to process traffic in real-time and reduce FPRs. We validate the performance of the framework by testing it on the latest publicly available dataset, Modbus 2023.