Zeek Intrusion Detection on Raspberry Pi for IoT-Based Agriculture Monitoring Systems: Preliminary Investigation

The increasing adoption of IoT technologies in agriculture has transformed crop monitoring and management practices. However, as agricultural networks become increasingly connected, they also become potential targets for cyber threats. These threats pose significant risks to the security and integrity of farming operations. Our previous work focused on developing an IoT application for plant agriculture monitoring systems that incorporated power management techniques and secure authentication mechanisms. To further enhance the security of that system, there is a need for intrusion detection capabilities to identify and mitigate evolving cyber threats in the network. This paper presents a preliminary investigation of implementing Zeek, an open-source intrusion detection system (IDS), to secure IoT devices in agricultural scenarios. We deploy Zeek in a Raspberry Pi virtual environment using VirtualBox, as it provides a controlled and isolated testing environment. Then, we evaluate the performance and capability of Zeek in detecting intrusions using a pcap file containing a mix of genuine and malicious traffic from Stratosphere laboratory dataset. We analyze multiple cyber threats relevant to IoT agriculture, including unauthorized access attempts and distributed denial of service (DDoS) attacks. We confirm the effectiveness of Zeek's performance based on the number of detected attacks, detection times and resource utilizations. Zeek uses 28.3% of CPU and 1.09% of memory, completing the analysis in just over 6 seconds.