CyberDome: Cloud based Intrusion Detection and Mitigation

The current Internet of Things (IoT) security systems are unable to keep up with the pace of increasing things and the complexity of their structure, resulting in need for scalable, robust and contemporary systems capable of real-time security. The proposed system conceives a combination of cloud-based Intrusion Detection System (IDS) along with a mitigation module. The cloud based IDS comprises of machine learning model (XGBoost) with F1-scores ranging from 0.995 to 1.0, capable of classifying the network traffic logs and invoking the mitigation module on anomaly detection. Mitigation module based on Software Defined Networks (SDN) can mitigate threats using open flow rules taking up tasks like dynamic flow control, network segmentation and device quarantine on demand by IDS. The mitigation module is also a cloud-based component, with the term SDN as a Service, which possess the capability to manage multiple large complex networks while maintaining the network agility, security and scalability under heavy traffic loads. Machine learning model deployed in the cloud, XGBoost is a lightweight model adept to generalizing to unseen data cleverly avoiding overfitting by Incorporating regularization techniques. When number of networks are scaled, among the plausible solutions, the cloud based solution proves to be cost effective while maintaining a prominent performance compared to edge computing or TinyML-based solutions with reduced management overhead along with easy and centralized maintenance.