ML-IDS: A machine learning approach to detect wormhole attacks in Internet of Things

Internet of Things (IoT) is an emerging business model aimed to connect many low-power embedded devices with internet. IoT has many applications in building smart cities, smart environment, e-health care, etc. Due to the presence of unreliable internet and new routing protocols for low-power devices, IoT requires innovative security solutions. In this paper, we present three new Intrusion Detection Systems (IDSs) for IoT: 1) K-means clustering unsupervised learning based IDS; 2) decision tree based supervised IDS; and 3) a hybrid two stage IDS that combines K-means and decision tree learning approaches. To the best of our knowledge, these are the first machine learning based IDSs (together called as ML-IDS) for IoT. All the three IDS are centralized and scalable approaches. The K-means approach achieves 70-93% detection rate for varying sizes of random IoT networks. Decision tree based IDS achieves 71-80% detection rate and the hybrid approach attains 71-75% detection rate for the same network sizes. Although the hybrid IDS obtains lower detection rate, it is more accurate than the other two approaches. The hybrid approach eliminates the false positives significantly, while the other two IDS suffer from a higher number of false positives. Similar results are also obtained for regular mesh, star and ring topologies of IoT networks, each comprising 16 nodes.