IDSA-IoT: An Intrusion Detection System Architecture for IoT Networks

The Internet of Things (IoT) allows large amounts and variety of devices to connect, interact and exchange data. The IoT network creates numerous opportunities for novel attacks that can compromise information and systems integrity. Intrusion detection systems have been studied over two decades, mostly employing traditional data mining and machine learning techniques that require an offline phase for model training on large amounts of data. This paper presents three data stream novelty detection techniques applied to the intrusion detection problem and proposes IDSA-IoT, a novel implementation architecture, which combines the use of resources at the edge of the network and a public cloud. After an extensive empirical evaluation, results show that it is possible to identify new attack patterns soon after their emergence and to adapt the models in an efficient way.