Novel Online Network Intrusion Detection System for Industrial IoT Based on OI-SVDD and AS-ELM

The Industrial Internet of Things (IIoT) should be equipped with computational resources to detect network intrusions, types of attacks, and update their models automatically in real time. The most challenging aspect of machine learning (ML)-based network intrusion detection system (NIDS) design to secure IIoT is the continuous need for up-to-date definitions of attack data records. Moreover, the approaches employed by cyber attackers are in a dynamic state with changing trends and techniques. Hence, conventional signature-based NIDS are not suitable since they cannot update obsolete detection models. Anomaly-based NIDS that contains an online learning technique is adopted in our proposed method. Since IIoTs face resource-constrained problems, such as low memory, low computing capacity, and limited energy supply, it is very challenging to implement the exiting general-purpose anomaly-based NIDS. This article proposes a lightweight NIDS based on an online incremental support vector data description (OI-SVDD) anomaly detection system on the IIoT devices and an adaptive sequential extreme learning machine (AS-ELM) on the multiaccess edge computing (MEC) server. Additionally, we utilize the MEC server, which provides computational resources to execute the AS-ELM model at the network’s edge. To avoid data saturation in the proposed model, we apply data filtering using the rate of convergence (ROC). We evaluated the proposed NIDS through experiments using two data sets, such as UNSW-NB15 (public data set) and our self-generated data set. Our results show that the proposed OI-SVDD and AS-ELM perform effectively and detect network intrusion in a realistic IIoT environment.