Implementation of Intrusion Detection System in the

Internet of Things: A Survey

Shakir Zaman Haseeb Tauqeer Wakeel Ahmad
Department of Computer Science University Department of Computer Science University Department of Computer Science University
of Engineering and Technology Taxila of Engineering and Technology Taxila of Engineering and Technology Taxila
Taxila, Pakistan Taxila, Pakistan Taxila, Pakistan
[email protected] [email protected] [email protected]

Syed M. Adnan Shah Muhammad Ilyas

Department of Computer Science University Department of Computer Science and IT
of Engineering and Technology Taxila University of Sargodha
Taxila, Pakistan Sargodha, Pakistan
[email protected] [email protected]

Abstract— The Internet of Things (IoT) is a precipitously Numerous technologies are involved in achieving the
evolving technology. In which interconnected computing devices and objective of IoT. Such as, Smart Grid (SG), Radio Frequency
sensors share data over the network to decipher different problems Identification (RFID), Near Field Communication (NFC),
and deliver new services. Medical treatment, control devices Machine to Machine Communication (M2M) and Vehicle to
remotely, and machine to machine interaction, etc., are services for Vehicle Communication (V2V). IoT equipment are totally
2020 IEEE 23rd International Multitopic Conference (INMIC) | 978-1-7281-9893-4/20/$31.00 ©2020 IEEE | DOI: 10.1109/INMIC50486.2020.9318047

users without human collaboration. Despite of having many dependent on the power. It is core need of power supplier to
advantages it also has some disadvantages, Security is one of them. supply power in an efficient manner. To overcome the power
There are many techniques used to preclude IoT from several attacks supplier issues (customer’s dissatisfaction, expensive resources
Intrusion Detection System (IDS) is one of them. IDS is one of the
and interrupted power) a more reliable solution SG is proposed
most original and well-organized methods that can protect IoT
in [5]. It helps in producing, supplying and transmitting power
devices from invaders and detect their attack with high accuracy.
This study discussed and briefly explained numerous kinds of attacks
in an efficient and reliable way. In RFID information is shared
like DDoS/DoS, hello flood and Sybil attack, etc., and also through the radio frequency. RFID system comprises of
anticipated different kinds of IDS approaches like Machine multiple readers and a tag. The data are stored on the tag
Learning, SDN, and Automata-based IDS that can be beneficial for electronically. This system works in real time to monitor the
the prevention and detection of IoT devices from attacks. objects. NFC is also a sort of communication in which
information is shared wirelessly. A small amount of information
Keywords—IoT, IDS, Machine Learning, SDN, Automata is shared only if both of the devices are NFC capable. Unlike
I. INTRODUCTION Bluetooth technology it doesn’t demand pre-connection.
Usually, It can send data over the distance of 20m or depends
Internet of Things (IoT) is a ubiquitous network in which on the size of the antenna. M2M communication occurs mostly
devices communicate without human interaction. The sensor in computers, embedded processors, mobiles and sensors. This
plays a key role in the IoT environment as the data is perceived is applicable in various fields like robotics, healthcare and smart
by these sensors and then sent to the central body for the further homes, etc. V2V consist of a vehicle which pretends to be a
process [1]. Smart devices like sensor nodes, smart TV, smart node. Communication is achieved through sensors connected to
mobile, smart doors, and smart heater get connected through the an ad-hoc network. It has quite complex structure as it doesn’t
Internet with each other to give information, to provide comfort follow a uniform protocol due to mobile vehicle. It can send
to humans [2]. Fig. 1 shows the architecture of the IoT network. data over the distance of 1000m [6]. Software Defined Network
The gateway acts as a threshold between IoT devices (smart (SDN) makes the network programmable. Instead of routers and
AC, smart locks, smart lights, e.t.c) and control devices (laptops switches, in SDN centralized controller is used for control
and user's mobile phones). Due to incompatible devices
architecture, the IoT environment becomes heterogeneous. As a
result of heterogeneity, these devices are vulnerable to security
attacks. An intruder may take control of the smart devices
remotely and can use it for his malicious purposes, causing
billion dollars loss. As discussed in [3], in 2016, every IoT
device was attacked once in every two minutes. According to a
recent study by HP, currently, almost 70% of smart devices are
vulnerable to security threats. Another study by HP reveals that
90% of devices have collected personal information during the
testing phase. This data can be used for nasty purposes due to a
compromised device or as a result of a cyber-attack [4].

Fig.1. IoT Structure

978-1-7281-9893-4/20/$31.00 ©2020 IEEE

purpose. Routers and switches are just used as forwarding
device. SDN controller has a universal view of network and by
this, structure of network become easy to understand [7]. An
updated programmed network control is offered by SDN, which
split data planes and control that are established on the devices
of vendor’s application in smart gird [8].
Intrusion Detection System (IDS) is used to monitor
network. It also works as fire alarm system which only
identifies the incidents. With a lot of benefits, it also has some
issues for example if alarm is not listened properly then it may
harm the system. It also has more issues like incidents that occur
by IDS itself, it does not prevent the system form them. The
information it read form IP packet can also be faked which is Fig.2. IDS Architecture
also a challenge. And finally where it provides easiness to users,
it also has some issues which need to be addressed.To mitigate administrator if there is a change in the normal behavior of the
network security issues, numerous techniques are being used by system.
the users; IDS is one of them. It helps in detecting the intrusions III. IDS TECHNIQUES
in the network and inform the user about threats. Early detection
of the attacks protects the network for being compromised. This A. Machine Learning Approach
paper is organized as follows. Section I comprises of Machine Learning is a child of Artificial Intelligence that
Introduction. Section II describes IDS, and section III covers can learn from data and perform decisions with minimum
various techniques implemented in IDS so far. In the end, human interaction. Fig. 3 shows an overview of the Machine
section IV is a brief conclusion of this research work. Learning structure.
II. INTRUSION DETECTION SYSTEM (IDS) 1. Supervised
IDS aims to monitor the network, detect compromised In supervised machine learning algorithms, users have prior
nodes, and intrusions in-network and alert the user about knowledge about the output for a given sample. The main aim
detected intrusions [9]. It also works fine for both external and of supervised learning is to train the machines on the data that
internal attacks. This technology is evolving gradually to is already available with the authentic result. Supervised
mitigate computer crime. Usually, IDS have three main learning usually occurs in classification whenever we want to
components: Monitoring, Analysis & Detection, an Alarms. map the input to the output label. Some well-known supervised
Network traffic, patterns, and resources are monitored by the algorithms are Random Forests, Support Vector Machine
monitoring module. Analysis and detection module plays a role (SVM), and Artificial Neural Network (ANN).
in detecting intrusion according to a specific algorithm. Alarm
a) Artificial Neural Network (ANN)
module trigger alarms on the detection of intrusion. Fig. 2 [10]
depicts the architecture of IDS. The prevention system requires The work in the field of ANN is started at the end of nineteen
numerous kinds of threats that can arise on data. This phase of and the start of the twentieth century. The first neural network
IDS is also known as the input section. In Intrusion Monitoring, was developed in 1950. There are many things that computers
phase monitor the data and traffic. While in the Intrusion can do better than humans like mathematical problems etc. But
Detection phase, the attack is detected if it matches the patterns. still, human brains are much faster and sensitive then computer
Then after identifying an attack, in the response section, it will machines in the way of imagination and inspiration. ANN are
produce a notification to make the system attentive to attacks. invented to make computers similar to human brains [11].
And then, at the end of refinement, it uses to recover data that Pandeeswari et.al [12] anticipated that there are a lot of
is damaged or destroyed by attacks. There are two categories in resources which are affords by cloud computing. In this article
which IDS is classified, Network-Based Intrusion Detection the authors proposed an anomaly detection based IDS. And for
System (NIDS) and Host-Based Intrusion Detection System improving detection ratio they used hybrid model which
(HIDS). combines, Fuzzy C Means and Artificial Neural Network. The
proposed system is implemented with Naïve Bayes classifier.
A. A Network-Based Intrusion Detection System (NIDS)
b) Random Forest
NIDS is used to detect network threats by monitoring and Random Forest is flexible and one of the most used
analyzing network traffic. NIDS intends to cover those places algorithms due to its easiness. The simple working of Random
where the percentage of occurring of attack is greater. Forest is that it builds decision trees and then combines them to
Normally, it is placed on all subnets. get optimal solutions or predictions. The most prominent
B. A host-Based Intrusion Detection System (HIDS) advantage of the Random Forest algorithm is that it is used for
both regression and classification. Usually, manufacturers do
HIDS is normally used in a single system. With the
not pay any attention to the Security of the devices. They are
connection of the internet, it runs on all devices that are
only concerned about the low power hardware equipment [13].
connected in a network. It equates the previous snapshot of the
Hence IoT devices are not computationally enabled to do the
file set to the file set of the entire system. Then alerts the
large computational encryption task.
 Fig.3. Different approaches used for Intrusion Detection System in IoT

In [14], the proposed system has two basic parts. In the first These algorithms are used in clustering and association
part, Network traffic monitoring device is used to gather data problems [17].
from the nodes traffic and forward it to cloud analyzer for
a) Anomaly Detection
feature extraction. Raspberry Pi-3 acts as a central device. The
second part is the detection and classification of the attacks. In anomaly detection, abnormal data points are discovered
Tshark is used as a network protocol analyzer. The main goal is in the dataset. This is useful in identifying fake operations,
to capture network traffic and save as Pcap files. These Pcap are finding damaged pieces of hardware, or pinpointing errors that
uploaded for analysis to the cloud analyzer. BroIDS works as a occurred during data entry work. Authors use a TOSSIM
traffic analyzer and analyze Pcap files. To store the extracted simulator in [18]. Both anomaly detection and signature-based
network features, MySQL database is used. These features are detection were used in this paper. And named their solution as
then further used by the processing module. With the help of 31 a lightweight intrusion detection device because when an attack
estimators (decision trees), Random Forest Classifier and is expected to occur, the anomaly detection technique is
Scikit-Learn ExtraTreesClassifier classify intrusions. Based on triggered. When anomaly detection is enabled all the time, the
the information gain ratio decision tree's quality is measured. intrusion detection device can consume more energy.
The output layer uses Softmax as an activation function. Output
dimensions of Softmax function are used as dataset categories, In [19], Pajouh et al. discussed that in cybersecurity,
one is regular, and 9 of them are attacks. The regularization of network anomaly detection is the most problematic and
dropouts is used to avoid overfitting. challenging field. In the proposed paper, they anticipated a two-
tier classification model established on Naive Bayes
c) Support vector machine (SVM) methodology. This proposed system offers low computation
because of feature selection and optimal measurement
The main concept of SVM is the decision plane. A decision
reduction. Besides Security against multifaceted and occasional
plane is like a separator that separates the members of different
attacks, it also provides sophisticated detection rates. This
classes. In this IDS, Machine Learning algorithms such as
model is accomplished by the SMOTE technique, and the NSL-
SVM, naive Bayes classifier, J.48 decision tree, and decision
KDD data set is used. Earlier techniques for low resource IoT
table are used in the anomaly detection model as supervised
devices, which used anomaly detection in IDS, could cause
algorithms. KDD99 dataset is used for training and evaluation
high-energy consumption because they were triggered all the
purposes [15]. Nowadays, most of the functional IDSs are either
time. So, in [20], Sedjelmaci et al. proposed a game-theoretic
for traditional IoT network architecture or conventional
method that is triggered only when a new attack is about to
wireless sensor networks (WSNs). But none of them is suitable
occur. By this approach, false-positive rates are improved, and
for IPV6. Famous traditional IDSs like Snort and Bro just
the energy consumption is reduced.
worked on an IP-Based system, but they cannot manage a
heterogeneous environment. That is why new components b) Association Mining
should have the capacity to tackle such huge traffic. In [16], the
proposed system works dynamically and detects threats in real- Association mining classifies sets of items that commonly
time. After network installation, two sets of data are gathered. take place simultaneously in your dataset. It aims to draw out
By seeking the help of these datasets, a Machine Learning productive rules that help in producing new knowledge.
paradigm is created that acts as the core of the proposed model. Association rules are solely based on the relations between the
Wireshark is used as the network traffic analyzer. Nmap is used items. These rules are represented by two terms antecedent
as a network scanner to scan networks. Simple versions of DoS (predicts the consequence) and consequence (predicted by
attacks, such as UDP Flood and SYN Attacks, are injected for antecedent in association).Furthermore these rules predicts the
network evolution. Classification experiments are carried out occurrence of one item based on the occurrence of another
by using the well-known Weka ML tools. specific item. Analysis mechanism of Association mining
comprises of two main parts. First, to find out the item or
2. Unsupervised itemset from the given database. Second part is to identify
In unsupervised learning, we do not need to train the model. successive interferences from these itemset [21]. Applications
It produces results for unforeseen data based on its previous of Association mining are Basket data analysis, Cross
experience. Therefore, it can find all kinds of unknown patterns. marketing and Catalog design, etc.
 c) Clustering Security and defends smart things from the top level. An
approach based on SDN gateway is used for routing the traffic
The best model for data is to consider that it has multiple towards IoT. So, the gateway cannot pass an attack to the IoT
blobs. The main thing to build model like this, is that which data network. In [26], Alsmadi et al. discussed that the IDS system
point have relation with which blob. Data points that are close performs improved and intellectual detection on conceivable
enough are accumulated and created blobs from them. These network attacks that are projected to occur. Intrusion Prevention
blobs are known as clusters and the technique used in this System (IPS) works with the amalgamation of IDS to take
process is called clustering [22]. The most famous clustering action to terminate detected network attacks. But it is a very
algorithm was developed in 1957 that was k-means clustering. problematic assignment to find difference between malicious
After this, many other clustering algorithms have been traffic and normal traffic through IDS/IPS. So, in this paper,
proposed and used to give benefits to the users. In these days’ they proposed an SDN based IDS/IPS system to encounter these
data clustering is come up as an effective technique to correctly challenges. Because they measured that programmable
fulfil the categorizing of data in realistic groups [23]. networking is the best solution for these types of challenges.
B. Deep learning and SDN based IDS C. Blockchain and Automata-based IDS
Deep Learning is a function of artificial intelligence which Blockchain (BC) technology is based on P2P topology. It is
tends to make computer to decide like a human brain. It distributed ledger technology that has the potential to store data
comprises of three categories known as semi-supervised, on thousands of servers globally. There are a lot of successful
supervised, and unsupervised. SDN makes the network implementations of Blockchain technology, but the first one is
programmable. Instead of routers and switches, in SDN the Bitcoin network[10]. Collaborative IDS is used to tackle
centralized controller is used for control purposes. Routers and complex attacks, but it has flaws as well. This collaborative IDS
switches are just used as forwarding devices. SDN controller failed to mitigate personal attacks. Because of the distributed
has a universal view of the network, and by this, the structure existence, malicious nodes can provide false rules affecting the
of the network become easy to understand. detection of other nodes. Motivated by Blockchain technology
In [24] security solution is proposed by implementing a and to mitigate insider attacks, a CBSigIDS is proposed in [27].
novel IDS. In proposed work, the network connection phase and For distributed architecture, the proposed system provides a
network protocols of the host network are analyzed, and then signature based trustworthy environment over a collaborative
through virtual network channels, a connection is established. network.
The link prober module is primarily responsible for sending IoT devices work efficiently with a distributed, lightweight,
probe signals to all host network devices (IoT personal area and scalable Security and privacy approach. A system that has
network). Whenever a session request or handshake is received, the aforementioned characteristics (distributed, secure, and
the connection prober extracts the information of the received private nature) is Blockchain technology, which is the first
data packet and converts it into an appropriate protocol. Virtual cryptocurrency that supports Bitcoin [28]. A solution is
Network Client (VNC) module ensures the compatible network proposed in [29] based on an innovative instance of Bitcoin by
channels according to the information gathered in-network eliminating the need for coins and the idea of Proof of Work
prober module. Controller module controls, an interfaces data (POW). This anticipated model focused on tiered composition
packet, and command exchange among Data Collection, and distributed fashion to ensure the safety of Bitcoin. To
Transformation, and the VNC module. Connection Prober and convey the idea of their work in a better way, authors
VNC module are autonomous and are also controlled by the demonstrated their thoughts in the domain of smart home (an
Controller module. Data collection and transformation tears application of IoT). Overlay, smart home, and cloud storage are
down data packets extracts header tags as functions, populates three main parts of their projected design. The vulnerability of
the cached database, and then transfers all information to the built-in features, physical components, network device, and
anomaly detection module based on Machine Learning. application layer reside on different levels are a target by
Machine Learning-based anomaly detection module (MLAD) security issues. Different protocols are used by users to interact
consists of the Machine Learning engine. The engine is with these components, which can be demolished by security
responsible for separating the good tuple from the hostile tuple. threats. The various protocols supportive deployment of
If the monitoring module detects unusual activity and has a components adds to the complexity of these countermeasures.
tuple-related decision-trigger, it activates the Actuator module In [30] a survey of key security solutions is proposed. A
for further intervention. Otherwise, it activates the module of comprehensive analysis of security threats of all levels( high,
the Trainer, which requires human interaction to continue the intermediate, and low) and solutions of such filthy problems are
learning process. Trainer module is invoked when MLAD is discussed. IoT definition in the coming era is related to 5G
needed to prepare for an unknown tuple, and human Internet. In [31], authors suggest a model based on automatons.
intervention is also required. The key responsibility of the The proposed automata model can describe an IoT system's
Mitigation phase is to mitigate the attack and then launch an communication. The implementation of this model into the
appropriate response. The Handler component runs the intrusion detection framework became possible. The proposed
mitigation response on getting signal from Actuator module IDS based on automatons consists of four parts: Event monitor,
In [25], Wani et al. use SDN based intrusion detection Event Analyzer, Event Database, and Response Unit. But it
technique to remove major threats of IoT. This system provides focuses mainly on the Event Analyzer and Response Unit.
 Table 1: Summary of IDS techniques

Ref. Problem Technique Tool

Heterogeneity in IoT devices, easy access to penetration tools, ANN and Random Forest, UNSW-
[14] TShark as network protocol analyzer.
distributed environment NB15 dataset.
Sony Smart TV, Samsung smartwatch,
Heterogeneity, Incompatibility with IPV6, rule base IDS, no
[16] Supervised Nova 3I smartphone, HP wireless
evaluation in a real environment.
printer, Whirlpool smart AC
[15] Failure in novel detection. SVM, J.48 decision tree KDD99
[18] High energy consumption due to high computation power. Unsupervised (Anomaly detection) Nash Equilibrium.
[19] Fail to detect novel attacks, DoS, Probe, R2L, and U2R Smote KDD99, NSL-KDD
High energy consumption, Heterogenous devices, Internal and Game Theory, ANN, Anomaly
[20] TOSSIM, TinyOS
External attacks Detection by supervised algorithms.
[24] DDoS, Botnets, Virus or Malware, Data Theft. SDN Mininet 2.0, RYU controller
[25] Failure in novel detection. Deep Learning N/A
[26] Static Firewall rules, network attacks, SDN, SDN based IDS/IPS N/A
[27] Insider attacks Blockchain approach N/A
Computation and energy consumption overhead of traditional
[29] Blockchain technology, Bitcoin. N/A
security methods.
[30] Limited power and less memory of IoT devices Blockchain technology. KD 99 dataset.
Unauthorized user Due to long-distance DOS attacks, a IOLTS, The Needham-Shroeder Public
[31] Automata theory
dynamic environment. Key
Sinkhole attack, Selective forwarding, Wormhole attack, IP
[32] N/A Raspberry Pi, 3B model
spoof attack, and (DDoS).
[33] External Intruders, Internal Intruders, (DoS), Zero-Day attack SIM, SEM Apache Server
[34] Hello, flood attack and Sybil attack. Hybrid Approach N/A

D. IDSs for Denial of Service Attack, Hello Flood Attack SEM is used to monitor the collected information and detects
and Sybil Attack in IoT the attacks. In [34], Hodo et al. use the ANN techniques to
detect the various type of security attacks. This approach also
A solution is proposed against DOS attacks in [32] by can detect a Distributed Denial of Service (DDoS) attacks.
Sousa et al. The architecture of the system is as follows. ANN has two learning procedures, supervised and
Sensor, Packet Analyzer, Attack Detection, Generation unsupervised learning. In this technique, multi-layer
Rules, and the IPTABLES rules for output, which are the perception is used for training with the Feed-Forward
rules created by the firewall. It also has IP capture and packet Learning algorithm and Backward Learning algorithm.
capture modules. IP Capture module captures IP addresses of
all active devices over the network. IP Capture's output is IV. SURVEY FINDINGS
input to Packet Capture to detect attacks. Once the packets
IoT devices have less computation ability to perform
are collected, their features are extracted and loaded into the
bulky processing tasks. Yet security of IoT devices can’t be
database of DB Packs. Packet Analyzer uses these features to
compromised. To overcome aforementioned defect a solution
determine whether traffic is coming from registered network
is proposed in [8] based on machine learning algorithms.
devices. Packet Analyzer uses these features to determine
Proposed work has three modules data collection, data
whether traffic is coming from registered network devices. It
processing and detection module. Random Forest and Neural
then shares information with the Attack Detection module.
Networks are used for detection and categorization of the
The Attack Detection module is responsible for classifying
intrusions respectively. In [10] against DoS attacks a solution
the attack based on the features provided by the Packet
is proposed based on machine learning and rule-based
Analyzer. Finally, the attack record is inserted into the
approach to monitor the abnormal behavior of the network.
database. Generation Rules module produces the blocking
Machine learning approach assists in training the model for
function against the attacks based on the history of attacks
the normal activities of the network. This model can detect
stored in the database.
the anomaly even it occurs for the first time. Integrated
In [33], authors have proposed a tool named as Security Intrusion Detection System is proposed in [15] based on
Information and Event Management (SIEM). This tool has machine learning. This model doesn’t rely on router for
further two modules, Security Information Management information gathering, rather it operates separately. Proposed
(SIM) and Security Event Manager (SEM). The main aim of work comprises of three phases network connection,
SIM is to gather information from the distributed candidate detection and the mitigation phase. In [18] a blockchain based
resources of the system and store the collected information to collaborative IDS is proposed. This technique demolishes
a single destination, just like a database. In the phase of insider attacks that occur due to shared information among
collection information, various software and tools are used. IDS nodes. In [21] a survey of security threats to IoT devices
along with solutions based on Blockchain technology is Foundations and Applications of Self* Systems (FAS* W). 2016.
conducted. IEEE.
[14] Mohamed, T., T. Otsuka, and T. Ito, "Towards Machine Learning Based
V. CONCLUSION IoT Intrusion Detection Service". in International Conference on
Industrial, Engineering and Other Applications of Applied Intelligent
IoT is collection of devices with network connectivity. It is a Systems. 2018. Springer.
heterogeneous environment, as devices of different [15] Mehmood, T. and H.B.M. Rais, "Machine learning algorithms in
manufacturers and specifications are connected to obtain the context of intrusion detection". in 2016 3rd International Conference
objective of IoT. As IoT is evolving, but manufacturers have on Computer and Information Sciences (ICCOINS). 2016. IEEE.
not paid any reasonable security measurements. [16] Mridha, M., M.A. Hamid, and M. Asaduzzaman, "Issues of Internet of
Manufacturer of smart devices (smart lock, smart AC, smart Things (IoT) and an intrusion detection system for IoT using machine
learning paradigm". in Proceedings of International Joint Conference
meters, etc.) mainly focuses on the less computational and on Computational Intelligence. 2020. Springer.
low energy consumption devices, consequently left behind [17] Sarmah, D.K., "A Survey on the Latest Development of Machine
the security approaches for the devices. To tackle security Learning in Genetic". Optimization in Machine Learning and
vulnerabilities, various techniques are being carried out; IDS Applications: p. 91.
is one of them. Related works that have surveyed IDS has [18] Sedjelmaci, H., S.M. Senouci, and M. Al-Bahri, "A lightweight
covered IDS only in general terms. We follow a new way to anomaly detection technique for low-resource IoT devices: a game-
survey IDS; we have first chosen various techniques being theoretic methodology". in 2016 IEEE International Conference on
Communications (ICC). 2016. IEEE.
implemented in IDS. And then gathered the information for
[19] Pajouh, H.H., G. Dastghaibyfard, and S. Hashemi, "Two-tier network
each category based on technology and technique. In this anomaly detection model: a machine learning approach". Journal of
paper, we have surveyed IDS using Machine Learning, Deep Intelligent Information Systems, 2017. 48(1): p. 61-74.
Learning, Blockchain, Automata theory, and SDN. [20] Sedjelmaci, H., S.M. Senouci, and T. Taleb, "An accurate security game
for low-resource IoT devices". IEEE Transactions on Vehicular
REFERENCES Technology, 2017. 66(10): p. 9381-9393.
[1] Porkodi, R. and V. Bhuvaneswari, "The internet of things (IOT) [21] Ceglar, A. and J.F. Roddick, "Association mining". ACM Computing
applications and communication enabling technology standards: An Surveys (CSUR), 2006. 38(2): p. 5-es.
overview". in 2014 International conference on intelligent computing [22] Forsyth, D., "Clustering", in Applied Machine Learning. 2019,
applications. 2014. IEEE. Springer. p. 155-182.
[2] Lou, Y., et al., "Personalized gesture interactions for cyber-physical [23] Ghosal, A., et al., "A short review on different clustering techniques
smart-home environments". Science China Information Sciences, and their applications", in Emerging Technology in Modelling and
2017. 60(7): p. 072104. Graphics. 2020, Springer. p. 69-83.
[3] Collen, A., et al., "Ghost-safe-guarding home IoT environments with [24] Chawla, S. and G. Thamilarasu, "Security as a service: real-time
personalised real-time risk control". in International ISCIS Security intrusion detection in internet of things". in Proceedings of the Fifth
Workshop. 2018. Springer. Cybersecurity Symposium. 2018.
[4] Kanuparthi, A., R. Karri, and S. Addepalli, "Hardware and embedded [25] Wani, A. and S. Revathi, "Analyzing threats of iot networks using sdn
security in the context of internet of things". in Proceedings of the 2013 based intrusion detection system (sdiot-ids)". in International
ACM workshop on Security, privacy & dependability for cyber Conference on Next Generation Computing Technologies. 2017.
vehicles. 2013. Springer.
[5] Faheem, M., et al., "Smart grid communication and information [26] Alsmadi, I.M. and A. AlEroud, "SDN-based real-time IDS/IPS alerting
technologies in the perspective of Industry 4.0: Opportunities and system", in Information Fusion for Cyber-Security Analytics. 2017,
challenges". Computer Science Review, 2018. 30: p. 1-30. Springer. p. 297-306.
[6] Shah, S.H. and I. Yaqoob, "A survey: Internet of Things (IOT) [27] Li, W., et al., "Designing collaborative blockchained signature-based
technologies, applications and challenges". in 2016 IEEE Smart Energy intrusion detection in IoT environments". Future Generation Computer
Grid Engineering (SEGE). 2016. IEEE. Systems, 2019. 96: p. 481-489.
[7] Amin, R., M. Reisslein, and N. Shah, "Hybrid SDN networks: A survey [28] Nakamoto, S., "A peer-to-peer electronic cash system". Bitcoin.–URL:
of existing approaches". IEEE Communications Surveys & Tutorials, https://bitcoin. org/bitcoin. pdf, 2008.
2018. 20(4): p. 3259-3306.
[29] Dorri, A., et al., "Blockchain for IoT security and privacy: The case
[8] Faheem, M., et al., "Energy efficient and reliable data gathering using study of a smart home". in 2017 IEEE international conference on
internet of software-defined mobile sinks for WSNs-based smart grid pervasive computing and communications workshops (PerCom
applications". Computer Standards & Interfaces, 2019. 66: p. 103341. workshops). 2017. IEEE.
[9] Ganapathy, S., et al., "Intelligent feature selection and classification [30] Khan, M.A. and K. Salah, "IoT security: Review, blockchain solutions,
techniques for intrusion detection in networks: a survey". EURASIP and open challenges". Future Generation Computer Systems, 2018. 82:
Journal on Wireless Communications and Networking, 2013. 2013(1): p. 395-411.
p. 271.
[31] Fu, Y., et al., "An automata based intrusion detection method for
[10] Pandey, P. and A. Barve, "An Energy-Efficient Intrusion Detection internet of things". Mobile Information Systems, 2017. 2017.
System for MANET", in Data, Engineering and Applications. 2019,
[32] Sousa, B.F.L.M., et al., "An intrusion detection system for denial of
Springer. p. 103-117.
service attack detection in internet of things". in Proceedings of the
[11] Witten, I.H. and E. Frank, "Data mining: practical machine learning Second International Conference on Internet of things, Data and Cloud
tools and techniques with Java implementations". Acm Sigmod Record, Computing. 2017.
2002. 31(1): p. 76-77.
[33] Sornalakshmi, K., "Detection of DoS attack and zero day threat with
[12] Pandeeswari, N. and G. Kumar, "Anomaly detection system in cloud SIEM". in 2017 International Conference on Intelligent Computing and
environment using fuzzy clustering based ANN". Mobile Networks and Control Systems (ICICCS). 2017. IEEE.
Applications, 2016. 21(3): p. 494-505.
[34] Hodo, E., et al., "Threat analysis of IoT networks using artificial neural
[13] Pacheco, J. and S. Hariri, "IoT security framework for smart cyber network intrusion detection system". in 2016 International Symposium
infrastructures". in 2016 IEEE 1st International Workshops on on Networks, Computers and Communications (ISNCC). 2016. IEEE.