Edge-ML based nework intrusion detection system for IoT devices.

Abstract

In recent years, there has been a substantial proliferation in the use of the Internet of Things in a wide variety of domains, from providing new services and options in smart home applications to industrial IoT, automating healthcare, power grids and more. However, IoT networks are prone to security breaches due to the limited computational power and constrained resources of these devices, which cannot support traditional security mechanisms. This security concern is increasingly becoming a relevant research issue, for which a number of Network Intrusion Detection Systems (NIDSs) have been proposed. In this report, we develop and implement a practical machine learning based IoT network intrusion detection system that operates on low-end microcontrollers. The proposed system is deployed on edge which ensures a fast response to attacks targeting IoT devices, thanks to the decentralized data processing. Privacy of network users is also preserved as data is kept locally at the edge of the network. Two prototypes were proposed for the realization of this project, which are based on the Raspberry Pi and the ESP32 Microcontroller. The ESP32 based prototype is composed of three sub-systems, each utilizing an ESP32 MCU. Four distinct Machine Learning algorithms were explored to detect malicious from benign traffic, and recognize the type of attack, reaching up to an accuracy of 99.76% and an F1-score of 94.25% for tree-based models. A detailed evaluation and comparison of the models was conducted. The most accurate model was selected and then optimized to obtain a light weight and faster executable version, for an easier deployment on edge. The models were additionally tested on real-world data, by predicting the class label of previously unseen data from new Pcap files.