Anomaly Detection for Internet of Things (IoT) Using an Artificial Immune System

Abstract

Internet of Things (IoT) have demonstrated significant impact on all aspects of human daily lives due to their pervasive applications in areas such as telehealth, home appliances, surveillance, and wearable devices. The number of IoT devices and sensors connected to the Internet across the world is expected to reach over 50 billion by the end of 2020. The connection of such rapidly increasing number of IoT devices to the Internet leads to concerns in cyber-attacks such as malware, worms, denial of service attack (DoS) and distributed DoS attack (DDoS). To prevent these attacks from compromising the performance of IoT devices, various approaches for detecting and mitigating cyber security threats have been developed. This paper reports an IoT attack and anomaly detection approach by using the dendritic cell algorithm (DCA). In particular, DCA is an artificial immune system (AIS), which is developed from the inspiration of the working principles and characteristic behaviours of the human immune system (HIS), specifically for the purpose of detecting anomalies in networked systems. The performance of the DCA on detecting IoT attacks is evaluated using publicly available IoT datasets, including DoS, DDoS, Reconnaissance, Keylogging, and Data exfiltration. The experimental results show that, the DCA achieved a comparable detection performance to some of the commonly used classifiers, such as decision trees, random forests, support vector machines, artificial neural network and naïve Bayes, but with reasonably high computational efficiency.

This work has been supported by the Commonwealth Scholarship Commission (CSC-TZCS-2017-717), the Royal Academy of Engineering (IAPP1$\setminus$100077), and Mr. Aminu Abulmalik who contributed to data processing and part of the experimentation under the Royal Academy of Engineering project.