Detecting Unusual Repetitive Patterns of Behavior Indicative of a Loop-Based Attack in IoT

Area of Science:

• Cybersecurity
• Machine Learning
• Internet of Things (IoT) Security

Background:

• Internet of Things (IoT) devices face significant risks of compromise.
• Traditional attack detection methods are often ineffective due to IoT device limitations like battery life and processing power.

Purpose of the Study:

• To develop and evaluate a novel loop-based machine learning approach for detecting attacks in IoT environments.
• To address the limitations of existing detection techniques for resource-constrained IoT devices.

Main Methods:

• Extracted loop-based patterns from the CTU-IoT-Malware-Capture-7-1 dataset (Linux, Mirai).
• Implemented and evaluated nine machine learning models for loop-based attack detection.
• Utilized the XGBoost model for its superior performance in identifying malicious patterns.

Main Results:

• The XGBoost model achieved high performance metrics: 8.85% Accuracy, 96.57% Precision (Class), and 96.72% Recall (Class 1).
• Demonstrated exceptional capability in handling large IoT datasets and generalizing across diverse malicious behavior patterns.
• Showcased robustness in distinguishing between attack and normal activity, minimizing false positives and negatives.

Conclusions:

• The loop-based detection approach using machine learning, particularly XGBoost, is highly effective for real-time IoT threat detection.
• XGBoost offers a superior solution for identifying intricate and diverse malicious activities in IoT networks.
• This method enhances the security of IoT ecosystems by providing reliable and accurate attack detection capabilities.