ISAAF: an IoT security and attack prevention framework using AI-driven predictive analytics

Area of Science:

• Cybersecurity
• Artificial Intelligence
• Internet of Things

Background:

• The Message Queuing Telemetry Transport (MQTT) protocol, crucial for IoT connectivity, is vulnerable to various cyber threats.
• Existing machine learning (ML) and deep learning (DL) models struggle to generalize intrusion detection from simulated to real-world IoT traffic.
• The MQTTEEB-D dataset, collected from a real operational IoT testbed, addresses the need for realistic data.

Purpose of the Study:

• To introduce a novel, layered, AI-driven security framework for real-time intrusion detection and automated mitigation in IoT environments.
• To evaluate the performance of ML/DL models trained on real-world IoT data compared to simulated benchmarks.
• To demonstrate the framework's effectiveness in detecting and mitigating cyber threats in operational IoT scenarios.

Main Methods:

• Development of a layered, AI-driven security framework utilizing the MQTTEEB-D dataset.
• Retraining of Decision Tree (DT) and Gated Recurrent Unit (GRU) models on the MQTTEEB-D dataset.
• Deployment and testing of the framework in real-world IoT settings to assess detection and mitigation capabilities.

Main Results:

• ML/DL models (DT, GRU) showed drastically improved accuracy (DT: 87%, GRU: 86.5%) when retrained on the MQTTEEB-D dataset, compared to initial low accuracies (8%, 21%) on real data after training on simulated data.
• The proposed framework demonstrated efficient detection and mitigation of attacks with near-real-time responsiveness in experimental scenarios.
• The framework proved scalable, deployable, and effective across different domains for real-world IoT applications.

Conclusions:

• Real-world datasets like MQTTEEB-D are essential for developing robust IoT intrusion detection systems.
• The AI-driven layered security framework offers a significant advancement in securing IoT applications against cyber threats.
• The proposed solution provides a practical and effective security measure for diverse, real-world IoT deployments.