Invariant state modelling for robust adaptive intrusion detection in software-defined internet of things environments

Area of Science:

• Cybersecurity
• Network Intrusion Detection Systems
• Internet of Things (IoT) Security

Background:

• Software-Defined Internet of Things (SD-IoT) networks face challenges with heterogeneous traffic, limited throughput, and evolving cyber threats.
• Existing intrusion detection systems (IDS) struggle to address the dynamic and complex nature of attacks in SD-IoT environments.
• There is a need for a unified and deployable IDS framework capable of robust and adaptive threat detection.

Purpose of the Study:

• To design and evaluate a novel IDS framework, Robust Adaptive Intrusion Detection Using Invariant State (RADIUS), for SD-IoT networks.
• To address limitations in traffic analysis, detection accuracy, and adaptability to non-stationary attacks.
• To provide interpretable and adaptive threat detection mechanisms.

Main Methods:

• Utilized a Temporal Convolution Encoder (TCE) with dilated and causal convolutions for efficient traffic embedding.
• Incorporated an Adaptive State Transition Module (ASTM) for identifying latent state transitions and enabling adaptive detections.
• Employed dual-objective optimization during training, focusing on prediction accuracy, environment-invariance, and sensitivity to rare events.
• Applied Extreme Value Theory (EVT) with conformal bounds for anomaly scoring and classification calibration.

Main Results:

• The RADIUS framework achieved high performance metrics: 99.8% accuracy, 99.5% precision, 99.8% recall, and 99.7% F1-score.
• Demonstrated consistent performance outperforming the Extended Wrapper Approach (EWA) baseline model.
• Showcased the effectiveness of TCE and ASTM in constructing efficient embeddings and identifying adaptive state transitions.

Conclusions:

• The RADIUS framework offers a robust and deployable solution for intrusion detection in SD-IoT networks.
• Its adaptive capabilities and high accuracy make it suitable for addressing complex and evolving cyber threats.
• RADIUS provides a significant advancement over existing methods, enhancing the security posture of SD-IoT environments.