Behavior of the DenStream Clustering Algorithm for Attack Detection in the Internet of Things

Gabriel Keith Tazima; Bruno Bogaz Zarpelao (COMP/UEL)

doi:10.5433/1679-0375.2023.v44.48956

Comportamento do Algoritmo de Clusterização DenStream na Detecção de Ataques em Internet das Coisas

Autores

Gabriel Keith Tazima Universidade Estadual de Londrina - DC/UEL https://orcid.org/0009-0000-2529-1092
Bruno Bogaz Zarpelao (COMP/UEL) Universidade Estadual de Londrina - DC/UEL https://orcid.org/0000-0001-9172-3578

DOI:

https://doi.org/10.5433/1679-0375.2023.v44.48956

Palavras-chave:

mineração de fluxos contínuos de dados, detecção de ciberataques, internet das coisas, cibersegurança

Resumo

Como opção para melhorar a proteção da Internet das Coisas (Internet of Things - IoT), a literatura apresenta diversas propostas de detecção de ataques baseadas em aprendizado de máquina em lote supervisionado. Essas propostas requerem exemplos de tráfego benigno e malicioso para treinamento, além de encontrar dificuldade para se adaptar a mudanças nos dados analisados. Neste trabalho, estudamos como podemos aplicar um algoritmo de mineração de fluxos de dados contínuos não supervisionado denominado DenStream para detecção de ataques em IoT. Algoritmos desse tipo não requerem amostras rotuladas e aprendem de maneira incremental, adaptando-se a mudanças. O objetivo do trabalho é investigar se, ao monitorar o comportamento dos clusters criados pelo DenStream, podemos identificar a ocorrência de ataques. Os resultados mostraram que o DenStream pode prover indicadores para detecção de ataques em tráfego TCP, UDP e ICMP.

Métricas

Carregando Métricas ...

Biografia do Autor

Gabriel Keith Tazima, Universidade Estadual de Londrina - DC/UEL

Mestrando, Departamento de Ciência da Computação, Universidade Estadual de Londrina, Londrina, Paraná, Brasil

Bruno Bogaz Zarpelao (COMP/UEL), Universidade Estadual de Londrina - DC/UEL

Professor Associado, Departamento de Ciência da Computação da Universidade Estadual de Londrina (UEL), Londrina, Paraná, Brasil

Referências

Aggarwal, C. C., Philip, S. Y., Han, J., & Wang, J. (2003). A Framework for Clustering Evolving Data Streams. In Association for Computing Machinery, VLDB 03 Proceedings [Conference]. 29th International Conference on Very Large Data Bases. DOI: https://doi.org/10.1016/B978-012722442-8/50016-1

Anthi, E., Williams, L., Słowińska, M., Theodorakopoulos, G., & Burnap, P. (2019). A supervised intrusion detection system for smart home IoT devices. IEEE Internet of Things Journal, 6(5), 9042–9053. DOI: https://doi.org/10.1109/JIOT.2019.2926365

Cao, F., Ester, M., Qian, W., & Zhou, A. (2006). Density-Based Clustering over an Evolving Data Stream with Noise. In Society for Industrial and Applied Mathematics, Proceedings of the 2006 SIAM International Conference on Data Mining [Conference]. SIAM International Conference on Data Mining, Philadelphia. DOI: https://doi.org/10.1137/1.9781611972764.29

Chow, R. (2017). The Last Mile for IoT Privacy. IEEE Security & Privacy, 15(6), 73–76. DOI: https://doi.org/10.1109/MSP.2017.4251118

Gama, J. (2010). Knowledge discovery from data streams. CRC Press. DOI: https://doi.org/10.1201/EBK1439826119

Gama, J., & Rodrigues, P. P. (2007). Data Stream Processing. In J. Gama & M. M. Gaber (Eds.), Learning from Data Streams: Processing Techniques in Sensor Networks (pp. 25–39). Springer Berlin Heidelberg. DOI: https://doi.org/10.1007/3-540-73679-4_3

Lohiya, R., & Thakkar, A. (2020). A Review on Machine Learning and Deep Learning Perspectives of IDS for IoT: Recent Updates, Security Issues, and Challenges. Archives of Computational Methods in Engineering, 28, 3211–3243. DOI: https://doi.org/10.1007/s11831-020-09496-0

Mohammadi, M., Rashid, T. A., Karim, S. H., Aldalwie, A. H. M., Tho, Q. T., Bidaki, M., Rahmani, A. M., & Hosseinzadeh, M. (2021). A comprehensive survey and taxonomy of the SVM-based intrusion detection systems. Journal of Network and Computer Applications, 178, 102983. DOI: https://doi.org/10.1016/j.jnca.2021.102983

Moustafa, N., Turnbull, B., & Choo, K.-K. R. (2019). An ensemble intrusion detection technique based on proposed statistical flow features for protecting network traffic of Internet of Things. IEEE Internet of Things Journal, 6(3), 4815–4830. DOI: https://doi.org/10.1109/JIOT.2018.2871719

Muthukrishnan, S. (2005). Data streams: Algorithms and applications. Now Publishers Inc. DOI: https://doi.org/10.1561/9781933019604

Nakagawa, F. H. Y., Barbon, S. J., & Zarpelão, B. B. (2021). Attack Detection in Smart Home IoT Networks using CluStream and Page-Hinkley Test. In Institute of Electrical and Electronics Engineers, 2021 IEEE Latin-American Conference on Communications (LATINCOM) [Conference]. Latin-American Conference on Communications (LATINCOM), Santo Domingo, Dominican Republic. DOI: https://doi.org/10.1109/LATINCOM53176.2021.9647769

Page, E. S. (1954). Continuous Inspection Schemes. Biometrika, 41(1/2), 100–115. DOI: https://doi.org/10.1093/biomet/41.1-2.100

Pishva, D. (2017). Internet of things: Security and privacy issues and possible solution. In Institute of Electrical and Electronics Engineers, International Conference on Advanced Communication Technology (ICACT) [Conference]. 19th International Conference on Advanced Communication Technology (ICACT), PyeongChang, Korea, 797–808. DOI: https://doi.org/10.23919/ICACT.2017.7890229

Ramírez-Gallego, S., Krawczyk, B., García, S., Woźniak, M., & Herrera, F. (2017). A survey on data preprocessing for data stream mining: Current status and future directions. Neurocomputing, 239, 39–57. DOI: https://doi.org/10.1016/j.neucom.2017.01.078

River. (2022). Standardscaler. https://riverml.xyz/0.15.0/ api/preprocessing/StandardScaler/

River. (2023). Pagehinkley. Pagehinkley. https://riverml.xyz/0.18.0/ api/drift/PageHinkley/

Scaranti, G. F., Carvalho, L. F., Barbon, S., Lloret, J., & Proença, M. L. (2022). Unsupervised online anomaly detection in Software Defined Network environments. Expert Systems with Applications, 191, 116225. DOI: https://doi.org/10.1016/j.eswa.2021.116225

Yang, K., Ren, J., Zhu, Y., & Zhang, W. (2018). Active Learning for Wireless IoT Intrusion Detection. IEEE Wireless Communications, 25(6), 19–25. DOI: https://doi.org/10.1109/MWC.2017.1800079

Yin, C., Xia, L., Zhang, S., Sun, R., & Wang, J. (2018). Improved clustering algorithm based on high-speed network data stream. Soft computing (Berlin, Germany), 22(13), 4185–4195. DOI: https://doi.org/10.1007/s00500-017-2708-2

Zarpelão, B. B., Miani, R. S., Kawakani, C. T., & de Alvarenga, S. C. (2017). A survey of intrusion detection in Internet of Things. Journal of Network and Computer Applications, 84, 25–37. DOI: https://doi.org/10.1016/j.jnca.2017.02.009

Zheng, S., Apthorpe, N., Chetty, M., & Feamster, N. (2018). User Perceptions of Smart Home IoT Privacy. Proc. ACM Hum.-Comput. Interact., 2(CSCW). DOI: https://doi.org/10.1145/3274469