Department of Informatics, Kyushu University, Fukuoka 819-0395, Japan.
Department of Electrical and Information Engineering, Universitas Gadjah Mada, Yogyakarta 55281, Indonesia.
Sensors (Basel). 2020 Aug 5;20(16):4372. doi: 10.3390/s20164372.
With the rapid development and popularization of Internet of Things (IoT) devices, an increasing number of cyber-attacks are targeting such devices. It was said that most of the attacks in IoT environments are botnet-based attacks. Many security weaknesses still exist on the IoT devices because most of them have not enough memory and computational resource for robust security mechanisms. Moreover, many existing rule-based detection systems can be circumvented by attackers. In this study, we proposed a machine learning (ML)-based botnet attack detection framework with sequential detection architecture. An efficient feature selection approach is adopted to implement a lightweight detection system with a high performance. The overall detection performance achieves around 99% for the botnet attack detection using three different ML algorithms, including artificial neural network (ANN), J48 decision tree, and Naïve Bayes. The experiment result indicates that the proposed architecture can effectively detect botnet-based attacks, and also can be extended with corresponding sub-engines for new kinds of attacks.
随着物联网 (IoT) 设备的快速发展和普及，针对这些设备的网络攻击越来越多。据称，物联网环境中的大多数攻击都是基于僵尸网络的攻击。由于大多数物联网设备的内存和计算资源不足，无法实现强大的安全机制，因此仍然存在许多安全漏洞。此外，许多现有的基于规则的检测系统可能会被攻击者规避。在这项研究中，我们提出了一种基于机器学习 (ML) 的僵尸网络攻击检测框架，采用顺序检测架构。采用一种有效的特征选择方法，实现了具有高性能的轻量级检测系统。使用三种不同的机器学习算法，包括人工神经网络 (ANN)、J48 决策树和朴素贝叶斯，对僵尸网络攻击检测的整体检测性能达到了 99%左右。实验结果表明，所提出的架构可以有效地检测基于僵尸网络的攻击，并且还可以通过相应的子引擎进行扩展，以检测新的攻击类型。
