Computer Science Department, College of Computer and Information Sciences, King Saud University, Riyadh 11543, Saudi Arabia.
Sensors (Basel). 2020 Nov 6;20(21):6336. doi: 10.3390/s20216336.
Nowadays, Internet of Things (IoT) technology has various network applications and has attracted the interest of many research and industrial communities. Particularly, the number of vulnerable or unprotected IoT devices has drastically increased, along with the amount of suspicious activity, such as IoT botnet and large-scale cyber-attacks. In order to address this security issue, researchers have deployed machine and deep learning methods to detect attacks targeting compromised IoT devices. Despite these efforts, developing an efficient and effective attack detection approach for resource-constrained IoT devices remains a challenging task for the security research community. In this paper, we propose an efficient and effective IoT botnet attack detection approach. The proposed approach relies on a Fisher-score-based feature selection method along with a genetic-based extreme gradient boosting (GXGBoost) model in order to determine the most relevant features and to detect IoT botnet attacks. The Fisher score is a representative filter-based feature selection method used to determine significant features and discard irrelevant features through the minimization of intra-class distance and the maximization of inter-class distance. On the other hand, GXGBoost is an optimal and effective model, used to classify the IoT botnet attacks. Several experiments were conducted on a public botnet dataset of IoT devices. The evaluation results obtained using holdout and 10-fold cross-validation techniques showed that the proposed approach had a high detection rate using only three out of the 115 data traffic features and improved the overall performance of the IoT botnet attack detection process.
如今,物联网 (IoT) 技术拥有各种网络应用,并吸引了许多研究和工业界的关注。特别是,易受攻击或未受保护的物联网设备的数量急剧增加,同时可疑活动(如物联网僵尸网络和大规模网络攻击)的数量也在增加。为了解决这个安全问题,研究人员已经部署了机器学习和深度学习方法来检测针对受感染的物联网设备的攻击。尽管做出了这些努力,但是为资源受限的物联网设备开发高效和有效的攻击检测方法仍然是安全研究社区面临的一项挑战。在本文中,我们提出了一种高效和有效的物联网僵尸网络攻击检测方法。该方法依赖于基于 Fisher 得分的特征选择方法和基于遗传的极端梯度提升 (GXGBoost) 模型,以确定最相关的特征并检测物联网僵尸网络攻击。Fisher 得分是一种基于过滤的特征选择方法,用于通过最小化类内距离和最大化类间距离来确定显著特征并丢弃不相关特征。另一方面,GXGBoost 是一种最优和有效的模型,用于对物联网僵尸网络攻击进行分类。在物联网设备的公共僵尸网络数据集上进行了多次实验。使用保留和 10 折交叉验证技术获得的评估结果表明,该方法仅使用 115 个数据流量特征中的三个特征就具有很高的检测率,并提高了物联网僵尸网络攻击检测过程的整体性能。