Agbedanu Promise Ricardo, Yang Shanchieh Jay, Musabe Richard, Gatare Ignace, Rwigema James
African Centre of Excellence for Internet of Things, University of Rwanda, Kigali P.O. Box 4285, Rwanda.
Global Cybersecurity Institute, Rochester Institute of Technology, Rochester, NY 14623, USA.
Sensors (Basel). 2025 Jan 2;25(1):216. doi: 10.3390/s25010216.
The Internet of Things (IoT) and Industrial Internet of Things (IIoT) have drastically transformed industries by enhancing efficiency and flexibility but have also introduced substantial cybersecurity risks. The rise of zero-day attacks, which exploit unknown vulnerabilities, poses significant threats to these interconnected systems. Traditional signature-based intrusion detection systems (IDSs) are insufficient for detecting such attacks due to their reliance on pre-defined attack signatures. This study investigates the effectiveness of Adaptive SAMKNN, an adaptive k-nearest neighbor with self-adjusting memory (SAM), in detecting and responding to various attack types in Internet of Things (IoT) environments. Through extensive testing, our proposed method demonstrates superior memory efficiency, with a memory footprint as low as 0.05 MB, while maintaining high accuracy and F1 scores across all datasets. The proposed method also recorded a detection rate of 1.00 across all simulated zero-day attacks. In scalability tests, the proposed technique sustains its performance even as data volume scales up to 500,000 samples, maintaining low CPU and memory consumption. However, while it excels under gradual, recurring, and incremental drift, its sensitivity to sudden drift highlights an area for further improvement. This study confirms the feasibility of Adaptive SAMKNN as a real-time, scalable, and memory-efficient solution for IoT and IIoT security, providing reliable anomaly detection without overwhelming computational resources. Our proposed method has the potential to significantly increase the security of IoT and IIoT environments by enabling the real-time, scalable, and efficient detection of sophisticated cyber threats, thereby safeguarding critical interconnected systems against emerging vulnerabilities.
物联网（IoT）和工业物联网（IIoT）通过提高效率和灵活性彻底改变了各个行业，但同时也带来了重大的网络安全风险。利用未知漏洞的零日攻击的兴起，对这些互联系统构成了重大威胁。传统的基于签名的入侵检测系统（IDS）由于依赖预定义的攻击签名，不足以检测此类攻击。本研究调查了自适应SAMKNN（一种具有自调整内存（SAM）的自适应k近邻算法）在检测和应对物联网（IoT）环境中各种攻击类型方面的有效性。通过广泛测试，我们提出的方法展示了卓越的内存效率，内存占用低至0.05 MB，同时在所有数据集上保持高精度和F1分数。所提出的方法在所有模拟的零日攻击中检测率也达到了1.00。在可扩展性测试中，即使数据量扩大到500,000个样本，所提出的技术仍能保持其性能，保持低CPU和内存消耗。然而，虽然它在渐进、重复和增量漂移情况下表现出色，但其对突然漂移的敏感性突出了需要进一步改进的领域。本研究证实了自适应SAMKNN作为物联网和工业物联网安全的实时、可扩展且内存高效的解决方案的可行性，在不占用过多计算资源的情况下提供可靠的异常检测。我们提出的方法有可能通过实现对复杂网络威胁的实时、可扩展和高效检测，显著提高物联网和工业物联网环境的安全性，从而保护关键互联系统免受新出现的漏洞影响。
