Hybrid Internal Anomaly Detection System for IoT: Reactive Nodes with Cross-Layer Operation
Joint Authors
Thanigaivelan, Nanda Kumar
Nigussie, Ethiopia
Virtanen, Seppo
Isoaho, Jouni
Source
Security and Communication Networks
Issue
Vol. 2018, Issue 2018 (31 Dec. 2018), pp.1-15, 15 p.
Publisher
Hindawi Publishing Corporation
Publication Date
2018-08-15
Country of Publication
Egypt
No. of Pages
15
Main Subjects
Information Technology and Computer Science
Abstract EN
We present a hybrid internal anomaly detection system that shares detection tasks between router and nodes.
It allows nodes to react instinctively against the anomaly node by enforcing temporary communication ban on it.
Each node monitors its own neighbors and if abnormal behavior is detected, the node blocks the packets of the anomaly node at link layer and reports the incident to its parent node.
A novel RPL control message, Distress Propagation Object (DPO), is formulated and used for reporting the anomaly and network activities to the parent node and subsequently to the router.
The system has configurable profile settings and is able to learn and differentiate between the nodes normal and suspicious activities without a need for prior knowledge.
It has different subsystems and operation phases that are distributed in both the nodes and router, which act on data link and network layers.
The system uses network fingerprinting to be aware of changes in network topology and approximate threat locations without any assistance from a positioning subsystem.
The developed system was evaluated using test-bed consisting of Zolertia nodes and in-house developed PandaBoard based gateway as well as emulation environment of Cooja.
The evaluation revealed that the system has low energy consumption overhead and fast response.
The system occupies 3.3 KB of ROM and 0.86 KB of RAM for its operations.
Security analysis confirms nodes reaction against abnormal nodes and successful detection of packet flooding, selective forwarding, and clone attacks.
The system’s false positive rate evaluation demonstrates that the proposed system exhibited 5% to 10% lower false positive rate compared to simple detection system.
American Psychological Association (APA)
Thanigaivelan, Nanda Kumar& Nigussie, Ethiopia& Virtanen, Seppo& Isoaho, Jouni. 2018. Hybrid Internal Anomaly Detection System for IoT: Reactive Nodes with Cross-Layer Operation. Security and Communication Networks،Vol. 2018, no. 2018, pp.1-15.
https://search.emarefa.net/detail/BIM-1214091
Modern Language Association (MLA)
Thanigaivelan, Nanda Kumar…[et al.]. Hybrid Internal Anomaly Detection System for IoT: Reactive Nodes with Cross-Layer Operation. Security and Communication Networks No. 2018 (2018), pp.1-15.
https://search.emarefa.net/detail/BIM-1214091
American Medical Association (AMA)
Thanigaivelan, Nanda Kumar& Nigussie, Ethiopia& Virtanen, Seppo& Isoaho, Jouni. Hybrid Internal Anomaly Detection System for IoT: Reactive Nodes with Cross-Layer Operation. Security and Communication Networks. 2018. Vol. 2018, no. 2018, pp.1-15.
https://search.emarefa.net/detail/BIM-1214091
Data Type
Journal Articles
Language
English
Notes
Includes bibliographical references
Record ID
BIM-1214091