Repository logo
 
Publication

A flow-based intrusion detection framework for internet of things networks

2023Journal article Open access
Simple item page
dc.contributor.authorSantos, Leonel
dc.contributor.authorGonçalves, Ramiro Manuel
dc.contributor.authorRabadão, Carlos
dc.contributor.authorMartins, José
dc.date.accessioned2022-03-25T16:04:38Z
dc.date.available2022-03-25T16:04:38Z
dc.date.issued2023
dc.description.abstractThe application of the Internet of Things concept in domains such as industrial control, building automation, human health, and environmental monitoring, introduces new privacy and security challenges. Consequently, traditional implementation of monitoring and security mechanisms cannot always be presently feasible and adequate due to the number of IoT devices, their heterogeneity and the typical limitations of their technical specifications. In this paper, we propose an IP flow-based Intrusion Detection System (IDS) framework to monitor and protect IoT networks from external and internal threats in real-time. The proposed framework collects IP flows from an IoT network and analyses them in order to monitor and detect attacks, intrusions, and other types of anomalies at different IoT architecture layers based on some flow features instead of using packet headers fields and their payload. The proposed framework was designed to consider both the IoT network architecture and other IoT contextual characteristics such as scalability, heterogeneity, interoperability, and the minimization of the use of IoT networks resources. The proposed IDS framework is network-based and relies on a hybrid architecture, as it involves both centralized analysis and distributed data collection components. In terms of detection method, the framework uses a specification-based approach drawn on normal traffic specifications. The experimental results show that this framework can achieve & 100% success and 0% of false positives in detection of intrusions and anomalies. In terms of performance and scalability in the operation of the IDS components, we study and compare it with three different conventional IDS (Snort, Suricata, and Zeek) and the results demonstrate that the proposed solution can consume fewer computational resources (CPU, RAM, and persistent memory) when compared to those conventional IDS.pt_PT
dc.description.sponsorshipThis work was supported by Portuguese national funds through the FCT—Foundation for Science and Technology, I.P., under the project UID/CEC/04524/2019.pt_PT
dc.description.versioninfo:eu-repo/semantics/publishedVersionpt_PT
dc.identifier.citationSantos, Leonel; Gonçalves, Ramiro; Rabadão, Carlos; Martins, José (2023). A flow-based intrusion detection framework for internet of things networks. Cluster Computing. ISSN 1386-7857. 26, p. 37-57pt_PT
dc.identifier.doi10.1007/s10586-021-03238-ypt_PT
dc.identifier.issn1386-7857
dc.identifier.urihttp://hdl.handle.net/10198/25293
dc.language.isoengpt_PT
dc.peerreviewedyespt_PT
dc.publisherSpringerpt_PT
dc.relationCentro de Investigação em Informática e Comunicações
dc.rights.urihttp://creativecommons.org/licenses/by-nc/4.0/pt_PT
dc.subjectInternet of thingspt_PT
dc.subjectNetwork monitoringpt_PT
dc.subjectIntrusion detectionpt_PT
dc.subjectNetwork securitypt_PT
dc.subjectNetwork attackspt_PT
dc.titleA flow-based intrusion detection framework for internet of things networkspt_PT
dc.typejournal article
dspace.entity.typePublication
oaire.awardTitleCentro de Investigação em Informática e Comunicações
oaire.awardURIinfo:eu-repo/grantAgreement/FCT/6817 - DCRRNI ID/UID%2FCEC%2F04524%2F2019/PT
oaire.citation.titleCluster Computingpt_PT
oaire.fundingStream6817 - DCRRNI ID
person.familyNameMartins
person.givenNameJosé
person.identifierR-005-4SA
person.identifier.ciencia-idBC19-7E23-DA8C
person.identifier.orcid0000-0002-7787-6305
person.identifier.ridB-5280-2014
person.identifier.scopus-author-id35321317600
project.funder.identifierhttp://doi.org/10.13039/501100001871
project.funder.nameFundação para a Ciência e a Tecnologia
rcaap.rightsopenAccesspt_PT
rcaap.typearticlept_PT
relation.isAuthorOfPublication9a3a730e-b304-424c-9325-35f43c88f16c
relation.isAuthorOfPublication.latestForDiscovery9a3a730e-b304-424c-9325-35f43c88f16c
relation.isProjectOfPublication628af577-74f4-4f3d-a3ef-edc88e342ccf
relation.isProjectOfPublication.latestForDiscovery628af577-74f4-4f3d-a3ef-edc88e342ccf

Files

Original bundle
Now showing 1 - 1 of 1
No Thumbnail Available
Name:
Santos2021_Article_AFlow-basedIntrusionDetectionF.pdf
Size:
2.75 MB
Format:
Adobe Portable Document Format
Download

Collections

EsACT - Artigos em Revistas Indexados à WoS/Scopus