Multi-level Host-based Intrusion Detection System for Internet of Things

Catalog abstract summary

The paper presents a host-based IoT intrusion-detection framework that combines user- and kernel-space traces with machine-learning classifiers.

Source: Official open-access article PDF reviewed; abstract paraphrased for this catalog.

Problem and motivation

IoT intrusion detection needs host-level context across user and kernel activity, but resource-constrained devices cannot perform all analysis locally and network-only signals miss useful execution behavior.

Method and contribution

A multi-level host IDS collects live/snapshot LTTng CTF data on an IoT device, optionally uses barectf, aggregates selected events remotely, creates synthetic syscall events and one-hot features, and evaluates supervised DT/RF/GBT/MLP/SVM plus One-Class SVM and LSTM models.

Findings and evidence

In the Home Assistant/Raspberry Pi experiment, DT/RF/GBT reported near-perfect classification on the stated split, while MLP and the printed SVM row were much less reliable. Snapshot tracing added roughly 0.25-1.52% average CPU overhead across 10 s-0.5 s intervals and roughly 1.8-2.7% memory overhead. A novel basic attack had millisecond-scale detection latencies, but it was not real malware.

Limitations and future directions

Limitations: The attacks are simulated or mimicked; no real malware and no public corpus identifier were verified. TCP/IP-centric collection excludes several IoT protocols, including Z-Wave/Zigbee/Insteon data collection. Supervised models only cover learned attacks; cross-validation can be optimistic and the analysis engine may be a single point of failure.

Future work: Combine misuse and anomaly detection, add an ARM honeypot, scale/optimize the analysis engine and learning process, build per-device or ensemble models, and support LTTng live mode plus additional IoT protocols.

Sources and identifiers

• Published version published
• Institutional full text · PDF public_full_text

When to cite this paper

Cite this paper when your work uses or compares a multi-level IoT host IDS that exports trace-derived features to a remote analysis engine.

• For a multi-level IoT host IDS that exports trace-derived features to a remote analysis engine.
• For the trace-to-FSM-synthetic-event-to-one-hot-feature pipeline over LTTng/barectf/Babeltrace data.
• For the Home Assistant/Raspberry Pi 3 benign-plus-threat evaluation and its snapshot CPU/memory overhead measurements.
• For the explicit boundary that near-perfect supervised results came from simulated/mimicked attacks rather than real malware.

Citation

@article{ezzatiJivan2020multilevel,
  author = {Robin Gassais and Naser Ezzati-Jivan and Jose M. Fernandez and Daniel Aloise and Michel R. Dagenais},
  title = {Multi-level Host-based Intrusion Detection System for Internet of Things},
  year = {2020},
  journal = {Journal of Cloud Computing},
  volume = {9},
  number = {1},
  pages = {62},
  eid = {62},
  publisher = {Springer Science and Business Media LLC},
  issn = {2192-113X},
  doi = {10.1186/s13677-020-00206-6},
  url = {https://doi.org/10.1186/s13677-020-00206-6}
}

Gassais, R., Ezzati-Jivan, N., Fernandez, J. M., Aloise, D., & Dagenais, M. R. (2020). Multi-level Host-based Intrusion Detection System for Internet of Things. Journal of Cloud Computing, 9(1), 62. https://doi.org/10.1186/s13677-020-00206-6

R. Gassais, N. Ezzati-Jivan, J. M. Fernandez, D. Aloise, and M. R. Dagenais, "Multi-level Host-based Intrusion Detection System for Internet of Things," Journal of Cloud Computing, vol. 9, no. 1, Art. no. 62, 2020, doi: 10.1186/s13677-020-00206-6