Behavior of the DenStream Clustering Algorithm for Attack Detection in the Internet of Things
Multiple attack detection schemes based on supervised batch learning are presented in the literature as an alternative to improve Internet of Things (IoT) security. These schemes require benign and malicious traffic samples for training and are unable to easily adapt to changes in the analyzed data....
| Autores: | , |
|---|---|
| Tipo de recurso: | artículo |
| Estado: | Versión publicada |
| Fecha de publicación: | 2023 |
| País: | Brasil |
| Institución: | Universidade Estadual de Londrina (UEL) |
| Repositorio: | Revista Semina: Ciências Exatas e Tecnológicas (Online) |
| Idioma: | inglés |
| OAI Identifier: | oai:ojs2.ojs.uel.br:article/48956 |
| Acceso en línea: | https://ojs.uel.br/revistas/uel/index.php/semexatas/article/view/48956 |
| Access Level: | acceso abierto |
| Palabra clave: | stream mining cyberattack detection internet of things cybersecurity mineração de fluxos contínuos de dados detecção de ciberataques internet das coisas cibersegurança |
| Sumario: | Multiple attack detection schemes based on supervised batch learning are presented in the literature as an alternative to improve Internet of Things (IoT) security. These schemes require benign and malicious traffic samples for training and are unable to easily adapt to changes in the analyzed data. In this work, we study how we can use DenStream, an unsupervised stream mining algorithm, to detect attacks in IoT networks. This type of algorithm does not require labeled examples and can learn incrementally, adapting to changes. We aim to investigate whether attacks can be detected by monitoring the behavior of DenStream's clusters. The results showed that DenStream could provide indicators of attack occurrence in TCP, UDP, and ICMP traffic. |
|---|