Self-Healing And Lightweight Intrusion Detection For Iot-Based Systems

Abstract

The rapid growth of Internet of Things (IoT) has revolutionized modern technology, enabling seamless connectivity across diverse domains. However, resourceconstrained IoT devices are highly vulnerable to cyber threats, particularly Denial of Service (DoS) and Distributed Denial of Service (DDoS) attacks. Such attacks can severely compromise the reliability and functionality of IoT networks, necessitating robust, resource-efcient, and adaptive intrusion detection mechanisms. Traditional Intrusion Detection Systems (IDSs) often fail to meet the unique demands of IoT environments due to their high computational overhead and inability to adapt dynamically to emerging threats. Addressing these challenges requires an innovative approach that balances lightweight design with high detection accuracy and resilience. The frst part of this research proposes an Ensemble Lightweight Intrusion Detection System (ELIDS) approach, which combines the capabilities of seven distinct flter-based Feature Selection (FS) methods to identify the most relevant features in classifying normal and DoS/DDoS attack packets. In the proposed ELIDS, each FS method generates a ranked list of features along with their corresponding scores. These lists are subsequently aggregated, resulting in a consolidated fnal list that includes the reduced set of features. The selected features are further utilized to train six Machine Learning (ML) algorithms, designing lightweight ML-enabled IDS. The proposed ELIDS is evaluated for in-domain and cross-domain testing scenarios. The results reveal that incorporating an ensemble FS approach improves detection accuracy also optimizes computational resources. Moreover, ELIDS outperforms conventional FS methods, especially over cross-domain testing scenarios. The second part of this research presents a Self-Healing for Internet of Thing (SHviii IoT), designed to enhance the performance of ML-enabled IDS models, especially when a decline in their effectiveness is observed during cross-domain testing. In this framework, the health monitor continuously checks the behavior of simulated IoT devices and generates a danger signal when it detects any deviation from normal operating patterns caused by a DoS/DDoS attack. Once the danger signal is triggered, the proposed SHIoT initiates its healing mechanism, which activates defensive measures to counter DoS/DDoS attacks. The framework is assessed using performance metrics and obtained results demonstrate a notable enhancement in the performance of ML models, which retain both previous and newly acquired knowledge to identify both existing and emerging DoS/DDoS attacks. Finally, the third part of this research integrates the Self-Healing and Ensemble-based Lightweight IDS (SHIoT-ELIDS). The SHIoT-ELIDS is evaluated using nine unseen datasets, achieving a peak accuracy of 99.9% while employing Random Forest as the learning algorithm. Additionally, the proposed SHIoT-ELIDS performs efciently in terms of resource utilization, where testing a single packet takes only 0.0050 msec, demonstrating its appropriateness for real-time detection environments. The CPU usage is around 0.0014% per packet, ensuring the system imposes minimal load on the underlying hardware. Additionally, memory consumption remains low at 0.1456 MB per packet, while the fnal classifcation model size is of 697 KB, making it ideal for deployment on devices with limited processing and storage capacity, such as IoT devices. Overall, SHIoT-ELIDS can improve the security posture of IoT networks, providing a scalable and resource-efcient defense against evolving cyber threats