Intrusion detection and prevention systems in industrial IoT network

Abstract

The Industrial IoT system often struggles to identify malignant traffic and may cause disruption in the flow of work or even hazardous situations. The previously described techniques to identify such intrusions work well but not enough to be implemented in such environments where it is very difficult to identify malignant traffic in loads of benign ones. Hence, an intrusion detection system is needed that works well with very highly unbalanced datasets. Therefore, we developed a transformer model that gives a high accuracy and combined it with a boosting module that decreases false negatives, which is highly required. This model is applied to the UNSW-2018-IoT-Botnet dataset, which is publicly available in the cloudstor network. Thus, the classified traffic identified as malignant is eliminated from the system using prevention techniques. The paper also extends the model to classify among five different traffics for the same dataset, in which some of the traffics are very difficult to distinguish, such as DoS and DDoS traffic. The experiments on such data sets have shown much better results, which proves that the model classifies well and can be implemented practically as well.