Two-level machine learning driven intrusion detection model for IoT environments

As a consequence of the growing number of cyberattacks on IoT devices, the need for defences like intrusion detection systems (IDSs) has significantly risen. But current IDS implementations for IoT are complex to design, difficult to incorporate, platform-specific, and limited by IoT device's resource constraints. This paper proposes a deployment-ready network IDS for IoT that overcomes the shortcomings of the existing IDS solutions and can detect 22 types of attacks. The proposed IDS provide the flexibility to work in multiple modes as per IoT device computing power, made possible via development of three machine learning-based IDS modules. The intrusion detection task has been divided at two levels: at edge devices (using two light modules based on neural network and decision tree) and at centralised controller (using a random forest and XGBoost combination). To ensure the best working tandem of developed modules, different IDS deployment strategies are also given.