A sequential scheme for detecting cyber attacks in IoT environment

With the rapid spread of the IoT (Internet of Things) devices, our daily life has been becoming more convenient and efficient. However, the attacker is more easily targeting the IoT devices to make them become attack destinations or bots for attacking other victims. This is because most of the IoT devices have not enough resources, memory and computation skill, to be equipped with an efficient security system. The mainstream of the actual IDSs (Intrusion Detection Systems) for traditional networks/computers and those for the IoT devices are still signature/rule-based. It is well known that such detection systems cannot handle new kind of attacks or new variants. And, the formal rule-based detection techniques would be circumvented by attackers. Moreover, for many IoT devices, so many signatures/rules often cannot be operated. Machine learning-based technologies are attracted much attention from many researchers and developers in recent years. Such methods can detect specific attacks or just detect anomalies. In many related works, one classifier is often trained for detecting multiple kinds of attacks, which is obviously cannot grantee an optimum performance for every kind of attacks. In this study, we proposed a system that detects multiple specific attacks in a sequential manner. That is, each kind of specific attacks is detected using a designated classifier instead of a common one. An artificial neural network as the classifier is trained and used for each kind of the specific attacks. As a result, the multiple classifiers can detect the specific attacks in a sequential manner. Our proposal is explained in detail in this paper and its performance is examined using different activation functions. We also make it clear which activation function is the best choice for our system.