A comparative study of novelty detection models for zero day intrusion detection in industrial Internet of Things.

Otokwala, Uneneibotejit; Arifeen, Murshedul; Petrovski, Andrei

Abstract

The detection of zero-day attacks in the IoT network is a challenging task due to unknown security vulnerabilities. Also, the unavailability of the data makes it difficult to train a machine learning (ML) model about new vulnerabilities. The existing supervised ML-based Intrusion Detection Systems (IDS) are trained to detect only known attacks. On the contrary, the unsupervised ML-based IDSs show a high false-positive rate. In this paper, we experimented on three novelty detection algorithms named One-Class SVM (OCSVM), Local Outlier Factor (LOF), and Isolation Forest (IF), which follow the one-vs-all strategy for zero-day-intrusion detection for IoT datasets. UNSW-NB15 and IoTID20 datasets are considered for the experiment. Experimental results show that OCSVM outperformed the other two models for zero-day intrusion or unseen anomaly detection in IoT domain.

Citation

OTOKWALA, U., ARIFEEN, M. and PETROVSKI, A. 2024. A comparative study of novelty detection models for zero day intrusion detection in industrial Internet of Things. In Panoutsos, G., Mihaylova, L.S. and Mahfouf, M. (eds.) Advances in computational intelligence systems: contributions presented at the 21st UK workshop on computational intelligence (UKCCI 2022), 7-9 September 2022, Sheffield, UK. Advances in intelligent systems and computing, 1454. Cham: Springer [online], pages 238-249. Available from: https://doi.org/10.1007/978-3-031-55568-8_20

• Presentation Conference Type: Conference Paper (published)
• Conference Name: 21st UK workshop on computational intelligence (UKCCI 2022)
• Start Date: Sep 7, 2022
• End Date: Sep 9, 2022
• Acceptance Date: Jul 15, 2022
• Online Publication Date: May 19, 2024
• Publication Date: Dec 31, 2024
• Deposit Date: Sep 10, 2024
• Publicly Available Date: May 20, 2025
• Publisher: Springer
• Peer Reviewed: Peer Reviewed
• Pages: 238-249
• Series Title: Advances in Intelligent Systems and Computing
• Series Number: 1454
• Series ISSN: 2194-5357; 2194-5365
• Book Title: Advances in Computational Intelligence Systems
• ISBN: 9783031555671
• DOI: https://doi.org/10.1007/978-3-031-55568-8_20
• Keywords: |IoT; Intrusion detection; OCSVM; LOF; IF; Security
• Public URL: https://rgu-repository.worktribe.com/output/2472355