A Hybrid Intrusion Detection System against Botnet Attack in IoT using Light Weight Signature and Ensemble Learning Technique

Abstract Internet of Things (IoT) plays a substantial role in the digital era of the information and intelligent Age. The use of interactive internet apps has opened up opportunities for increased threats to cyber security. Recently, botnets threats in IoT had become the most common cyber security threats. These threats provide malicious services and carry out phishing links on the internet. Consequently, an efficient intrusion detection system (IDS) is needed to detect these botnet attacks and unknown attacks with a low false-positive rate. Existing IDS methods detect these new attacks but require a high-precision detector. Most of the existing IDS uses either single machine learning or multiple classifiers that fail to detect unknown attacks and produce a high false-positive rate. This paper proposes a hybrid-based IDS that solves and detects unknown and novel attacks with low false-positive rates, better accuracy levels, and detection rates. This proposed work is deployed using two IDS methods in a two-staged manner. First, we modelled a Signature-Based Detector against DDOS attack for providing a better detection rate, early detection of known and low false-positive rates. Next, we modelled an Anomaly-Based Detector against DDOS attacks to achieve low false alarm rates, improved accuracy levels, and detected botnet and unknown attacks using the Machine Learning-based ensemble technique. Finally, we evaluated the performance using the confusion matrix on the classified data. We assessed the classifier performance based on detection rate, precision, accuracy, AUC score, and false-positive rates. The proposed hybrid technique provides a lower false-positive rate and better detection rate than the proposed model's classification technique.