Profiling-Based Classification Algorithms for Security Applications in Internet of Things

Due to the various types of network resources involved in the Internet of Things (IoT), it becomes challenging to detect security incidents and unexpected faults in IoT environments. The nature of network objects (e.g., system, user, service, and devices) is too various and changeable to predict objects' behaviors and to identify the best parameters for the machine learning model in order to detect anomalies against IoT protection. We propose a new profiling method called "Management Information Base for IoT (MIB-IoT)" by extending conventional MIB to a more generalized structure in order to represent not only the structured properties of network objects but also the best machine learning model for each network object in a systematic fashion. MIB-IoT profiles can be defined for various applications such as abnormal behavior detection, malicious behavior detection, and even data source identification. To demonstrate the feasibility of the proposed MIB-IoT, we apply various classification algorithms on datasets consisting of normal operation data, hardware fault data, and malicious data. The experiment results show that the classification algorithm using MIB-IoT is capable of achieving an accuracy of 99.81% for malicious behavior detection and an accuracy of 78.51% for data source identification respectively.