An Effective Method for Secure Data Delivery in IoT

Abstract

The Internet of Things (IoT) has become very popular recently due to its important features that contribute to many aspects of our lives such as health and transportation. It consists of a vast number of different projects such as sensors, tags, actuators, and mobile devices, which can communicate and collaborate without human interactions. These devices carry small memory and low-energy battery, which affects their performance and lead to many issues. In this work, we are going to focus on the efficiency and security issues. We will propose a secure and efficient routing protocol for data delivery in order to improve its performance. The proposed technique will be evaluated in an implemented platform with appropriate case study. The expected outcome of this study will be a reference design and its practical implementation to support efficiency and security in IoT.

1. Introduction

Nowadays, many research efforts have been concentrated on the efficiency and security of IoT devices to raise the performance and the level of protection for IoT data and detect possible attacks. It is significant to understand the types of data delivery challenges in IoT. The challenges related to wireless sensor networks (WSN), cyber-physical systems (CPS), and machine-to-machine (M2M) continue to appear within the context of IoT since the basic components of IoT networks include WSNs, CPS, and M2M. One of the challenges is the difficulty in providing communications using infrastructure-based wireless systems because of the high cost of deploying and maintaining this infrastructure with the rapid growth of IoT users and devices [1]. Furthermore, the IoT system is mobile and dynamic; thus, its perimeters are not well-defined. It is also robustly heterogeneous concerning the devices, protocols, and communication medium.

The other concern is that IoT system is vulnerable to malicious cyber-attacks. One of these aggressive attacks is a distributed DoS (DDoS) attack, which intends to bring down a victim system by preventing legitimate devices of service from accessing it. DDoS attackers may also aim to gain unlimited access to the victim machines and cause more damage consequently. These attacks are made not to be significantly distinct from the usual behavior practiced by the system. One of the techniques that can be used to detect cyber-attacks is intrusion detection (ID). Yet, the advanced ID schemes utilizing machine learning techniques struggle to detect some of the cyber-attacks. These attacks are made not to be significantly distinct from the usual behavior practiced by the system. Therefore, there is a need for an anomaly-based IDS combined with artificial intelligence and machine learning due to its ability to classify and identify earlier hidden attacks. This kind of IDS will help in detecting multi-stage DDoS attacks. Current schemes in the development of ID investigate artificial intelligence and machine learning in academia and industry, such as artificial neural networks and fuzzy logic.

IoT advanced systems can achieve high performance with a human being’s supervision for defining how to perform their duties. They also can automatically detect unusual patterns of web traffic with malicious activities and learn the patterns by themselves over time. Previous studies in the wireless network security area focused on ID based on a single hidden Markov model (HMM) and multi-class system classifier (MCSC) [2, 3]. Here, we study the potential applicability of the hierarchical hidden Markov model (HHMM) for intrusion detection in IoT systems in which the problem space can be several magnitudes higher than in wireless networks. And, we propose a probabilistic hierarchical hidden Markov model that reduces the high state-space without compromising classification accuracy. The proposed scheme shows better outcomes for detecting the DoS and DDoS attack patterns compared to the state-of-the-artwork.

The main contributions of the work are:

1. We propose a PHHMM model that translates high-dimensional IoT data to a discrete set of reliable data to be securely delivered with the ability to detect DDoS attacks.

2. We propose a method that learns and efficiently analyzes large amounts of data for classifying DDoS patterns in IoT traffic.

3. We conducted a performance comparison of our PHHMM with the baseline HHMM, Neural Network, and Naive Bayes models on the benchmark dataset from the CICIDS2019 database that contains 11 types of DoS and DDoS attacks collected over real-time for validating the proposed model.

The rest of this paper is organized as follows. Section II investigates the state of the art of some IoT data delivery used methods and presents the related work, followed by the background in Section III. Then, the model details are demonstrated in section IV and section V. Next, we show and discuss the experiments and simulation results in sections VI and VII. Finally, section V ends the paper, outlining some suggestions for future work.

2. Related work

2.1 Routing protocols in IoT

To design an efficient protocol in IoT networks is a risky task due to their characteristics. The efficient routing protocol has to respond to the changes that may happen in the topology as same as the bandwidth constraint. Most of the proposed protocols are only sub-optimal. Forster et al. [4] discuss three popular machine learning techniques on the communication layers in the WSNs. These algorithms are used in distributed environments to solve different problems such as ad hoc routing. They are categorized into three groups; reinforcement learning, supervised, and unsupervised. The aim is to find out a convergent mapping function that helps in prophesying the output results for any new input. Routing in IoT environments, as mentioned earlier, is associated with protocols in wireless sensors and ad hoc networks. One existing routing protocol for IoT networks is IP6 overpower personal area networks (6LoWPAN), which are used to route the data among non-IP sensors through networks with high processing capabilities. Its topology consists of a set of reduced function sensors that are linked to full function sensors [5]. It helps to support low cost, different length addresses, low bandwidth, different topologies, energy consumption, and lengthy sleep time. This protocol supports the multi-hop data delivery and reduces transmission overhead by providing header compression enclosing IPv6 long headers in the IEEE802.15.4 small packets [6]. Many of the real-world machine learning algorithms use both supervised and unsupervised learning as hybrid learning or semi-supervised learning to take advantage of the strengths of these main categories and minimize their cons [7]. Another standard protocol in IoT is the Routing Protocol for Low-Power and Lossy Networks (RPL) [8], which is a distance-vector protocol based on IPV6 that can prop lots of data-link protocols. It builds a destination-oriented directed acyclic graph (DODAG). It has only one path from each node to the root, and all the communications will be through that root. All nodes advertise themselves as the root by broadcasting a DODAG information object (DIO), and then the DODAG is gradually built. For the cognitive networks, as an extension of RPL, which is the Cognitive RPL Protocol (CORPL) is designed. It uses the DODAG topology generation. Constrained Application Protocol (CoAP) [6] is another IoT protocol that produces a lightweight RESTful (HTTP) interface to reduce overhead and power consumption. The next protocol is the Message Queue Telemetry Transport (MQTT), which was introduced for providing embedded connectivity between the party of middlewares and applications and the party of networks and communications. It is a publish/subscribe design that includes three parts: publishers, which are the sensors that connect to the broker to send their data, subscribers, which are the sensory data or applications, and the broker, which sends the data to the subscribers after classifying them in topics. Secure MQTT (SMQTT) [6] is an extension of MQTT to enhance its security features. It is encryption-based, where each message is encrypted and delivered to multiple nodes, which is common in IoT applications. For supporting a large range of IoT applications, ZigBee smart energy [6] is used. It has a wide star topology, peer-to-peer topology, or cluster-tree network topology. It also allows implementations with low memory and processing power. In addition, the Advanced Message Queuing Protocol (AMQP) [9] is designed for the financial industry. It is a publish/subscribe design built over TCP, but the broker here is divided into two main components: exchange and queues. The exchange receives publisher messages and distributes them to queues based on pre-defined conditions. Moreover, the long-term evolution advanced protocol (LTE-A) [9] is used for IoT applications in wireless networks. LTE-A design has a core network (CN) to control mobile devices, a radio access network (RAN) to establish data planes and control the wireless connections, and mobile nodes.

2.2 Intrusion detection systems in IoT

Because of the lack of training datasets, the current IoT intrusion detection systems are incapable of detecting the latest DoS and DDoS attacks [10], such as Network Time Protocol (NTP) attack, Network BIOS (NetBIOS) attack, UDP lag (delay). The authors in [11] proposed a hidden Markov model for predicting and detecting multi-stage attacks. Their work is not applicable for IoT systems as it fails on the high dimension state space since the incoming network traffic in IoT will have largely hidden states. The approach developed by [12] has a high detection rate as it identified most of the occurred attacks. However, they did not consider DDoS attacks. Authors in [2] proposed an anomaly detection module that uses Long Short-term memory for detecting both known and unknown attacks with a low false-positive rate. Their work shows high recognition rates. In [3], researchers discussed the multi-stage attack and its prediction. They proposed a multi-stage Naive Bayes model that can predict each stage of the multi-stage attack scenarios. However, schemes in [2, 3] are not suitable for predicting multiple attack intents in heteroecious environments. Besides, the authors in [13] propose a Hierarchical Hidden Markov Model (HHMM), which is an extension of the hidden Markov model (HMM), as the method for activity recognition. They analyzed the accuracy rate of their model with the Naive Bayes and HMM schemes. The comparison showed that the HHMM has the highest accuracy rate among others. However, they did not take into consideration the nature of IoT systems. The authors in [14] described routing-specific attacks in the IoT systems and concentrated on identifying the malicious node’s location and neighborhood to inform the network administrator. In [15], the researchers proposed an ID scheme to detect flood attacks in IoT networks. Their proposed model identifies the attacks through the back-propagation neural network model. Table 1 summarizes the properties of the major types of existing ID schemes.

Paper	HHMM	HMM	DDoS detection	Up-to-date dataset	Applicable for IoT
[1]	No	Yes	Yes	No	No
[2]	No	Yes	No	N/A	No
[3]	No	Yes	No	Yes	No
[4]	No	Yes	Yes	Yes	No
[5]	Yes	Yes	Yes	Yes	No
[6]	No	No	Yes	N/A	Yes
[7]	No	No	Yes	N/A	Yes

Table 1.

Intrusion detection schemes.

3. Preliminaries

This section provides definitions for the used terms in this paper:

3.1 Distributed denial of service attacks (DDoS)

DDoS is one of the potential attacks in IoT where attackers coordinate the utility of many machines connected to the network to send an overwhelming amount of unwanted requests to a targeted server [16]. They try to disrupt the traffic of the server with a flood of unwanted requests. Besides, DDoS reaches effectiveness by using various compromised devices as the roots of attack traffic. The more hacked devices, the more damage is caused to the servers. Thus, the attacker examines remote machines for security gaps using some tools such as worms to find their vulnerabilities and inject them with the attack code. Then, these compromised machines become zombies, which the attacker uses to send malicious packets to the targeted victim. DDoS may yet cause a long-term memory consumption of the relaying nodes in IoT environments due to nodes’ restricted resources. There are various DDoS attack types used to degrade the performance or availability of targeted services on the Internet. Some of these attacks are Botnet attacks, Spoof-packet flood attacks, Multi-Vector Attacks, and Misused Application Attacks. Besides, there are various schemes used to defend against DDoS attacks, which are under three categories; policy-based schemes, application-based schemes, and machine learning–based schemes. The policy-based defense scheme is placed in the switch to define the traffic that is allowed to be forwarded and the other ones are defined as malicious. It requires analyzing collected data samples of the network to classify malicious traffic. Numerous policy algorithms use different measurements such as standard deviation or measure the chi-square statistic of the sample to classify the packets as malicious or legitimate. Secondly, the application-based schemes handle and control packets in the network by the user interface layer. Finally, the machine Learning-based defense schemes deploy machine learning algorithms to investigate and classify the traffic to detect the DDoS attack.

3.2 Hierarchical hidden Markov model (HHMM)

The Hierarchical hidden Markov model (HHMM) is a multi-level stochastic process derived from the Hidden Markov model (HMM) by making each of the hidden states a self-contained autonomous probabilistic model. It is a statistical framework for modeling a sequence of observations. Each observation is emitted from a hidden state within the system by recursive activation. The basic idea of HHMM is that the upper-level states produce sequence states called “abstract” states [17]. And, the lower-level states produce single observations called “concrete” states [17]. The observations are governed by each of the sub-states (sub-HMMs). The process of recursive activations ends when reaching a state that produces output symbols like an HMM [17].

For estimating HHMM parameters, we define the generalized forward ($\alpha$) and backward ($\beta$) probabilities as follows:

$$\begin{array}{c}\alpha \left(i\right)=P\left(O,,,q_i^l,|,\lambda \right)\\ P\left(O,|,\lambda \right)=\sum {\alpha }_T\left(i\right)\end{array}$$

where $q_i^l$ is the number of sub-states of an abstract state.

$$\beta \left(j\right)=P\left(O|q_j^l,\lambda \right)$$

We also define the generalized horizontal ($\xi$) and vertical transitions ($\chi$) as follows:

$$\begin{array}{c}\xi \left(T,q_j^l,q^{l-1}\right)=P\left(i_t=q_i^l,i_{t+1}=q_j^l,|,O,,,\lambda \right)\\ \chi \left(T,q_i^l,q^{l-1}\right)=P\left(i_t=q_i^{l-1},i_{t+1}=q^l|O,\lambda \right)\end{array}$$

The model is represented as ${\lambda }_{\mathit{\text{PHHMM}}}$ = $<A^{q^l},B^{q^l},{\pi }^{q^l}>$. And, the states of an HHMM are denoted by $Q^l=q_i^l$, where $l\in 1,2,.\dots L$, $i$ is the state indexing, $L$ is the output state, and $l$ is the hierarchy indexing. It performs the following computation:

• A probability transition matrix ($A^{q^l}=a_{\mathit{ij}}^{q^l}$) is generated as the conditional probability of future traffic state is independent of the past states given the present state:

  $$\begin{array}{c}{a}_{\mathit{ij}}^{q^l}=P\left(q_{t+1}^{l+1}=S_j,|,q_t^{l+1}=S_i\right),1⩽i,j⩽N\\ a_{\mathit{ij}}^{q^l}⩾0\\ \sum a_{\mathit{ij}}^{q^l}=1\end{array}$$

  where $a_{\mathit{ij}}$ is a horizontal transition probability from state i to state j and all are sub-states of $q^l$.

  N is hidden states.

• An emission matrix ($B^{q^l}=b_{\mathit{jh}}^{q^l}$) for observation probabilities given the hidden traffic state is generated by:

  $$\begin{array}{l}{b}_{\mathit{jh}}^{q^l}=P\left(O_{h\left(t\right)},|,q_t^l=S_j\right),1⩽i,j⩽N\\ 1⩽h⩽M\end{array}$$

  where $b_{\mathit{jh}}$ is observed probability in state j.

  M is observable states.

• An initial state distribution (${\pi }^{q^l}$) is generated by:

$${\pi }^{q^l}={\pi }^{q^l}\left(q_i^{l+1}\right)=P\left(q_t\right)=s_1$$

4. Framework of the proposed model

In this section, we first explain the structure of the traditional HHMM model then we illustrate the framework of our proposed model.

4.1 Framework of the HHMM

Learning, decoding, and evaluating are the three principal HHMM objectives as described in [18]. Briefly, the techniques applied to achieve these objectives are as follows:

• Learning: Baum-Welch algorithm is used to create the object of the learning machine.

• Decoding: Viterbi algorithm is applied to define the most probable state path of hidden states that can be transitioned given an observation sequence (O) and the model parameters ($\lambda$).

• Evaluation: The forward and backward algorithms are used to determine the probability of an observed sequence.

This probabilistic hierarchical hidden Markov model should overcome the problem of the heterogeneity of IoT data. However, it suffers from high computational costs as the data increases in an exponential manner due to its used algorithms. Applying this scheme to IoT data undeviatingly will contribute to a problem of high state space. We, therefore, need to find a way to reduce the high state space without compromising the classification quality.

4.2 Framework of PHHMM

Our proposed model uses clustering and dimension reduction techniques to partition the massive incoming network traffic to overcome the problem of largely hidden states, before applying HHMM for classification. It follows the framework described in Figure 1 and achieves the objectives [18] and techniques are applied as follows:

• Estimate the model parameters: Find the most probable parameter ${\lambda }^{\ast }$ of the model by applying the Baum-Welch algorithm [19]: given the PHHMM structure and one or more observation sequences $\lambda ={\mathit{\text{argmax}}}_{{\lambda }^{\ast }}P\left(O_t|\lambda \right)$.

• Learning: Calculate the probability of a sequence: Derive the maximum likelihood estimate of the parameters of PHHMM given the set of output sequences by applying the Baum-Welch algorithm: given a PHHMM and its parameters, determine the likelihood $P\left(O|\lambda \right)$ of a sequence $O$ to be generated by the model.

• Decoding: Calculate the most probable state sequence: Find the state sequences that best explain the observations by applying the Viterbi algorithm: given a PHHMM, its parameters, and an observation sequence, determine the single state sequence that is most likely to generate the observation sequence.

• Evaluation: Detect DDoS attacks: Evaluate the probability of the observed sequence and solve the detection problem to compute the probability of alert observations by applying the DDoS detection algorithm: given the probability of an observed attack alert sequence (O), detect DDoS attacks and predict future trails.

Figure 1.

The PHHMM detection model.

In our PHHMM model, applying dimension reduction techniques is a challenging step due to the lack of a standard approach for reducing the dimensionality of the observed IoT network traffic. It requires identifying the principal components and linear combinations of variables that describe the highest contrast in the massive data without compromising this data. Determining the principal components given a covariance matrix is computationally expensive as it claims the eigenvalue decomposition that requires the calculation of the covariance matrix. To overcome this challenge, we present an approach that avoids the direct computation of the covariance matrices but delivers the efficient subspace dimension. Our model applies the singular value decomposition (SVD) for calculating PCA to circumvent this expensive operation. The participating nodes in the algorithm use the PCA with the SVD learning mechanism to estimate principal components of the data traffic.

This work contributes to improving and resolving the common flaws in the application of HHMM in massive data by reducing the data dimensions based on traffic from both of the two streams being compared instead of depending only on some training data of normal traffic. Using only the most significant principal components, we could avoid the computation of the entire subspace. We can estimate a reduced number of principal components that are sufficiently effective in detecting malicious traffic. Our model allows the subsequent use of only the number of dimensions necessary at any given time.

5. Proposed model

This section explains the methods and techniques that we apply to the tasks in the tasks of the proposed model in Figure 1.

5.1 Data pre-processing

Collecting a large amount of attack traffic and normal traffic in a large real-time network is time and money-consuming. It needs significant resources, a diversity of normal IoT traffic, and a diversity of attack traffic. Instead, there are publicly available network traffic datasets, which can be used for this task. We analyze some of the available datasets based on the following:

• Real-time network traffic

• The most advanced DoS and DDoS attacks

The CICIDS2019 includes inbound and outbound traffic of the most advanced DoS and DDoS attacks. It contains lots of network flow-related characteristics and different types of current DoS and DDoS IoT attacks traffic collected over real-time networks.

5.2 Feature selection

The CICISD dataset has a huge number of attributes, selecting a subset of them is necessary for eliminating redundant and irrelevant ones. This helps in improving detection accuracy for DDoS attack detection. To better train our model for detecting the attack patterns, we have selected packet features that indicate DDoS attacks, which are useful for classification to distinguish between normal IoT traffic and DDoS IoT traffic:

• Destination IP: According to the research in [20], the IoT device communicates with several numbers of expected destinations that rarely get modified over time. Thus, if the device communicates with many separate destinations in a short time-stamp, it is considered an attack.

• Packet size: In [21], the authors declared that the size of a normal IoT packet size differs from 42 to 1434 bytes, while the size of a DDoS packet is smaller than 100 bytes. Thus, a sudden jump in the traffic with a fixed packet size of around 100 bytes represents a DDoS attack.

• Packet Size Variance: DDoS attack packets share the same size frequently whereas IoT packets’ size differs from one to another.

• Packet Time Interval: The time interval between DDoS packets is close to zero while IoT packets travel in a regular time interval.

5.3 Data clustering

The k-means clustering is a method of vector quantization that aims to partition n observations into k clusters in which each observation belongs to the cluster with the nearest mean based on a similarity metric [20].

Let $S=f_1,f_2,..\dots f_n$ and $K=C_1,C_2,.\dots C_n$ then $C_i\ne \varphi$, $C_i\cap C_j=\varphi$, and ${\cup }_{i=1}^K{C}_i=S$, where $i,j=1,2,\dots K,$ and $i\ne j$.

The clustering method works as follows:

• Input: N features $\left\{f_1,f_2,\dots ,f_n\right\}$

• Initialization: Finding cluster centers ${\mu }_1,\dots {\mu }_k.$

Randomly initialize K:

• Select K features as the primary cluster centers.

• Reiteration:

• Allocate each feature $f_n$ to its closest cluster center $C_k=\left\{n:k={\mathit{min}}_k{f}_n-{{\mu }_k}^2\right\}$.

• Determine the new center ${\mu }_k$ of the cluster $C_k:{\mu }_k=\frac{1}{\mid C_k\mid }\sum f_n$.

• Repeat until the cluster centers do not move anymore.

When deploying k-mean to cluster IoT traffic, we reduce the dimension data to quantize the data into single-dimensional data. We classify the traffic flow depending on similar characteristics and identify clusters of homogeneous traffic flows and define their borders. It needs to have high intra-cluster homogeneity and inter-cluster heterogeneity.

For determining the optimal (fitting) value of K, we use the elbow algorithm repeatedly applying different values of K and plotting their heterogeneity. When the curve begins to flatten, it reaches the optimal value of K.

5.4 Dimensionality reduction

After clustering the data, initially, we have n states $\left(S_1,S_2,\dots ,S_n\right)$, applying the dimension reduction technique results in a new set of m states $\left(s_1,s_2,\dots ,s_m\right)$ where $\left(m<n\right)$, $s_i=f_i\left(S_1,S_2,\dots ,S_n\right)$ and $f_i$ represents a mapping function. Thus, its idea is to transform the massive data from a high-dimensional space, like IoT data, into a k-dimensional sub-space by partitioning the data-space into fully connected states. The low-dimensional form holds the top eigenvector v which has the meaningful features of the real data ideally close to its natural dimension [22]. The new set of features is extracted by some functional mapping. In this model, we considered the principal component analysis (PCA) and calculated it using the singular value decomposition (SVD) as the PCA presents a structure for reducing data dimensionality by outlining the maximum variation in the data.

To achieve dimension reduction by applying PCA, it requires placing the eigenvalues from the highest to lowest by their value. This ordering stores the elements in order of weight to the variance of the initial data matrix. This will allow us to drop the less important elements. Thus, we keep most of the information and lose a little noise. We can reduce the dimension of the original data. For instance, for any data of d dimensions, we only take the first r eigenvectors:

$$\frac{\sum {\alpha }_r}{\sum {\alpha }_d}=\frac{{\alpha }_1+{\alpha }_2+.\dots +{\alpha }_r}{{\alpha }_1+{\alpha }_2+.\dots +{\alpha }_d}$$E1

$$={\alpha }_1,{\alpha }_2,.\dots ,{\alpha }_r$$E2

Definition 1 [23]: For any matrix $\mathrm{Y}=y_1,y_2,\dots ,y_n$ of the size $K\times d$ can be re-written as $Y={\mathit{USV}}^{{\rm T}}$ where, U is an orthonormal matrix of size $K\times r$, S is a diagonal matrix of size $r\times r$, V is a matrix of eigenvectors of size $r\times d$ (a column is an eigenvector) (see Figure 2).

Figure 2.

Singular value decomposition of Y [23].

Assume that the data matrix Y is centered, i.e., the column means have been subtracted to be equal to zero. The covariance matrix (C) is calculated by:

$$C=\frac{X^{{\rm T}}X}{K-1}$$E3

Because the covariance matrix is symmetric, it can be diagonalized by:

$$C={\mathit{VLV}}^{{\rm T}}$$E4

where V is an eigenvectors matrix and L is a diagonal matrix with eigenvalues ${\lambda }_i$. The eigenvectors are called principal axes of the data, and, the data projections on the principal axes are called principal components [24]. After obtaining the singular value decomposition, C is defined by:

$$C=\frac{{\mathit{VSU}}^{{\rm T}}{\mathit{USV}}^{{\rm T}}}{K-1}$$E5

$$=V\frac{S^2}{K-1}{V}^{{\rm T}}$$E6

As the result, the eigenvectors of C are the same as the matrix V (the right singular vectors of Y) and the eigenvalues of C can be defined from the singular values ${\lambda }_i$.

$${\lambda }_i=\frac{s_i^2}{\left(K-1\right)}{\lambda }_i$$E7

The principal components are defined by:

$$\mathit{YV}={\mathit{USV}}^{{\rm T}}V=\mathit{US}$$E8

In short, the PCA is calculated as follows:

• Obtain the maximum covariance in the data.

• Keep meaningful information only to reduce data size.

• Simplify the representation of the data:

• The variance of the data is maximized.

• Analyze the construction of the features and observations.

Based on Oja’s algorithm for stochastic PCA optimization [25], the primary concept of our algorithm is to implement stochastic m updates by uniformly sampling the columns $y_i$ at random, and reduce the variance of these updates.

$$X_t^{\prime }=X_{t-1}+\eta y_{i_t}{y}_{i_t}^{{\rm T}}{X}_{t-1}$$E9

$$X_t=\frac{1}{\Vert X_t^{\prime }\Vert }{X}_t$$E10

We use the variance-reduced stochastic schemes for convex optimization [23] to reduce the stochastic variance. Let $B=\frac{1}{n}{\mathit{XX}}^{{\rm T}}$; then the updates in each iteration can be rewritten of our algorithm as

$$X^{\prime }=\left(I+\mathit{\eta B}\right)X_{t-1}+\eta \left(y_{i_t}{y}_{i_t}^{{\rm T}}-B\right)\left(X_{t-1}-{\overline{X}}_{f-1}\right)$$E11

$$X_t=\frac{1}{\Vert X_t^{\prime }\Vert }{X}_t$$E12

The algorithm is burst into periods f = 1, 2, 3,. .., wherein all period we do a single exact power iteration by computing $\overline{U}$. The steps to solve the problem are explained by the pseudo-code in Algorithm 1.

Algorithm 1: Dimensionality Reduction Algorithm.

Input Matrix $Y=\left(y_1,\dots ,y_n\right)$.

Output Matrix ${\overline{X}}_f$.

1: Initialize Orthonormal Matrix ${\overline{X}}_{k\times d}$.

2: For $f=\mathrm{1,2,3}\dots K$ $$Do

3: $\overline{U}=\frac{1}{n}\sum y_i\left({y_i}^{{\rm T}}{\overline{X}}_{f-1}\right)$

4: ${\overline{X}}_0={\overline{X}}_{f-1}$

5: For $t=\mathrm{1,2,3},.\dots m$ $$Do

6: $B_{t-1}={\mathit{VU}}^{{\rm T}}$, where

 ${\mathit{USV}}^{{\rm T}}$ is an decomposition of $X_{t-1}^{{\rm T}}{\overline{X}}_{f-1}$

7: Set $i_t\in \mathrm{1,2,3},\dots n$ uniformaly at random

8: $X_t^{\prime }=X_{t-1}+\eta \left(y_{i_t}\left(y_{i_t}^{{\rm T}}{X}_{t-1}-y_{i_t}^{{\rm T}}{\overline{X}}_{f-1}{B}_{t-1}\right)+\overline{U}{B}_{t-1}\right)$

9: $X_t=X_t^{\prime }{\left({{X^{\prime }}^{{\rm T}}}_t{X}_t^{\prime }\right)}^{1/2}$

This is to ensure that $W_t$ has orthonormal columns

10: end for

11: ${\overline{X}}_f=X_m$

12: end for

5.5 Hierarchical hidden Markov classification

Similar to HHMM [17], the PHHMM model uses the Baum-Welch algorithm to calculate the likelihood-maximizing parameters of the model given the observed data. It comprises four phases: the initial phase where the $\lambda$ is randomly assumed if there is no prior knowledge, the forward phase where the forward variable is calculated recursively, the backward phase where the backward variable is calculated, and the update phase to update the parameters. Then, the model uses the Viterbi algorithm to find the most likely sequence of the hidden states given the observed data and the parameters. Finally, it uses the DDoS detection algorithm to detect the multistage attack based on the observed alert sequence, where, the standard HHMM focuses on a single category with a limited amount of features thus it is difficult to detect attack traffic that appears to be normal traffic.

The traditional HHMM constitutes multi-single states that are considered as self-contained probabilistic models [18]. However, due to the heterogeneity of IoT traffic, we design each state to have multiple separate lower HMM layers and one upper HMM layer, each lower state constitutes three levels:

• Learning: The observations of the first level train the $L_1{\mathit{\text{LHMM}}}_i$ by the Baum-Welch algorithm to determine model parameters.

• Decoding: The observations of the second level trains the $L_2{\mathit{\text{LHMM}}}_i$ by Viterbi algorithm to find the most likely sequence of hidden states using model parameters by the Viterbi algorithm.

• Evaluation: The observations of the third level trains the $L_3{\mathit{\text{LHMM}}}_i$ and find the DDoS attacks sequence using the most probable sequence.

The model has one upper HMM state for predicting DDoS attacks that use the attack sequence from the lower states to learn new patterns of DDoS attacks by the DDoS detection algorithm. Thus, we can detect the multistage DDoS attacks in this extended mode, unlike the standard HHMM.

Model Training (Baum-Welch algorithm) Baum-Welch algorithm [19] is a recursive Expectation–Maximization method for estimating un-observed hidden parameters in an HHMM model. This algorithm facilitates the complex challenges of analytically applying maximum likelihood estimation. It trains the HHMMs to find the optimal $\lambda$. Starting with initialized values, the algorithm iteratively adjusts the parameters based on a set of observed feature vectors.

By this algorithm, for HHMM models (${\lambda }_1^{q^l},{\lambda }_2^{q^l},\dots ,{\lambda }_n^{q^l}$) and a given sequence of observations $\left(O^{q^l}=O_1^{q^l},O_2^{q^l},\dots ,O_t^{q^l}\right)$, we choose ${\lambda }^{q^l}=\left(A^{q^l},B^{q^l},{\pi }^{q^l}\right)$ such that $P\left(O|{\lambda }_i^{q^l}\right),i=\left[1,n\right]$ is locally maximized.

Algorithm 2: The Baum–Welch algorithm.

Input Observation sequence $O^{q^l}$.

Output Re-estimated model parameters:

• The state transition matrix ${a^{\prime }}_{\mathit{ij}}^{q^l}$, and.

• The Observation likelihood sequence ${b^{\prime }}_{\mathit{jh}}^{q^l}$.

1: Initialize Observations ($M$), States ($q_i$), Threshold ($\mathit{Th}$).

2: Estimate $a_{\mathit{ij}}^{q^l}$, $b_{\mathit{jh}}^{q^l}$ using initialization techniques.

3: Calculate the expected probability $P\left(O|\lambda \right)$.

4: reiterate.

5: Calculate forward variable $\alpha \left(q_j^l\right)$:

${\alpha }_{t+1}^l\left(q_j^l\right)=b_j^{q^{l-1}}\left(O_{t+1}\right)$ $\sum {\alpha }_t\left(q_j^{l+1}\right){\alpha }_{\mathit{ij}}^{q_i^l}$

6: Calculate backward variable $\beta \left(q_i^l\right)$:

${\beta }_t^l\left(q_i^l\right)=\sum b_j^{q^{l-1}}\left(O_{t+1}\right)$ ${\alpha }_{\mathit{ij}}^{q_i^{l-1}}$ ${\beta }_{t+1}^d\left(q_j^l\right)$

7: Calculate downward and upward variable $\epsilon \left(q_i^l,q_j^l\right)$:

$\epsilon =\frac{{\alpha }_t\left(q_i^l\right)a_{\mathit{ij}}^{q^{l-1}}{\beta }_{t+1}\left(q_j^l\right)}{P\left(O|\lambda \right)}$

8: Estimate the state probability ${\gamma }_h\left(q_i^l\right)$ and ${\gamma }_f\left(q_i^l\right)$:

${\gamma }_{h_t}\left(q_i^l\right)=\frac{{\alpha }_t\left(q_i^l\right){\beta }_t\left(q_j^l\right)}{P\left(O|\lambda \right)}{\gamma }_{f_t}\left(q_i^l\right)=\frac{{\alpha }_t\left(q_i^l\right){\beta }_t\left(q_i^l\right)}{P\left(O|\lambda \right)}$

9: Compute the optimal state sequence $X\left(i,j\right)$:

$X\left(i,j\right)=\frac{{\alpha }_t^l\left(i\right)a_{\mathit{ij}}^l{\beta }_{t+1}^l\left(j\right)b_j^l\left(O_{t+1}\right)}{\sum \sum {\alpha }_t^l\left(i\right)a_{\mathit{ij}}^l{\beta }_{t+1}^l\left(j\right)b_j^l\left(O_{t+1}\right)}$

10: Estimate ${a^{\prime }}_{\mathit{ij}}^{q^l}$ and ${b^{\prime }}_{\mathit{jh}}^{q^l}$:

$\begin{array}{l}{a^{\prime }}_{\mathit{ij}}^{q^l}=\frac{\sum \epsilon \left(q_i^{l+1},q_j^{l+1}\right)}{\sum {\gamma }_{h_t}\left(q_i^{l+1}\right)}\\ {b^{\prime }}_{\mathit{jh}}^{q^l}=\frac{\sum {\gamma }_f\left(q_i^l\right)+\sum {\gamma }_h\left(q_i^l\right)}{\sum {\gamma }_f\left(q_i^l\right)+\sum {\gamma }_h\left(q_i^l\right)}\end{array}$

11: Calculate $P\left(O|\lambda \right)$ through the estimated parameters:

$\begin{array}{l}\epsilon =P\left(O|{{\lambda }^{\prime }}^{q^l}\right)-P\left(O|{\lambda }^{q^l}\right)\\ P\left(O|{\lambda }^{q^l}\right)=P\left(O|{{\lambda }^{\prime }}^{q^l}\right)\\ a_{\mathit{ij}}^{q^l}={a^{\prime }}_{\mathit{ij}}^{q^l}{b}_{\mathit{jh}}^{q^l}={b^{\prime }}_{\mathit{jh}}^{q^l}\end{array}$

12: until $\epsilon <\mathit{Th}$.

13: return ${a^{\prime }}_{\mathit{ij}}^{q^l},{b^{\prime }}_{\mathit{jh}}^{q^l}$.

Model Decoding (Viterbi algorithm) Viterbi decoding algorithm [26] predicts the hidden traffic states. This algorithm only uses state-optimized joint likelihood for observation data and the underlying Markovian state sequence as the objective function for estimation. Opposed to the BW algorithm, it does not update all likely paths for all states in the HHMM.

Algorithm 3: Viterbi algorithm [26].

Input Re-estimated model parameters ${a^{\prime }}_{\mathit{ij}}^{q^l}$, ${b^{\prime }}_{\mathit{jh}}^{q^l}$ from BA algorithm,

Output Re-estimated state transition matrix ${a^{\prime }}_{\mathit{ij}}^{q^l}$, and Alert observation likelihood sequence ${b^{\prime }}_{\mathit{jh}}^{q^l}$.

1: Initialize Observations ($M$), States ($q_i$), Threshold ($\mathit{Th}$), $a_{\mathit{ij}}$, $b_j\left(v_k\right)$.

2: Obtain the model ($\lambda$) through expected probability $P\left(O|\lambda \right)$.

3: reiterate.

4: Split $O^{q^l}$ into $N$ states through Viterbi decoding.

5: ${a^{\prime }}_{\mathit{ij}}^{q^l}=\frac{\mathit{no}.\mathit{\text{of\hspace{0.17em}states\hspace{0.17em}transitions\hspace{0.17em}fromitoj}}}{\mathit{\text{total}}\mathit{no}.\mathit{\text{of\hspace{0.17em}states\hspace{0.17em}transition\hspace{0.17em}fromi}}}$

6: ${b^{\prime }}_j^{q^l}\left(v_k\right)=\frac{\mathit{no}.\mathit{\text{ofoccurrencesofobservationkinstatej}}}{\mathit{\text{totalno}}.\mathit{\text{ofobservationsinstatej}}}$

where, $b_j^l\left(v_k\right)=P\left(O_t^{q^l}=v_k|q_t^{q^l}=S_j\right)$.

7: Normalize row sums of ${a^{\prime }}_{\mathit{ij}}^{q^l}$ and ${b^{\prime }}_{j(}^{q^l}{v}_k)$ to unity so that all elements $\in$ [0,1].

8: Estimate ${{\lambda }^{\prime }}^l$ from $O^{q^l}$, ${a^{\prime }}_{\mathit{ij}}^{q^l}$ and ${b^{\prime }}_j^{q^l}\left(v_k\right)$.

9: ${\lambda }^d={{\lambda }^{\prime }}^{q^l}$, $a_{\mathit{ij}}^{q^l}={a^{\prime }}_{\mathit{ij}}^{q^l}$, $b_{{\mathit{jv}}_k}^{q^l}={b^{\prime }}_j^{q^l}\left(v_k\right)$.

10: until $\mid {{\lambda }^{\prime }}^l-{\lambda }^l\mid >\mathit{Th}$.

11: return ${a^{\prime }}_{\mathit{ij}}^l,{b^{\prime }}_{{\mathit{jv}}_k}^l$.

Model Detection algorithm This algorithm uses prior knowledge to learn about the previous attack behavior and track the attack alerts. It gets the likelihood probability of the observation sequence $O_i^{q^d}$ then predicts the DDoS attack behavior based on the occurrence of the attack observation sequence in the previous algorithm.

Algorithm 4: Detection algorithm.

Input Alert observation sequence $O_i^{q^l}$, no. of iterations $G$, ${\lambda }_i^l=\left(A^{q^l},B^{q^l},{\pi }^{q^l}\right)$.

Output Attack alerts observation sequence ${O^{\prime }}_i^{q^l}$.

1: Initialize ${\alpha }_0^{q_1^l}\left(j\right)={\pi }_j^{q_1^l}{b}_j^{q_1^l}\left(O_0\right)$.

2: Calculate the probability of $O_1^{q^l}$:

${\alpha }_j^{q^l}\left(1\right)={\pi }_j^{q^l}{b}_j^{q^l}\left(O_1\right)$

3: Calculate the probability of observation sequence ($O^{q^l}$):

${\alpha }_{t+1}^{q^l}\left(j\right)=\mid \sum {\alpha }_t^{q^l}\left(i\right)a_{\mathit{ij}}^{q^l}\mid b_j^{q^l}\left(O_{t+1}\right)$

4: Calculate the likelihood sequence of the observable sequence (O) obtained by the model:

$P\left(O|{\lambda }^{q_i^l}\right)=\sum {\alpha }_t^{q_i^l}\left(j\right)$

5: If ($\mathit{\text{logP}}\left(O|{\lambda }^{q_i^l}\right)<-\mathit{Th}$).

${\mathit{\text{alert}}}_i={\mathit{\text{alert}}}_i+1$

6: until $G$ is reached.

7: return $\mathit{\text{alert}}$.

6. Experimental setup

6.1 Datasets

In this section, the performance of the PHHMM based anomaly detection approach was tested on traffic combining DDoS attack data with normal data from the prepared dataset. We place the prepared dataset into our PHHMM model to identify DDoS attack intentions and predict the possible attacks. The performance of implementing our proposed model is obtained through MATLAB R2020b simulations. To remove duplicate alerts, we wrote a script for extracting necessary fields such as IP Addresses, Alert ID, Destination Port, Source Port, and timestamp from Snort IDS alerts.

6.2 Evaluation metrics

We analyze and evaluate the performance on the common metrics for IDS performance evaluation; Accuracy (the rate of true results including true negatives and true positives), Precision (positive predictive value), Sensitivity (true positive rate), Specificity (false positive rate), and False Negative Rate (error rate) [27], all in an average sense (see Table 2).

		Predicted class
		Attack	Non-attack
Actual class	Attack	TP	FN
	Non-attack	FP	TN

Table 2.

Two-Class Case Confusion Matrix.

After generating the likely state sequences, we compare them to the known state sequences to define true positive (TP), false positive (FP), true negative (TN), and false-negative (FN) parameters [27]. The accuracy (ACC) is obtained by the following equation:

$$\mathit{ACC}=\frac{\mathit{TP}+\mathit{TN}}{\mathit{TP}+\mathit{TN}+\mathit{FP}+\mathit{FN}}$$E13

The precision (PR), the fraction of the total number of positive cases that are correctly identified as attacks to the total number of attacks, is obtained by the following equation:

$$\mathit{PR}=\frac{\mathit{TP}}{\mathit{TP}+\mathit{FP}}$$E14

Sensitivity (SN) or the true positive rate, the fraction of the total number of classified true positive that are accurately identified as attacks to the total number of positive cases, is calculated by the following equation:

$$\mathit{SN}=\frac{\mathit{TP}}{\mathit{TP}+\mathit{FN}}$$E15

We use F_measure to evaluate the model’s overall accuracy considering both precision and sensitivity. Having a good F-measure value indicates that the model has low false positives and false negatives, which means that it correctly identifies attacks. It is calculated by the following equation:

$$F_{\mathit{\text{measure}}}=2\times \frac{\mathit{PR}\times \mathit{SN}}{\mathit{PR}+\mathit{SN}}$$E16

The following equation is used to identify the error rate (ER) for false negative predictions:

$$\mathit{ER}=\frac{\mathit{FP}+\mathit{FN}}{\mathit{TP}+\mathit{TN}+\mathit{FP}+\mathit{FN}}$$E17

7. Evaluation results

Compared to the original system, our model constructs an equivalent system with a minimal number of constraints over real-valued variables consisting of bounds on variations. This helps in reducing the high state space and improving the classification accuracy and time complexity as well.

7.1 Classification accuracy

The above results show that our proposed model obtains satisfactory results with regard to attack detection rate. The proposed model has 98.9$\%$ accuracy and 97.9$\%$ precision. Table 3 reviews the results of the performance of our model compared to the neural network (NN), Naive Bayes (NB), and HHMM classification algorithms.

Models (Training 80$\%$/ Testing 20$\%$)	${ACC}$	${PR}$	${SN}$	$F_{{\text{Measure}}}$	${ER}$
Neural network	0.92	0.90	0.94	0.92	0.05
Naive Bayes	0.45	0.68	0.56	0.61	0.06
HHMM	0.975	0.92	0.979	0.94	0.03
PHHMM	0.989	0.979	0.99	0.985	0.02

Table 3.

Experiment results summary I.

We perform the tests using different window sizes to understand their influence on the detection. It shows that increasing the size of the window results in better accuracy.

Figure 3 shows the ROC curves for the performance of our proposed model, compared to the HHMM, NN, and NB models. ROC curves help identify the balance between the true-positive rate and the false-positive rate for all possible thresholds. It illustrates the model’s strength to differentiate between attack and non-attack classes (see Figure 4).

Figure 3.

Roc curves of models performance.

Figure 4.

Comparison of average models performance.

7.2 Efficiency

Computation time is not associated instantly with classification; however, it describes the training time taken by the model. Table 4 shows that our model has a lower computation time compared to the HHMM. In [28], The time complexity of calculating the probability of a sequence and estimating the HHMM parameters as the model depends on the length of the observation equals $O\left({\mathit{ST}}^3\right)$, where S is the number of states, and, T is the granted transactions number at each level. Meanwhile, the PHHMM time complexity equals $O\left(Slog\left(S\right)\right)$ based on our calculations. Figure 5 shows the time complexity of HHMM vs. PHHMM.

Models	Computation time (sec)
HHMM	8.3
PHHMM	5.6

Table 4.

Comparison of computation time.

Figure 5.

Time complexity of HHMM vs. PHHMM algorithms.

8. Conclusion

In this work, we propose a probabilistic hierarchical hidden Markov model (PHHMM) applied for IoT intrusion detection which is more efficient than the existing HHMM without compromising classification accuracy. The main idea of our model is to reduce the huge problem state space of IoT traffic through dimensionality reduction by PCA and SVD. The proposed model is tested on the CICISD2019 dataset to detect and predict DDoS attacks. We evaluated our model on major performance metrics including Accuracy, Precision, Sensitivity, and False Negative Rate, Specificity and shows that our scheme has better detection accuracy and low error rates compared to Naive Bayes and neural network classification algorithms. It shows that PHHMM achieves a comparable accuracy as HHMM, better than NB and NN, and better efficiency than HHMM.

Acknowledgments

We would like to thank the Ministry of Higher Education in Saudi Arabia and the University of Adelaide for partially supporting this research.