We present a comprehensive study on applying machine learning to detect distributed Denial of service (DDoS) attacks using large-scale Internet of Things (IoT) systems. While prior works and existing DDoS attacks have largely focused on individual nodes transmitting packets at a high volume, we investigate more sophisticated futuristic attacks that use large numbers of IoT devices and camouflage their attack by having each node transmit at a volume typical of benign traffic. We introduce new correlation-aware architectures that take into account the correlation of traffic across IoT nodes. We extensively analyze the proposed architectures by evaluating five different neural network models trained on a dataset derived from a 4060-node real-world IoT system. We observe that long short-term memory (LSTM) and a transformer-based model, in conjunction with the architectures that use correlation information of the IoT nodes, provide higher performance (in terms of F1 score and binary accuracy) than the other models and architectures, especially when the attacker camouflages itself by following benign traffic distribution on each transmitting node. For instance, by using the LSTM model, the distributed correlation-aware architecture gives 81% F1 score for the attacker that camouflages their attack with benign traffic as compared to 35% for the architecture that does not use correlation information. We validate the effectiveness of our proposed detection mechanism by implementing it on a real testbed. We also investigate the performance of heuristics for selecting a subset of nodes to share their data for correlation-aware architectures to meet resource constraints.

This short paper summarizes our recent/ongoing works [2, 3, 4] on detecting DDoS attacks in IoT systems. In our studies, we conducted a thorough examination of using machine learning to detect Distributed Denial of Service (DDoS) attacks in large-scale Internet of Things (IoT) systems. Unlike prior works and typical DDoS attacks that focus on individual nodes transmitting high volumes of packets, we explored the more sophisticated and advanced future attacks that use a large number of IoT devices while hiding the attack by having each node transmit at a volume that mimics benign traffic. We introduced innovative correlation-aware architectures that consider the correlation between the traffic of IoT nodes and compare the effectiveness of centralized and distributed detection models. Through extensive analysis, we evaluated the proposed architectures using five different neural network models trained on a real-world IoT dataset of 4060 nodes. Our results showed that the combination of long short-term memory (LSTM) and transformer-based models with the correlation-aware architectures offer superior performance, in terms of F1 score and binary accuracy, compared to the other models and architectures, especially when the attacker conceals its actions by following benign traffic distribution on each transmitting node. Furthermore, we investigated the performance of heuristics for selecting a subset of nodes to share their data in resource-constrained scenarios for correlation-aware architectures.

In recent years, there has been a significant surge in the deployment of Internet of Things (IoT) devices, which has consequently escalated security threats, notably Distributed Denial of Service (DDoS) attacks. Our prior research developed an LSTM-based framework for detecting futuristic DDoS attacks but largely relied on simulated datasets [1]. To bridge this gap, we designed a Raspberry Pi (RPi) testbed that mimics the complexities of large-scale IoT networks. This setup allows us to simulate realistic DDoS attacks originating from IoT devices and evaluate the effectiveness of various DDoS detection techniques. Specifically, using this RPi testbed, we validated the effectiveness of our LSTM-based framework in identifying futuristic DDoS attacks, observing an F1 score ranging between 0.8 and 0.86 depending on the aggressiveness of the DDoS attack.

We investigate the application of artificial intelligence to cybersecurity, to contribute to the safe and secure growth of the internet of things (IoT). Specifically, we train and evaluate different neural networks models to detect distributed denial of service (DDoS) attacks in a large-scale IoT system. We consider futuristic attacks launched by sophisticated malicious entities that take over multiple distributed IoT nodes and are able to disguise their intrusion by closely mimicking the benign traffic of the network. Using data from prior work, we find that a truncated Cauchy distribution is a suitable fit for benign traffic volume from IoT devices, and we model the attack traffic volume as following the same distribution but with different parameters for location and scale. We emulate both benign and attack traffic by overlaying these traffic volume distributions on top of an activity status data trace from a real urban IoT deployment consisting of about 4000 nodes. Using our enhanced dataset, we compare four neural network models: multi-layer perceptron (MLP), convolutional neural network (CNN), long short-term memory (LSTM), and autoencoder (AEN), analyzing their performance as a function of a parameter that measures the deviation of the attacks from the benign data. We observe that all four models are sensitive to the distance between benign and attack traffic. We further observe that LSTM gives the best overall performance in terms of both high accuracy and high recall.

Epidemic diseases bring many challenges to universities. In the case of airborne contagious diseases like COVID-19, health agencies’ guidelines recommend that people maintain a physical distance of about 2 meters from each other. Enforcing such physical distancing on a university campus means that it will potentially take longer for students to get into and out of classrooms and buildings on campus. We use real course registration data from a large US university to study wait times students would encounter to enter and exit campus buildings while keeping the recommended 2 meter physical distance, and show that peak wait times can be longer than 20 minutes. We propose LBCS, a load-balanced course scheduling algorithm that intelligently reduces the peak wait time while ensuring that conflicting classes are scheduled at different times. Through simulations we show that LBCS can reduce the peak wait time by a factor of 3×, better than naive alternatives such as shifting some classes to the weekend or randomly perturbing class start times.

As IoT deployments grow in scale for applications such as smart cities, they face increasing cyber-security threats. In particular, as evidenced by the famous Mirai incident and other ongoing threats, large-scale IoT device networks are particularly susceptible to being hijacked and used as botnets to launch distributed denial of service (DDoS) attacks. Real large-scale datasets are needed to train and evaluate the use of machine learning algorithms such as deep neural networks to detect and defend against such DDoS attacks. We present a dataset from an urban IoT deployment of 4060 nodes describing their spatio-temporal activity under benign conditions. We also provide a synthetic DDoS attack generator that injects attack activity into the dataset based on tunable parameters such as number of nodes attacked and duration of attack. We discuss some of the features of the dataset. We also demonstrate the utility of the dataset as well as our synthetic DDoS attack generator by using them for the training and evaluation of a simple multi-label feed-forward neural network that aims to identify which nodes are under attack and when.

This paper considers mobile computation offloading where task completion times are subject to hard deadline constraints. Hard deadlines are difficult to meet in conventional computation offloading due to the stochastic nature of the wireless channels involved. Rather than using binary offload decisions, we permit concurrent remote and local job execution when it is needed to ensure task completion deadlines. The paper addresses this problem for homogeneous Markovian wireless channel models. An online energy-optimal computation offloading algorithm, OnOpt, is proposed. Its energy optimality is shown by constructing a time-dilated absorbing Markov process and applying dynamic programming. Closed form results are derived for general Markovian processes, and the Gilbert-Elliott channel model is used to show how the particular structure of the Markov chain can be exploited in computing optimal offload initiation times more efficiently. It is shown that job completion time probabilities can be computed recursively, which leads to a significant reduction in the computational complexity of OnOpt. The performance of the proposed algorithm is compared to three others, namely, Immediate Offloading, Channel Threshold, and Local Execution. Performance results show that the proposed algorithm can significantly improve mobile device energy consumption compared to the other approaches while guaranteeing hard task execution deadlines.

Multi-decision mobile computation offloading occurs when a task to be remotely executed is uploaded in separate parts. Since the upload is partitioned, separate decisions are needed to determine the best time to initiate each upload. The multi-decision problem is considered for the case where execution completion times are subject to hard deadline constraints and where task offloads occur over a Markovian wireless channel. An online energy-optimal computation offloading algorithm, Multiopt (Multi-decision online Optimum), is introduced, whose optimality is proven using Markovian stopping theory. The paper presents results using the Gilbert-Elliott channel model, where task completion time probabilities can be efficiently computed using Dynamic Programming. Although the proposed algorithm is proven to be energy optimal, its performance is also compared to four others, namely, Immediate Offloading, Channel Threshold, Local Execution, as well as optimal single-part offloading. Results show that the proposed algorithm can significantly improve mobile device energy consumption compared to the other approaches while guaranteeing hard task execution deadlines.