The widely deployment of infrastructure and wireless interfaces increases industrial IoT (IIoT) vulnerability to network intrusions, highlighting the requirements for robust network intrusion detection systems (NIDSs). Although deep learning (DL) provides a promising solution for NIDSs, it remains susceptible to adversarial attacks as minor input perturbations can lead to major misclassifications. In this paper, we propose a packet-level adversarial traffic generation (PATG) approach for attacking NIDSs in IIoT, which not only aligns with domain constraints but also evades various DL-based NIDSs. Particularly, we introduce a reversible abstract traffic representation to ensure that the original traffic can be effectively modified while preserving its functionality. We propose a packet-level generative adversarial networks to craft adversarial traffic by learning benign data distribution in feature space and simulating evasion behaviors, which escapes the DL-based NIDSs. We further design two defense schemes to enhance system resilience against proposed adversarial attacks. We evaluate PATG on nine state-of-the-art DL-based NIDSs in the Kitsune and CICIoT23 datasets. Experimental results demonstrate that PATG can achieve a maximum evasion increase rate of 99% with cost-effective execution, while the defense methods significantly mitigate the impact of the adversarial attacks.

The swift expansion of the Internet of Things (IoT) has brought about convenient services, but it has also increased cyber threats. An intrusion detection system (IDS) is an effective tool of mitigating security concerns by identifying suspicious network activities. Many decentralized deep learning methods, such as federated learning (FL), have been applied for intrusion detection. However, developing an effective and reliable collaborative IDS is still challenging due to data privacy leakage during model updates and high communication overhead by local model parameters. Moreover, existing FL methods are limited in practicality since they only perform well under data independent identically distribution (IID), which is not commonly found in real scenarios. To solve these issues, we propose a novel collaborative intrusion detection framework with strong privacy preservation in IoT networks (CIDIoT). Specifically, the CIDIoT extends the improved generative adversarial network model without exchanging individual network data to enable efficient intrusion detection. To enhance the privacy preserving of the framework, differential privacy noise and dynamic threshold secret sharing are added to the uploaded model information and downloaded data while keeping communication efficiency. A novel robust aggregation method is also developed to increase the robustness of the CIDIoT against imbalanced and Non-IID data case. Extensive experimental results on two real-world heterogeneous data sets validate that CIDIoT significantly outperforms other state-of-the-art methods in terms of detection accuracy, communication overhead, and cooperative privacy preservation.

With the thriving of wearable devices and the widespread use of smartphones, the e-healthcare system emerges to cope with the high demand of health services. However, this integrated smart health system is vulnerable to various attacks, including intrusion attacks. Traditional detection schemes generally lack the classifier diversity to identify attacks in complex scenarios that contain a small amount of training data. Moreover, the use of cloud-based attack detection may result in higher detection latency. In this paper, we propose an Edge-assisted Anomaly Detection (EAD) scheme to detect malicious attacks. Specifically, we first identify four types of attackers according to their attacking capabilities. To distinguish attacks from normal behaviors, we then propose a wrapper feature selection method. This selection method eliminates the impact of irrelevant and redundant features so that the detection accuracy can be improved. Moreover, we investigate the diversity of classifiers and exploit ensemble learning to improve the detection rate. To reduce high detection latency in the cloud, edge nodes are used to concurrently implement the proposed lightweight scheme. We evaluate the EAD performance based on two real-world datasets, i.e., NSL-KDD and UNSW-NB15 datasets. The simulation results show that the EAD outperforms other state-of-the-art methods in terms of accuracy, detection rate, and computational complexity. The analysis of detection time validates the fast detection of the proposed EAD compared with cloud-assisted schemes.