The growth of the IoT has revolutionized connectivity by allowing a wide range of entities and objects to be connected to the Internet [1]. However, one of the biggest challenges faced by this technology is its vulnerability to cyber-attacks. With limited resources and an increasing number of devices using diverse communication protocols, IoT devices are at risk [2]. Unfortunately, many IoT devices and services have poor security designs, making them easy targets for attackers who can exploit vulnerabilities through actions like creating botnets or deploying malicious software. Furthermore, traditional intrusion detection systems often struggle with detecting these attacks due to resource limitations and the inherent complexity of the IoT [3]. Smart platforms typically connect the majority of IoT devices using Wi-Fi networks. However, these wireless connections necessitate heightened security measures. Unfortunately, certain IoT devices lack the requisite hardware support required to effectively detect and combat cyber-attacks. Consequently, they are rendered ineffectual against newer and more sophisticated attack methods [4]. Ensuring robust security in the realm of IoT presents a considerable challenge due to various factors such as diverse device types and sensors, wireless communication protocols, inadequate device security designs, resource limitations and inherent complexities embedded within the overall structure of IoT.

Network intrusion detection systems play a crucial role in network monitoring, identifying and tracking malicious activities and detecting intrusions. They serve as valuable defense mechanisms against different cyber threats and attacks. IDS models are categorized based on their detection methods into two main approaches: anomaly-based and signature-based [5]. Anomaly-based IDS models analyze behaviors to differentiate between normal patterns and abnormalities or deviations, which proves to be successful in detecting polymorphic or unknown attacks [6]. The IDS models that rely on sets of pre-defined attack patterns are known as signature-based IDS. However, with the increasing volume and diversity of network traffic in IoT devices and social media applications, solely relying on identifying these pre-defined attack patterns is impractical for detecting intrusions in networks [7]. This is where anomaly-based IDS models come into play, as they are designed to identify unknown attacks when there are no pre-defined patterns available for IoT networks. Recently, it has been recognized that deep learning algorithms offer a powerful capability to extract significant features from input data, which can greatly enhance the classification models' learning ability across various computer science domains [8].

Convolutional neural networks have emerged as a valuable tool in detecting anomalies within the IoT. This is due to their ability to automatically extract both low and high-level features from diverse datasets, making computations faster and more efficient [9]. Ng et al. [10] proposed a unique anomaly detection system based on vector convolutional neural networks. CNNs are particularly advantageous for detecting and classifying anomalies because they possess the capability to identify key features without human intervention while also conducting computations at an accelerated pace. Despite these advantages, several challenges remain unsolved when it comes to anomaly detection using deep learning methods within the IoT context. These include issues such as identifying essential features needed for effective attack detection, extracting novel features from data and reducing false negatives. Based on the mentioned cases, we propose a CNN for anomaly-based intrusion detection systems that focuses on detecting recent DDoS attacks found in the CICDDoS2019 dataset. Our algorithm leverages the concept of edge computing to process a large amount of data close to its source, thereby reducing network transmission bandwidth and enhancing overall data processing efficiency. This study utilized three types of classification: binary, 8-class and 13-class classification techniques were employed to accurately identify DDOS attacks. 

The paper is structured into several sections to guide the reader through the content. In the subsequent section, an analysis of previous research on intrusion detection is provided. Following that, in the third section, a detailed explanation of the chosen research methodology is given. The fourth section presents an evaluation of our proposed method. Finally, all findings are summarized and concluded in the last section.

Related Works

Hassan et al. [11] proposed a novel hybrid deep learning approach that combines the power of a CNN with a Weight Dropped Long Short-Term Memory model (WDLSTM) to effectively detect intrusions in large-scale datasets. The CNN component was employed for feature discovery, while the WDLSTM technique helps prevent overfitting by allowing the neural network to generalize better. The proposed method was evaluated on the UNSW-NB15 dataset, yielding outstanding results, with binary classification accuracy reaching 97.1% and an impressive multiclass classification accuracy of 98.4%. These outcomes showcase how advancements in information and communication technology have driven significant improvements within the entire computational environment.

Zhang et al. [12] presented a CNN-based approach for implementing intrusion detection in Local Area Networks (LAN). Through experimentation on the KDD99 dataset, that technique displayed remarkable capabilities in detected network attacks and achieved an impressive accuracy of 98.34%. The experimental findings conclusively demonstrate the efficacy and high accuracy of the proposed CNN-based method for intrusion detection.

Kaur et al. [13] conducted an analysis of various attacks using a CNN model and provided detailed descriptions for each attack. The evaluation of the model's performance was carried out on the CICIDS2017 and CICIDS2018 datasets. While the CNN model exhibited capabilities for multiclass attack classification, it showed less than satisfactory detection rates for certain types of attacks. However, in terms of prediction accuracy, the model demonstrated the ability to accurately classify and characterize 99% of attacks in the CICIDS2017 dataset and 97.5% in the CSE-CIC-IDS2018 dataset.

Ferrag et al. [14] conducted an extensive survey on the application of deep learning techniques for detecting data security intrusions. The researchers compared and analyzed seven distinct deep learning models using 35 well-known datasets, classifying them into different groups. The evaluation process encompassed binary and multiclass classification tasks with a focus on two specific datasets: BoT-IoT and CIC-IDS2018. Moreover, the study also involved an investigation into various attack methods to assess the effectiveness of these deep learning models across diverse scenarios. Performance assessment was carried out based on metrics such as false alarm rates, accuracy and detection rates. The results indicated that the CNN model outperformed both the FFN and RNN models in terms of efficiency, making it a promising choice for data security intrusion detection.

Yin et al. [15] presented a unified deep-learning algorithm specifically designed for anomaly detection in IoT networks. Their approach involved a combination of LSTM autoencoders and CNNs to effectively identify abnormalities within the data. To further improve learning predictions, they utilized a two-stage window-based data preprocessing technique. It is important to highlight that their proposed methodology focused solely on binary classification and the results were highly promising. Significant improvements were observed in terms of precision, recall, F1 score and overall accuracy, which reached an impressive 98.36%. These findings underscore the efficacy of their unified deep-learning approach for accurate anomaly detection in IoT networks.

Jia et al. [16] The author of the study proposed countermeasures against DDoS attacks in IoT devices and introduced a new defense scheme called Flow Guard. Their approach focused on detecting, identifying, classifying and mitigating IoT-based DDoS attacks. They also developed an algorithm for detecting such attacks by analyzing traffic patterns and created two machine learning models to accurately identify and classify them. To assess the efficacy of their models, the researchers generated a substantial dataset using BoNeSi and Slow HTTP Test simulators in conjunction with the CICDDoS2019 dataset. The evaluation aimed to measure both identification/classification accuracy and model efficiency. The results were highly promising, with the LSTM algorithm proposed in the study achieving an impressive identification accuracy of 98.9%. Additionally, the proposed CNN model demonstrated an exceptional classification accuracy of up to 99.9%. Furthermore, the study highlighted that these models meet the latency constraints required for IoT applications when deployed on edge servers with computational capabilities surpassing those of personal computers.

Smys et al. [17], introduced an intrusion detection system tailored for IoT networks. The primary objective was to create a model capable of effectively detecting various types of attacks within these networks, achieved through a hybrid CNN approach. This proposed model exhibits the advantage of being versatile and applicable to a wide range of IoT applications. Through comprehensive experiments, the researchers observed that the hybrid model demonstrated higher sensitivity in detecting attacks within IoT networks compared to existing approaches. The study also involved analyzing different attack types commonly found in IoT environments. To enhance the model's performance, they incorporated long short-term memory processes into the CNN module. The experimental results were highly promising, as the proposed model achieved an impressive detection accuracy rate of 98%. This finding suggests that the application of this intrusion detection system holds significant promise in elevating security measures across diverse IoT settings.

Ferrag et al. [18], introduced three Intrusion Detection System (IDS) models based on deep learning techniques. These models included a CNN-based IDS model, a deep neural network-based IDS model and a recurrent neural network-based IDS model. The study aimed to assess the performance of these models in comparison to traditional machine learning approaches, particularly in the context of cybersecurity in Agriculture 4.0. To evaluate the effectiveness of each model, two classification types (binary and multiclass) were considered using two newly created datasets: CICDDoS2019 dataset and TON_IoT dataset. When tested with these datasets, the intrusion detection system model employing CNNs outperformed state-of-the-art IDS techniques based on deep learning. The experimental results were remarkable, with the CNN-based IDS model achieving an exceptional accuracy rate of 99.95% for binary traffic detection and 99.92% for multiclass traffic detection.

Saba et al. [3], presented a novel method based on CNN for intrusion detection systems in IoT networks, aimed at identifying abnormal activities effectively. The approach focuses on comprehensive traffic analysis throughout the IoT network. Through experimentation with the NID Dataset and BoT-IoT datasets, the proposed model demonstrated remarkable results, achieving high accuracy rates of 99.51% and 92.85% for detecting intrusions and identifying anomalous traffic behavior, respectively. This research showcases the potential of CNN technology in enhancing anomaly-based IDS capabilities for improved security in IoT networks.

Dataset

The Canadian Institute for Cybersecurity and the University of New Brunswick have made available the CICDDoS2019 dataset [19], which contains a wide variety of samples that allow for the investigation and detection of Distributed Denial-of-Service attacks employing IDS. The distribution of these assaults throughout the sample is shown. It includes examples of both regular traffic and assault traffic, covering a total of 13 distinct types of attacks. When doing studies on IDS-based detection of DDoS attacks and mitigation, researchers frequently use this dataset. A training set and a testing set are further separated into two sections of the dataset. Table 1 gives a summary of information including names of specific attacks and relevant sample sizes.

Data Pre‑Processing

From a higher-level perspective, network-based intrusion detection technology aims to detect and deal with any possible abnormal actions within a network. On a technical level, this technology involves the extraction of related features from network traffic data and their subsequent classification. The source of the traffic data, the probability distribution of sample categories, preprocessing methods used on data samples, as well as the development and training procedures of the classification model, can all have an impact on how effectively network-based IDS function [19]. Consequently, in order to develop an intrusion detection model that exhibits high performance levels, it is crucial to efficiently preprocess the sample data. By doing so, we can gain deeper insights into both inherent relationships between different sets of data and correlations with specific sample instances.

Table 1: Details of CICDDoS2019 Training/Testing Dataset

Figure 1: Model of Proposed NIDS-CNN Deployment

Figure 2: Architecture of CNN for Intrusion Detection

For the intrusion detection CICDDoS2019 dataset, the effectiveness of any learning system depends on the data pre-processing performed [20,21]. To prepare the dataset for creating the suggested model, the research used the following techniques.

• Feature Selection: Feature selection is a crucial method of data pre-processing that enhances efficiency by minimizing the amount of characteristics [22]

• Data Cleaning: There are two objectives of data preprocessing. Firstly, it involves eliminating redundant information and removing multiple duplicate records from the dataset. Secondly, it aims to eliminate null values, NAN values and infinity values present in the data

• Feature Scaling: Feature scaling is an important step in data preprocessing. In order to ensure that all values are mapped to the same order of magnitude, regardless of whether they are too large or too little, the sample data must be normalized. This enables efficient cross-operation between different attributes and allows for accurate correlation analysis. By converting all attribute types to numerical values, we ensure uniformity across all data records in the dataset. In particular, continuous numerical attributes often have a significant difference in value range. Such variation can heavily influence decision-making during model training using neural networks. To mitigate this issue and promote fair evaluation of these attributes, it becomes necessary to normalize them by bringing their values within a consistent range. The NIDS-CNN deployment model is shown in Figure 1

Proposed CNN-Based IDS

Convolutional networks, sometimes referred to as convolutional neural networks or CNNs, are a specific type of neural network with a well-known network architecture that are specifically designed for data processing. The term "convolutional neural network" denotes the employment of the convolutional mathematical operation by the network [9]. The Convolutional Neural Network model typically handles two-dimensional input data in its input layer. However, intrusion detection data is usually represented as one-dimensional data. To address this, the intrusion detection data is subjected to convolution using a one-dimensional convolution method. Although CNNs are widely used in graphics, images and natural language processing domains, there hasn't been a well-established CNN model for intrusion detection yet. Hence, we propose a specific CNN network architecture designed for intrusion detection purposes (Figure 2).

The CNN consists of a total of 10 layers, including an input layer, three convolutional layers to extract features from the input data, three dropout layers to mitigate overfitting and improve generalization performance, one max-pooling layer to reduce spatial dimensions while preserving important information, one fully connected layer for classification purposes and finally an output layer that provides the desired prediction or classification result. CNN structure is presented as follows:

• Input Layer: Following the preprocessing steps, including data set cleaning and normalization, three distinct datasets are created. The input layer, the first layer of the model, is then filled with the processed data directly

• The Convolution Layer: Convolution layers present in the network architecture are Layer 2, Layer 4 and Layer 6. These convolutional layers possess distinct characteristics such as sparse connection and parameter sharing. Unlike traditional neural networks that utilize matrix multiplication to establish the relationship between input and output, each parameter within the weight matrix contributes to expressing the interaction between input and output units. Conversely, convolution layers exhibit sparsity or limited connectivity/interactions termed "sparse interactions". The Gated Convolutional Neural Network (GCNN) utilizes a gated approach for convolution calculation by incorporating gating mechanisms from recurrent neural networks. This mechanism allows useful information preservation while discarding insignificant details. In particular, when applied to CICDDoS2019 dataset analysis tasks, GCNN employs specific calculation formulae designed for gated convolutions.

In the above equation, E represents the output of the previous layer in a CNN. The weights ω1 and ω2 are applied to this input, along with offsets b1 and b2. The activation function ReLu is then used to introduce nonlinearity into the calculation. Finally, ⊗ denotes matrix multiplication. Gated convolution is a method that merges two distinct convolutions by element-wise multiplying their individual outputs. One of these convolutions, denoted as A, performs a linear computation without utilizing an activation function. On the other hand, for the second convolution (denoted as B), the result of the linear calculation undergoes an activation function before it is obtained. This multi-step approach enables enhanced flexibility in capturing intricate patterns within data. Afterward, the gated convolution value is obtained by multiplying A and B. There are three unique convolution layers in the suggested network model. A approach of decreasing kernel size and rising kernel number is used to construct the convolution kernel sizes for these various layers. Specifically, starting from the top layer downwards, the kernel sizes are set to 1×3, 1×2 and 1×1, respectively. Additionally, the number of kernels in each layer is set at 16, 32 and 64 correspondingly. In order to extract more local features in shallow convolutional layers, a larger convolutional kernel size has been utilized. In the convolutional layer of deep learning, a smaller kernel is utilized to improve local features. This approach improves the model's ability to extract relevant information by focusing on localized patterns. By utilizing a smaller convolution kernel, optimal local features can be obtained which in turn leads to enhanced classification performance. Additionally, the use of small kernels enables the clustering of learned features, minimizing the negative impact of convolution redundancy on model performance. Consequently, this technique proves effective in mitigating redundancies and optimizing feature extraction processes within deep learning models.

• The Dropout layer: To address the issue of over-fitting in the CNN model during training, a layer called dropout is utilized. Overfitting can occur when there is an imbalance in the labels of the datasets, which negatively impacts the classification performance of the model. By implementing dropout layers at specific points within layers 3, 5 and 7 of our proposed models with corresponding dropout values set to 0.6, 0.5 and 0.4, respectively, we can effectively alleviate this problem

• Pooling Layer (Max): This particular layer is designed to extract both strong and fine features from the input data. It achieves this by utilizing a maximum pooling method that compresses and removes redundant features. One of the main benefits of this layer is its ability to reduce computation time and errors by reducing the number of calculations required in the model. Specifically, in our proposed model, we have designated layer 8 as the max-pooling layer with a stride value of 2. As a result, this reduces the number of parameters to half their original size

• Fully Connected Layer: In most cases, a CNN model will include fully connected layers. The presented model implements one fully connected layer with a specific number of neurons set at 250

• Output Layer (Softmax): The output layer functions as a classifier in deep learning, employing the Softmax function for this purpose. In Convolutional Neural Networks, multiclassification tasks are frequently carried out using Softmax classification, a logistic regression extension. The Softmax classification becomes logistic regression when used for binary classification. Softmax calculates the probability of each class out of k possible classes given a data point x in multiclassification issues with at least three values for the class label y (k > 2), such as (x₁, y₁), (x₂, y₂),..., (x_n, y_n), where each y_i belongs to 1, 2 or k. Our suggested model, which focuses on precisely identifying intrusions, functions as a standard classifier for both binary and multiclassification situations. Batch Normalization, the Adam algorithm and other techniques are used to speed up the model's convergence time when there are only so many computational resources available

The purpose of this evaluation is to assess the outcome of the CNN model. To accomplish this, we conducted experiments using a deep learning model on benchmark datasets that are publicly available.

In this section, we analyze the performance of the proposed NIDS-CNN in effectively detecting DDoS assaults by considering binary class, eight-class and thirteen-class classification. The CICDDoS2019 dataset was utilized for training and testing purposes. In our approach, we randomly selected 80% of the data for training while utilizing all data for testing. This resulted in three distinct datasets: Dataset 1, Dataset 2 and Dataset 3. The first dataset, Dataset 1, consists of two classes: Benign and DDoS. You can refer to Table 2 for more details about the training and testing datasets included in this set.

Table 2: Dataset 1: Binary Classification

The second dataset is called Dataset 2 and it contains eight classes: LDAP, MSSQL, NetBIOS, UDP, SYN, UDP-Lag, Port map and Benign. Table 3 provides information on the statistics for each class within Dataset 2.

Table 3: Dataset 2: Eight-Class Classification

Lastly, Dataset ​​​​​3 comprises thirteen classes including DNS, LDAP, MSSQL, Net-BIOS, NTP, SNMP, SSDP, UDP, Syn, TFTP, UDP-Lag, WebDDoS and Benign. The detailed breakdown of DDoS attack type data within Dataset ​3 is presented in Table 4.

Table 4: Dataset-3: Thirteen-Class Classification

The details regarding the three datasets employed in this study can be found in Table 5. Our suggested NIDS-CNN starts with pre-processing the data and produces three separate datasets. Each of these datasets is then trained and tested to see how well the NIDS-CNN performs in recognizing DDoS assaults in the IoT context. Our outstanding accuracy ratings for binary classification tasks, eight-class classification tasks and thirteen-class classification tasks total 99.68, 99.90 and 99.95%, respectively. These experiments effectively demonstrate the efficacy of our proposed model when applied in an IoT setting.

Table 5: Experimental Result of the Proposed Model

IoT infiltration incidences have increased as a result of the Internet's quick development and the emergence of a new generation of information infrastructure. Ensuring the security of IoT systems is currently a major area of research. Consequently, we propose an algorithm for detecting intrusions in IoT systems using deep learning within an edge computing environment. The proposed approach involves feeding preprocessed data from the CICDDoS2019 dataset into our intrusion detection model that utilizes edge computing. To achieve both binary and multiclassification for data analysis, an improved CNN model is employed. We introduced gated convolution to simplify and optimize our CNN model while maintaining high detection accuracy. Our experimental results demonstrate remarkable performance with 99.68% accuracy in identifying benign activity versus DDoS attacks (binary classification), 99.90% accuracy across eight distinct classes representing various types of DDoS attacks (eight-class classification) and 99.95% accuracy across thirteen different classes indicating specific attributes associated with DDoS attacks (thirteen-class classification). This highlights the effectiveness and robustness achieved by utilizing deep learning techniques combined with edge-based computations. Further research is necessary to improve threat detection in IoT as the industry evolves. It is crucial to incorporate robust security measures within and around IoT devices since they are fundamental components of IoT networks. Our future plans include developing new methods with different algorithms and leveraging various deep learning techniques.

1. Altay, O. Chaotic Slime Mould Optimization Algorithm for Global Optimization. Springer Netherlands, 2022.

2. Mousavi, S.K. et al. “Improving the Security of Internet of Things Using Cryptographic Algorithms: A Case of Smart Irrigation Systems.” Journal of Ambient Intelligence and Humanized Computing, vol. 12, 2021.

3. Saba, T. et al. “Anomaly-Based Intrusion Detection System for IoT Networks through Deep Learning Model.” Computers and Electrical Engineering, vol. 99, 2022.

4. Eskandari, M. et al. “Passban IDS: An Intelligent Anomaly-Based Intrusion Detection System for IoT Edge Devices.” IEEE Internet of Things Journal, vol. 7, no. 8, 2020, pp. 1-16.

5. Liang, C. et al. “Intrusion Detection System for the Internet of Things Based on Blockchain and Multi-Agent Systems.” Electronics, vol. 9, no. 7, 2020.

6. Khalaf, B.A. et al. “Comprehensive Review of Artificial Intelligence and Statistical Approaches in Distributed Denial of Service Attack and Defense Methods.” IEEE Access, vol. 7, pp. 51691-51713, 2019.

7. Farhan, B.I. and A.D. Jasim. “Survey of Intrusion Detection Using Deep Learning in the Internet of Things.” Iraqi Journal of Computer Science and Mathematics, vol. 3, no. 1, pp. 83-93, 2022.

8. Kim, K. “Deep Learning in Intrusion Detection Perspective: Overview and Further Challenges.” International Workshop on Big Data and Information Security, pp. 5-10, 2017.

9. Schmidhuber, J. “Deep Learning in Neural Networks: An Overview.” Neural Networks, vol. 61, pp. 85-117, 2015.

10. Ullah, I. et al. “Design and Development of a Deep Learning-Based Model for Anomaly Detection in IoT Networks.” IEEE Access, vol. 9, 2021.

11. Hassan, M.M. et al. “A Hybrid Deep Learning Model for Efficient Intrusion Detection in Big Data Environment.” Information Sciences, vol. 513, 2019.

12. Zhang, L. et al. “An Improved Network Intrusion Detection Based on Deep Neural Network.” IOP Conference Series: Materials Science and Engineering, vol. 563, no. 5, 2019.

13. Kaur, G. et al. “Intrusion Traffic Detection and Characterization Using Deep Image Learning.” IEEE International Conference on Dependable, Autonomic and Secure Computing, pp. 55-62, 2020.

14. Ferrag, M.A. et al. “Deep Learning for Cyber Security Intrusion Detection: Approaches, Datasets and Comparative Study.” Journal of Information Security and Applications, vol. 50, pp. 1-20, 2020.

15. Yin, C. et al. “Anomaly Detection Based on Convolutional Recurrent Autoencoder for IoT Time Series.” IEEE Transactions on Systems, Man and Cybernetics: Systems, vol. 52, no. 1, pp. 1-11, 2020.

16. Jia, Y. et al. “FlowGuard: An Intelligent Edge Defense Mechanism Against IoT DDoS Attacks.” IEEE Internet of Things Journal, vol. 7, no. 10, 2020.

17. Smys, S. and H. Wang. “Hybrid Intrusion Detection System for Internet of Things (IoT).” Journal of ISMAC, vol. 2, no. 4, pp. 190-199, 2020.

18. Ferrag, M.A. et al. “Deep Learning-Based Intrusion Detection for Distributed Denial of Service Attack in Agriculture 4.0.” Electronics, vol. 10, no. 11, pp. 1-26, 2021.

19. CICDDoS2019 Dataset. University of New Brunswick, 2019, www.unb.ca/cic/datasets/ddos-2019.html. Accessed June 2020.

20. Ni, X. et al. “Civil Aviation Safety Evaluation Based on Deep Belief Network and Principal Component Analysis.” Safety Science, vol. 112, pp. 90-95, 2019.

21. Pal, K.K. and K.S. Sudeep. “Preprocessing for Image Classification by Convolutional Neural Networks.” IEEE International Conference on Recent Trends in Electronics, Information and Communication Technology, pp. 1778-1781, 2016.

22. Ahmed, D.S. et al. “Effective Phishing Emails Detection Method.” Turkish Journal of Computer and Mathematics Education, vol. 12, pp. 4898-4904, 2021.

23. Huang, Y. et al. “Supervised Feature Selection through Deep Neural Networks with Pairwise Connected Structure.” Knowledge-Based Systems, vol. 204, p. 106202, 2020.