Machine learning (ML) techniques learn a system by observing it. Events and occurrences in the network define what is expected of the network’s operation. It is for this reason that ML techniques are used in the computer network security field to detect unauthorized intervention. In the event of suspicious activity, the result of the ML analysis deviates from the definition of expected normal network activity and the suspicious activity becomes apparent. Support vector machines (SVM) are ML techniques that have been used to profile normal network activity and classify it as normal or abnormal. They are trained to configure an optimal hyperplane that classifies unknown input vectors’ values based on their positioning on the plane. We propose to use SVM models to detect malicious behavior within low-power, low-rate and short range networks, such as those used in the Internet of Things (IoT). We evaluated two SVM approaches, the C-SVM and the OC-SVM, where the former requires two classes of vector values (one for the normal and one for the abnormal activity) and the latter observes only normal behavior activity. Both approaches were used as part of an intrusion detection system (IDS) that monitors and detects abnormal activity within the smart node device. Actual network traffic with specific network-layer attacks implemented by us was used to create and evaluate the SVM detection models. It is shown that the C-SVM achieves up to 100% classification accuracy when evaluated with unknown data taken from the same network topology it was trained with and 81% accuracy when operating in an unknown topology. The OC-SVM that is created using benign activity achieves at most 58% accuracy.

Machine learning models have long be proposed to detect the presence of unauthorized activity within computer networks. They are used as anomaly detection techniques to detect abnormal behaviors within the network. We propose to use Support Vector Machine (SVM) learning anomaly detection model to detect abnormalities within the Internet of Things. SVM creates its normal profile hyperplane based on both benign and malicious local sensor activity. An important aspect of our work is the use of actual IoT network traffic with specific network layer attacks implemented by us. This is in contrast to other works creating supervised learning models, with generic datasets. The proposed detection model achieves up to 100% accuracy when evaluated with unknown data taken from the same network topology as it was trained and 81% accuracy when operating in an unknown topology.

Attacks in Wireless Sensor Networks (WSNs) aim in limiting or even eliminating the ability of the network to perform its expected function. WSNs are networks with limited resources and often deployed in uncontrollable environments that an intruder can easily access. WSN attacks target specific network layer's vulnerabilities but normally affect other layers as well. Local sensor activity at multiple sensor network layers should be monitored and evaluated to detect possible malicious intervention. In this work we propose a general methodology of an anomaly-based Intrusion Detection System (IDS), named mIDS, that uses the Binary Logistic Regression (BLR) statistical tool to classify local sensor activity to either benign or malicious. We evaluate the proposed system using routing layer attacks and we show that mIDS is able to detect malicious activity within the range of 88%-100%.

Security threats are present in Wireless Sensor Networks and aim to destruct, manipulate the network, or eavesdrop network traffic for malicious intent. The first line of defense is to prevent attacks, usually by applying cryptography, the second line of defense is detecting the presence of the attack within the network, and the third is stopping or recovering quickly from the attack. In this work we deal with the detection phase and examine the impact of routing layer attacks in WSNs in an effort to build better intrusion detection systems (IDS). IDSs base their detection decision on the knowledge gained from known attacks. The attacks' characteristics and methods to manipulate the network are analysed and used to drive recovery mechanisms. In this paper we implemented routing-layer packet drop attacks and investigated the impact of the attacks as "seen" from the Sink node and the victim node. We show that the attacks can have an effect on all network layers of the victim node and the degree of impact depends on many factors, including the topology of WSN and the distance from the Sink.

Plant automation and control are mission-critical applications and require timely and reliable data delivery, which is difficult to provide using a wireless technology. This is especially more difficult in industrial environments with harsh radio conditions. In this paper we present a dynamic and distributed topology control algorithm for Wireless Sensor Networks for use in performance critical environments. This topology control algorithm assumes a small number of sensor nodes connected to a single sink and communicating using a TDMA-based MAC protocol designed with the application requirements in mind. Our solution was implemented and evaluated in real testbed inside an oil refinery. Evaluation results demonstrating the self-organizing properties of the proposed mechanism, as well as its operational performance are included. The results show that the system reliability is high and that data are delivered on time to the control center.