This study proposes a heterogeneous hardware-based framework for network intrusion detection using lightweight artificial neural network models. With the increase in the volume of exchanged data, IoT networks’ security has become a crucial issue. Anomaly-based intrusion detection systems (IDS) using machine learning have recently gained increased popularity due to their generation’s ability to detect unseen attacks. However, the deployment of anomaly-based AI-assisted IDS for IoT devices is computationally expensive. A high-performance and ultra-low power consumption anomaly-based IDS framework is proposed and evaluated in this paper. The framework has achieved the highest accuracy of 98.57% and 99.66% on the UNSW-NB15 and IoT-23 datasets, respectively. The inference engine on the MAX78000EVKIT AI-microcontroller is 11.3 times faster than the Intel Core i7-9750H 2.6 GHz and 21.3 times faster than NVIDIA GeForce GTX 1650 graphics cards, when the power drawn was 18mW. In addition, the pipelined design on the PYNQ-Z2 SoC FPGA board with the Xilinx Zynq xc7z020-1clg400c device is optimised to run at the on-chip frequency (100 MHz), which shows a speedup of 53.5 times compared to the MAX78000EVKIT.

This study proposes the wider use of non-intrusive side-channel power data in cybersecurity for intrusion detection. An in-depth analysis of side-channel IoT power behaviour is performed on two well-known IoT devices—a Raspberry Pi 3 model B and a DragonBoard 410c—operating under normal conditions and under attack. Attacks from the categories of reconnaissance, brute force and denial of service are applied, and the side-channel power data of the IoT testbeds are then studied in detail. These attacks are used together to further compromise the IoT testbeds in a “capture-the-flag scenario”, where the attacker aims to infiltrate the device and retrieve a secret file. Some clear similarities in the side-channel power signatures of these attacks can be seen across the two devices. Furthermore, using the knowledge gained from studying the features of these attacks individually and the signatures witnessed in the “capture the flag scenario”, we show that security teams can reverse engineer attacks applied to their system to achieve a much greater understanding of the events that occurred during a breach. While this study presents behaviour signatures analysed visually, the acquired power series datasets will be instrumental for future human-centred AI-assisted intrusion detection.

The growth of the Internet of Things (IoT) has led to a significant rise in cyber attacks and an expanded attack surface for the average consumer. In order to protect consumers and infrastructure, research into detecting malicious IoT activity must be of the highest priority. Security research in this area has two key issues: the lack of datasets for training artificial intelligence (AI)-based intrusion detection models and the fact that most existing datasets concentrate only on one type of network traffic. Thus, this study introduces Dragon_Pi, an intrusion detection dataset designed for IoT devices based on side-channel power consumption data. Dragon_Pi comprises a collection of normal and under-attack power consumption traces from separate testbeds featuring a DragonBoard 410c and a Raspberry Pi. Dragon_Slice is trained on this dataset; it is an unsupervised convolutional autoencoder (CAE) trained exclusively on held-out normal slices from Dragon_Pi for anomaly detection. The Dragon_Slice network has two iterations in this study. The original achieves 0.78 AUC without post-processing and 0.876 AUC with post-processing. A second iteration of Dragon_Slice, utilising dropout to further impede the CAE’s ability to reconstruct anomalies, outperforms the original network with a raw AUC of 0.764 and a post-processed AUC of 0.89.

This paper proposes and analyses a lightweight Convolutional Neural Network (CNN) based anomaly detection framework for Internet of Things (IoT) devices. IoT security has become a massive concern in recent years. IoT devices form the backbone of much of the critical infrastructure we have today. From power stations to biomedical devices, there is the potential of heavy financial damage and loss of human life if they become compromised. As IoT adoption accelerates, the amount of cyberattacks on IoT devices increases substantially. Due to the resource constrained nature of IoT devices, no security solution addresses all concerns in the IoT field. By training models based on normal power consumption behaviour, a wide range of anomalies can be detected in the power time series data of the IoT device. The methodology proposed in this paper is generic in nature, making it applicable to every IoT device on the market. The work in this paper is implemented at the edge, on an ultra-low-power microcontroller.

With the widespread integration of new technologies, IoT devices are becoming increasingly diverse and capable of handling highly complex tasks, compared to previous generations. This evolution has led to demands for a comprehensive security approach across multiple layers of an IoT architecture. This work proposes a scalable security solution from the edge to the cloud, combining Blockchain technology and anomaly-based IDS (Intrusion Detection System). Smart contracts provide a transparent environment for registering and managing IoT devices on the cloud. Specifically, the smart contract includes two authorization levels for managing administrators and IoT devices. Besides, anomaly-based IDSs are deployed at Gateways to detect network attacks. We propose using lightweight machine learning models on FPGA hardware acceleration for Gateways. We have simulated the Blockchain network on the Ganache software, demonstrating that the smart contract effectively manages administrators and devices such that only authorized entities can access the system. The FPGA-based Gateway, which contains pre-trained ANN (Artificial Neural Network) and CNN (Convolutional Neural Network) detection models from the IoT-23 dataset, has been deployed on the Alveo U280 card (NetFPGA-PLUS). The ANN model has achieved the highest processing speed at 20Gbps. The results indicate that integrating Blockchain and anomaly-based IDS significantly enhances scalable security in IoT networks.