Vol.73, No.2, 2022, pp.3099-3118, doi:10.32604/cmc.2022.028285
R-IDPS: Real Time SDN-Based IDPS System for IoT Security
  • Noman Mazhar1,2, Rosli Saleh1,*, Reza Zaba1,3, Muhammad Zeeshan4, M. Muzaffar Hameed1, Nauman Khan1
1 Faculty of Computer Science and Information Technology, University of Malaya, Kuala Lumpur, 50603, Malaysia
2 Centre for Research in Industry 4.0, University of Malaya, Kuala Lumpur, 50603, Malaysia
3 MIMOS Berhad, National Applied R&D Centre, Kuala Lumpur, 57000, Malaysia
4 School of Electrical Engineering and Computer Science, National University of Sciences and Technology, Islamabad, 44000, Pakistan
* Corresponding Author: Rosli Saleh. Email:
Received 06 February 2022; Accepted 07 April 2022; Issue published 16 June 2022
The advent of the latest technologies like the Internet of things (IoT) transforms the world from a manual to an automated way of lifestyle. Meanwhile, IoT sector open numerous security challenges. In traditional networks, intrusion detection and prevention systems (IDPS) have been the key player in the market to ensure security. The challenges to the conventional IDPS are implementation cost, computing power, processing delay, and scalability. Further, online machine learning model training has been an issue. All these challenges still question the IoT network security. There has been a lot of research for IoT based detection systems to secure the IoT devices such as centralized and distributed architecture-based detection systems. The centralized system has issues like a single point of failure and load balancing while distributed system design has scalability and heterogeneity hassles. In this study, we design and develop an agent-based hybrid prevention system based on software-defined networking (SDN) technology. The system uses lite weight agents with the ability to scaleup for bigger networks and is feasible for heterogeneous IoT devices. The baseline profile for the IoT devices has been developed by analyzing network flows from all the IoT devices. This profile helps in extracting IoT device features. These features help in the development of our dataset that we use for anomaly detection. For anomaly detection, support vector machine has been used to detect internet control message protocol (ICMP) flood and transmission control protocol synchronize (TCP SYN) flood attacks. The proposed system based on machine learning model is fully capable of online and offline training. Other than detection accuracy, the system can fully mitigate the attacks using the software-defined technology SDN technology. The major goal of the research is to analyze the accuracy of the hybrid agent-based intrusion detection systems as compared to conventional centralized only solutions, especially under the flood attack conditions generated by the distributed denial of service (DDoS) attacks. The system shows 97% to 99% accuracy in simulated results with no false-positive alarm. Also, the system shows notable improvement in terms of resource utilization and performance under attack scenarios. The R-IDPS is scalable, and the system is suitable for heterogeneous IoT devices and networks.
Machine learning; Internet of things; software defined networking; distributed denial of service attacks
Cite This Article
N. Mazhar, R. Saleh, R. Zaba, M. Zeeshan, M. Muzaffar Hameed et al., "R-idps: real time sdn-based idps system for iot security," Computers, Materials & Continua, vol. 73, no.2, pp. 3099–3118, 2022.
This work is licensed under a Creative Commons Attribution 4.0 International License , which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.