anomaly1_faas
anomaly1_faas
Abstract
1. INTRODUCTION 2
1.1 Overview 2
1.2 Objective
2
1.3.1 Purpose 3
1.3.2 Scope 3
1.3.3 Applicability 3
2.1 Introduction 5
3. METHODOLOGY 8-9
7.1 Conclusion 18
7.2 Applications 18
REFERENCES 21
AD-IoT
ABSTRACT
The rapid advancement of the Internet of Things (IoT) has revolutionized smart cities,
enabling seamless connectivity and automation across various domains, including
transportation, healthcare, and industrial systems. However, the increasing deployment of
IoT devices has also led to an exponential rise in cyber threats, making anomaly
detection a crucial aspect of cybersecurity. This research presents AD-IoT, an anomaly
detection framework based on machine learning, designed to identify and mitigate cyber
attacks targeting IoT networks in smart cities.
The study utilizes the UNSW-NB15 dataset, a benchmark dataset that provides realistic
network traffic, including benign activities and various cyberattack patterns. The dataset
undergoes pre-processing, feature selection, and classification using machine learning
models such as Random Forest (RF) and Extra Trees Classifier (ETC). These models are
evaluated based on accuracy, detection rate (DR), false positive rate (FPR), and
precision-recall metrics to ensure optimal performance. Experimental results indicate that
the proposed model achieves an accuracy of 99.34%, demonstrating high efficiency in
detecting cyber threats while minimizing false positives.
This research also explores the feasibility of implementing AD-IoT in fog computing
environments, allowing real-time detection of anomalies with minimal latency. Future
work includes extending the model to multi-class classification, incorporating deep
learning approaches, and deploying AD-IoT in real-world IoT networks for validation.
The study contributes to the ongoing development of cybersecurity solutions for IoT-
based smart city applications, ensuring robust protection against cyber threats in a
dynamically evolving digital landscape.
1 2024-25
Dept. of ECE, AMCEC
AD-IoT
Chapter 1
INTRODUCTION
1.1 Overview
The rapid advancement of technology has led to the widespread adoption of Internet of
Things (IoT) devices in various sectors, including smart cities, healthcare, transportation,
and industrial automation. These IoT devices collect and exchange massive amounts of
data, enabling automation and intelligent decision-making. However, this interconnected
nature exposes IoT networks to various cyber threats, making them vulnerable to security
breaches, unauthorized access, and cyberattacks. Cybersecurity in IoT has become a
significant concern, requiring robust anomaly detection systems to safeguard smart city
infrastructures. Anomaly detection in IoT (AD-IoT) employs machine learning
algorithms to identify unusual activities that may indicate cyberattacks. By implementing
machine learning-based anomaly detection, smart city infrastructures can enhance
security, mitigate risks, and ensure the continuous operation of essential services.
1.2 Objectives
The primary objective of this project is to develop an anomaly detection system for
identifying cyber threats in IoT networks within smart cities using machine learning
techniques. The system aims to:
1.3.1 Purpose
The purpose of this project is to provide a robust and efficient solution for detecting cyber
threats in IoT networks. By utilizing machine learning-based anomaly detection, the system can
enhance security, reduce risks, and prevent potential cyber attacks on smart city infrastructures.
1.3.2 Scope
The project focuses on detecting anomalies in IoT networks within smart city environments. It
involves data collection, feature selection, model training, and performance evaluation using
machine learning techniques. The scope includes:
1.3.3 Applicability
3 2024-25
Dept. of ECE, AMCEC
AD-IoT
This report is structured into several chapters, each covering different aspects of the research
and implementation:
Chapter 1 (Introduction): Provides an overview, objectives, scope, and applicability of the
project.Chapter 2 (Literature Survey): Reviews existing research on IoT security and anomaly
detection techniques.
Chapter 3 (Requirement Engineering): Details the software and hardware requirements for
implementing the system.
Chapter 4 (Advantages and Disadvantages): Discusses the benefits and limitations of the
proposed solution.
Chapter 5 (Methodology): Explains the system architecture and proposed approach for anomaly
detection.
Chapter 6 (Result Discussion and Performance Analysis): Analyzes the findings, detection
accuracy, and performance evaluation.
Chapter 7 (Conclusion and Future Work): Summarizes the project and outlines future
improvements.
References and Appendix: Lists all cited works and additional supporting information.
This structured approach ensures a comprehensive understanding of IoT cybersecurity, the role
of anomaly detection, and the potential impact of implementing machine learning-based
security solutions in smart cities.
4 2024-25
Dept. of ECE, AMCEC
AD-IoT
Chapter 2
LITERATURE SURVEY
2.1 Introduction
The rapid growth of the Internet of Things (IoT) has revolutionized smart city infrastructure by
enabling real-time monitoring, automation, and improved decision-making processes. However,
the interconnected nature of IoT devices presents new security challenges, making them
vulnerable to cyber attacks. Traditional security mechanisms often fall short in detecting and
mitigating these threats due to the unique constraints of IoT environments, such as limited
computing resources, diverse communication protocols, and decentralized architectures. As a
result, researchers have explored various anomaly detection methods utilizing machine learning
(ML) and artificial intelligence (AI) to enhance cyber security in IoT networks. This literature
survey provides a comprehensive analysis of existing approaches to anomaly detection in IoT-
based smart city systems, highlighting key methodologies, comparative studies, and research
gaps.
The primary objective of this literature survey is to review and analyze various machine
learning-based anomaly detection techniques applied to IoT cybersecurity in smart cities.
Specifically, this survey aims to:
Identify machine learning models and techniques used for anomaly detection.
5 2024-25
Dept. of ECE, AMCEC
AD-IoT
Several researchers have proposed different anomaly detection frameworks for securing IoT-
based smart city systems. Some of the key approaches include:
Recent research has explored hybrid models that combine supervised and unsupervised learning
techniques to enhance detection accuracy. Ensemble learning methods, such as combining
multiple classifiers or leveraging deep learning-based anomaly detection models, have shown
promising results in mitigating security threats in IoT networks.
6 2024-25
Dept. of ECE, AMCEC
AD-IoT
Deep learning models, such as Convolutional Neural Networks (CNN), Recurrent Neural
Networks (RNN), and Long Short-Term Memory (LSTM), have been extensively applied to
IoT anomaly detection. These models excel in handling large-scale IoT datasets and detecting
complex attack patterns. However, they require substantial computational resources and large
datasets for training.
7 2024-25
Dept. of ECE, AMCEC
AD-IoT
Chapter 3
METHODOLOGY
In this section, we propose a detection method system called AD-IoT for detecting cyberattacks at fog
nodes in a smart city. The framework of this method relies on different machine learning algorithms to
enhance the efficiency of AD-IoT for detecting attack behaviors in future urban IoT networks.
This method is designed to monitor the network traffic that passes through each fog node, as fog nodes
are nearest to IoT sensors, rather than detection on the city's massive cloud storage. By identifying
normal and abnormal behaviors at the fog level, the system can proactively alert security cloud services
to analyze and update their security protocols.
System Design
The AD-IoT system consists of several interconnected components designed to function efficiently in
an urban smart city environment. The primary elements of the system include:
IoT Devices: A vast number of IoT devices are connected to a gateway in the fog layer.
Gateway: Each private facility (e.g., smart homes, buildings, malls, schools) has its gateway connected
to a master AD-IoT security gateway in the fog layer, which manages multiple gateways.
AD-IoT Security Gateway IDS System: A master fog node that intelligently monitors communication
and network traffic data. The AD-IoT system is based on ensemble methods that enhance the
performance of algorithms in this model.
The bagging techniques utilized include:
Random Forest (RF)
Extra Tree (ET)
These techniques have massive decision trees and are trained using a subset of the UNSW-NB15
dataset. The ExtraTrees Classifier is used to select the most relevant 12 features for anomaly detection.
8 2024-25
Dept. of ECE, AMCEC
AD-IoT
As outlined, cyberattacks can compromise vulnerable IoT devices in both private and public networks
within urban environments. A Network Intrusion Detection System (NIDS) can leverage machine
learning algorithms (such as Decision Tree, K-Nearest Neighbor, and Random Forest) to classify and
detect malicious behaviors in IoT fog networks.
The AD-IoT system employs an anomaly detection method using machine learning algorithms. This
approach involves statistical analysis techniques to clean and preprocess data, forming an intelligent
predictive model that distinguishes between normal and abnormal traffic. The primary advantages of
this method include:
Reduced False Positive Rates (FPR): By filtering and refining data, the model improves
detection accuracy.
Lightweight Processing: Since detection occurs at fog nodes rather than cloud servers,
computational overhead is significantly reduced.
9 2024-25
Dept. of ECE, AMCEC
AD-IoT
Lower Latency: Processing at the fog level ensures real-time detection and quicker response to
cyber threats.
Energy Efficiency: Unlike cloud-based solutions, the fog-level detection model consumes less
power while maintaining high detection accuracy.
Thus, the AD-IoT approach enhances performance for detecting attacks in fog nodes within smart city
infrastructure. This model ensures minimal latency, lower resource consumption, and efficient anomaly
detection compared to traditional cloud-based security models. By leveraging fog computing, the
system provides a scalable and robust solution for securing IoT networks in modern smart cities.
10 2024-25
Dept. of ECE, AMCEC
AD-IoT
CHAPTER - 4
HARDWARE AND SOFTWARE REQUIREMENT
Requirement engineering is a crucial phase in the development of any project as it outlines the
necessary hardware and software components required for successful implementation. This
chapter provides a comprehensive list of the software and hardware tools necessary for
developing the project, ensuring efficiency, performance, and accuracy.
Software tools are fundamental for the development, testing, and deployment of any system.
The software used in this project includes:
Programming Language: Python for implementing machine learning models and data
processing.
Data Visualization Tools: Matplotlib and Seaborn for analyzing results and trends.
Packet Capture Tools: Wireshark for monitoring network traffic and analyzing security
threats.
Simulation Software: Tools like Cisco Packet Tracer or NS3 for simulating network
behavior before deployment.
11 2024-25
Dept. of ECE, AMCEC
AD-IoT
Hardware requirements play a significant role in ensuring the system's proper execution and
performance. The essential hardware components for this project are:
• Processor: Intel Core i5/i7 or AMD Ryzen 5/7 with at least 8 cores to handle data
processing efficiently.
• RAM: Minimum 16GB RAM for handling large datasets and running machine learning
models.
• Storage: SSD with at least 512GB for faster data retrieval and storage.
• GPU (Graphics Processing Unit): NVIDIA GTX 1660 or higher for accelerating
• IoT Devices: Smart sensors, actuators, and embedded systems that generate data for
anomaly detection.
• Network Components: Routers and switches for creating a test environment for IoT
communications.
These hardware components ensure that the system runs efficiently without performance
bottlenecks. The inclusion of high-performance computing resources helps improve real-time
anomaly detection accuracy.The combination of these software and hardware tools ensures the
smooth implementation of the IoT anomaly detection system. Proper requirement engineering
helps in mitigating risks associated with system failures and ensures that the project
development process is well-structured and organized.
12 2024-25
Dept. of ECE, AMCEC
AD-IoT
CHAPTER 5
ADVANTAGES AND DISADVANTAGES
Automation of anomaly detection reduces the need for manual monitoring, thus lowering
human error and intervention costs.By identifying and mitigating security breaches in IoT
networks, the system ensures the authenticity and integrity of transmitted
data.Implementing AI-driven anomaly detection reduces the costs associated with
traditional security measures and incident response efforts.The machine learning models
improve over time, learning from new threats and adapting to evolving attack
patterns.The system optimizes bandwidth and processing power by filtering out
malicious activities and reducing unnecessary network traffic.
13 2024-25
Dept. of ECE, AMCEC
AD-IoT
Disadvantages:
Deploying an advanced machine learning-based anomaly detection system requires
significant investment in hardware, software, and infrastructure. The integration of
machine learning models into existing IoT networks can be complex and may require
expertise in AI, cybersecurity, and networking. No system is perfect; sometimes,
legitimate activities may be flagged as anomalies, or real threats may go undetected.
The system’s effectiveness depends on the quality and quantity of training data. Poor or
insufficient data can result in inaccurate predictions.Continuous monitoring of IoT data
may lead to privacy concerns, as sensitive information might be accessed or stored by the
system.Cyber threats are constantly evolving, and the system may require frequent
updates and retraining to keep up with new attack vectors.
14 2024-25
Dept. of ECE, AMCEC
AD-IoT
Project Planning:
The implementation of an IoT anomaly detection system requires a structured plan to ensure the
successful deployment and operation of the project. The key steps involved in the planning
phase include: Requirement Analysis: Identifying system requirements, including hardware,
software, and network infrastructure. Design Phase: Developing the architecture, choosing
appropriate algorithms, and defining data collection methods. Implementation: Deploying the
system in a test environment and integrating it with IoT devices and networks.Testing and
Evaluation: Running simulations and real-world tests to assess the system’s accuracy,
reliability, and performance.Deployment: Rolling out the system across a smart city
infrastructure while monitoring performance in a live setting. Maintenance and Updates:
Regularly updating the system to adapt to new security threats and enhance performance.
Scheduling:
A project timeline ensures that each phase is completed efficiently. Below is a high-level
breakdown of the project schedule:
Week 1-2: Requirement gathering and feasibility study Week 3-4: System design and selection
of machine learning models Week 5-6: Data collection and pre-processing Week 7-8: Model
training and initial testing Week 9-10: Integration with IoT devices and security enhancements
Week 11-12: Final testing, optimization, and deployment Week 13+: Continuous monitoring
and updates
By following a structured planning and scheduling approach, the implementation of the IoT
anomaly detection system can be executed effectively while minimizing risks and challenges.
15 2024-25
Dept. of ECE, AMCEC
AD-IoT
CHAPTER 6
This section discusses the experimental results obtained from evaluating the AD-IoT model using the
UNSW-NB15 dataset. The performance analysis focuses on key evaluation metrics, including
accuracy, precision, recall, and the false positive rate, to assess the effectiveness of the proposed model
The AD-IoT framework was tested for its ability to classify network traffic as either normal or
attack. The dataset was pre-processed, including feature selection and normalization, before
training the machine learning model. The evaluation was conducted using Random Forest (RF)
and ExtraTreesClassifier, chosen for their efficiency in handling large datasets.
The confusion matrix for the Random Forest classifier, presented in Table II (Figure 3), illustrates the
distribution of true positives (TP), false positives (FP), true negatives (TN), and false negatives (FN).
The matrix indicates:
High accuracy in detecting normal traffic (99.27%)
A low false positive rate (FPR) of 0.02%, showing minimal misclassification of benign traffic as
attacks
A detection rate (DR) of 0.82%, representing the percentage of successful attack detections.
16 2024-25
Dept. of ECE, AMCEC
AD-IoT
To further validate the model, precision, recall, and F1-score were analyzed using the formulas shown
in Figure 2:
Metric Value
Precision 0.79%
Recall 0.97%
Accuracy 99.34%
Precision: 0.79% (shows the proportion of correctly classified attack instances)
Recall: 0.97% (high recall indicates that most attack instances were correctly identified)
Accuracy: 99.34%, proving the model's reliability
These results highlight the robustness of the AD-IoT framework in correctly identifying cyber threats
with minimal false positives. However, the precision metric is slightly lower than recall, indicating
room for improvement in attack detection efficiency.
17 2024-25
Dept. of ECE, AMCEC
AD-IoT
The AD-IoT model was implemented using Python with Pandas, NumPy, and scikit-learn libraries.
The experiments were conducted on a Windows OS with an Intel Core i7 processor and 8GB of RAM.
The ExtraTreesClassifier was utilized to optimize feature selection, reducing computational overhead
while maintaining high detection accuracy.The dataset was pre-processed using feature selection
techniques, as shown in Figure 1, to enhance performance:
The AD-IoT model successfully detects cyberattacks with high recall and accuracy, ensuring
efficient anomaly detection in network traffic.
The false positive rate remains low, minimizing unnecessary alerts in real-world
scenarios.Feature selection using ExtraTreesClassifier improved model efficiency, reducing the
dataset size while preserving classification performance.
Future work should explore advanced machine learning techniques to enhance precision and
reduce false positives further.Overall, the experimental results demonstrate that the AD-IoT
model is a promising approach for anomaly detection in IoT environments, providing accurate
and efficient threat detection.
18 2024-25
Dept. of ECE, AMCEC
AD-IoT
CHAPTER 7
7.1 Conclusion
The project successfully implemented an anomaly detection system for IoT cyberattacks in
smart cities using machine learning.The growing inter-connectivity of smart devices has
increased security vulnerabilities, requiring advanced intrusion detection mechanisms.The
proposed system analyzes network behavior to detect cyber threats in real-time.Experimental
results indicate that machine learning algorithms enhance accuracy and efficiency in
identifying security threats compared to traditional methods.The system demonstrated high
detection accuracy, reducing the risk of cyberattacks in smart city infrastructures.Future
advancements in AI-driven security solutions are essential to keep pace with evolving cyber
threats in IoT environments.
7.2 Applications
Smart City Security: Enhances protection for smart grids, traffic management, public
surveillance, and healthcare monitoring systems.
Industrial IoT (IIoT): Identifies network anomalies to prevent cyber threats in
manufacturing and automation processes.
Smart Homes: Strengthens security frameworks for connected devices against
unauthorized access.
Financial and Cloud-based Services: Detects fraudulent activities and unauthorized
data breaches in banking and online platforms.
Real-time Cybersecurity Monitoring: Ensures continuous security assessment and
intrusion detection across various IoT environments.
19 2024-25
Dept. of ECE, AMCEC
AD-IoT
Data Dependency: The accuracy of detection depends on the quality and diversity of
training data.
Computational Requirements: Real-time processing demands high computational
power, making implementation on low-resource IoT devices challenging.
Adapting to Evolving Threats: Cyberattack methods are continuously evolving,
requiring regular updates to the system.
False Positives: Differentiating between benign anomalies and real cyber threats
remains a challenge, potentially leading to incorrect alerts.
7.4 Future Scope of the Project
Advanced neural networks can improve accuracy and adaptability to new attack patterns.
Incorporating a broader range of attack types and IoT devices will enhance the model’s
reliability.Enhancing privacy by training models across multiple devices without centralizing
sensitive data.Utilizing blockchain technology can ensure data integrity and decentralization in
smart city cybersecurityDeveloping lightweight algorithms to allow deployment on resource-
constrained IoT devices.Providing transparency on how the system detects cyber threats,
increasing trust and interpretability for users.
20 2024-25
Dept. of ECE, AMCEC
AD-IoT
REFERENCES
[l] J. Howell. Number of connected iot devices will surge to 125 billion by 2030, ihs markit
says - ihs technology. [Online]. Available: https://technology.ihs.com/596542/, last accessed:
11/07/2018.
[2] E. Borgia, "The internet of things vision: Key features, applications and open issues,"
Computer Communications, vol. 54, pp. 1-31, 2014.
[3] F. Restuccia, S. D'Oro, and T. Melodia, "Securing the internet of things: New perspectives
and research challenges," IEEE Internet of Things Journal, vol. 1, no. 1, pp. 1-14, 2018.
[4] J. A. Stankovic, "Research directions for the internet of things," IEEE Internet of Things
Journal, vol. 1, no. 1, pp. 3-9, 2014.
[7] J. Santos, P. Leroux, T. Wauters, B. Volckaert, and F. D. Turck, "Anomaly detection for
smart city applications over 5g low power wide area networks," in NOMS 2018 - 2018
IEEE/IFIP Network Operations and Management Symposium, 2018, pp. 1-9.
[8] A. Yousefpour, G. Ishigaki, and J. P. Jue, "Fog computing: Towards minimizing delay in
the internet of things," in Edge Computing (EDGE), 2017 IEEE International Conference on.
IEEE, 2017, pp. 17-24.
[9] A. Abeshu and N. Chilarnkurti, "Deep learning: the frontier for dis tributed attack detection
in fog-to-things computing," IEEE Communications Magazine, vol. 56, no. 2, pp.
21 2024-25
Dept. of ECE, AMCEC
AD-IoT
22 2024-25
Dept. of ECE, AMCEC