A Guardian Node Framework for Slow DoS Detection in IoT Networks

The rapid expansion of the Internet of Things (IoT) has led to some innovative deployments in a raft of diverse domains from medical and industrial to vehicular, with many ensuing applications being time critical. However, the race to mass produce cheap, low-powered IoT nodes has exposed them to serious web based security threats such as Slow DoS (Denial of Service) attacks, due to their limited on-board processing capability. Malicious Slow DoS activity is very hard to reliably detect due to its propensity to resemble genuine slow nodes, so it can easily evade intrusion detection systems and firewalls. Current Slow DoS detection approaches including computationally intensive machine learning (ML) methods require large datasets and full packet capture (FPC), and deep packet inspection (DPI) which inherently incurs high processing overheads, rendering them impractical for resource-constrained IoT environments. Compounding the problem is the absence of comparable datasets that embrace multi-variant Slow DoS attacks and IoT node types, including crucially, legitimate slow nodes. This was the motivation to investigate Slow DoS detection mechanisms tailored, but not solely restricted, to resource-scarce IoT networks. This thesis presents a novel resource efficient Guardian Node (GN) Slow DoS detection framework that accurately discriminates in real-time, genuine slow nodes with high latency from all Slow DoS attack variants under a gamut of IoT traffic profiles. The framework uniquely exploits the network attributes of packet length and delta time in a robust detection solution. A critical results evaluation cogently demonstrates comparable performance with existing ML classifiers, especially in highly stochastic conditions where slow and malicious Slow DoS nodes appear very alike. Compared to FPC, the GN framework achieves significant resource savings with overheads reduced by up to 96%. Crucially in an IoT context, further resource savings are feasible using only a single attribute for multi-variant Slow DoS detection, with the corollary being a commensurate trade-off in accuracy. The new framework represents a notable contribution towards securing resource-constrained IoT networks against malicious Slow DoS style attacks, whilst reliably and uniquely classifying genuine slow nodes. By flexibly delivering low-overhead, real-time detection without relying on FPC, it offers an innately scalable and autonomous IoT security solution with the potential to be developed into a robust adaptive defence technology across global IoT networks.