OPTIMIST: Lightweight and Transparent IDS With Optimum Placement Strategy to Mitigate Mixed-Rate DDoS Attacks in IoT Networks

Distributed Denial-of-Service (DDoS) attacks are widespread for Internet of Things (IoT) systems that aim to disrupt the availability of a system completely (high-rate DDoS) or partially (low-rate DDoS). Design and placement of intrusion detection systems (IDSs) for DDoS attacks on IoT systems are challenging due to the low power and lossy nature of networks. Existing IDSs are designed to handle either high-rate or low-rate DDoS but cannot handle both with good accuracy. Existing IDS placement techniques are mostly nontransparent, making malicious nodes aware of the presence of IDS nodes. Most of the IDS placement strategies are nonoptimal, making them energy inefficient. Accordingly, this work proposes a transparent, optimally placed, distributed IDS solution, namely, OPTIMIST, which can handle both high-rate and low-rate DDoS attacks with good accuracy. The placement problem is formulated as the weighted minimum vertex cover problem of aK-uniform hypergraph and solved with an approximation algorithm. The IDS module is based on a long short-term memory (LSTM) model where a novel offline training method for LSTM is proposed using Wasserstein GAN-generated artificial flows. Extensive experimentation on simulation and testbed shows that the OPTIMIST can best achieve the balance between DDoS detection and energy overhead.