Sequential Intrusion Detection System for Zero-Trust Cyber Defense of Iot/Iiot Networks

Relevance. The Internet of Things (IoT) and the Industrial Internet of Things (IIoT) and their widespread application make them attractive targets for cyber attacks. Traditional cybersecurity methods such as firewalls and antivirus software are not always effective in protecting IoT/IIoT networks due to their heterogeneity and large number of connected devices. The zero-trust principle can be more effective in protecting IoT/IIoT networks. This principle assumes on no inherent trustworthiness of any user, device, or traffic, requiring authorization and verification before accessing any network resource. This article presents a zero-trust-based intrusion detection system (IDS) that uses machine learning to secure IoT/IIoT networks. The aim of this article is to develop a two-component IDS for detecting and classifying cyber-attacks. The study utilizes machine learning techniques, such as Decision Tree, Random Forest, and XGBoost, on the Edge-IIoTset dataset. The following results were obtained. The IDS structure proposed here employs a sequential approach that consists of two AI modules. The first module detects attacks using a simpler model like Decision Tree. The second module uses more complex models like Random Forest or XGBoost to classify attack types. Experimental evaluation on the Edge-IIoTset dataset demonstrates the system's effectiveness, with an overall accuracy of 95% and significantly reduced response time compared to single complex model systems. Conclusion. The proposed design for an Intrusion Detection System (IDS) achieves high accuracy in detecting attacks while maintaining optimal performance and minimizing additional computational costs. This is especially crucial for real-time network monitoring in IoT/IIoT environments. Further research can focus on the practical implementation of the proposed IDS structure for physical realization in securing IoT/IIoT networks based on the zero-trust principle.