Edge-Detect: Edge-centric Network Intrusion Detection using Deep Neural Network

TL;DR

This paper introduces 'Edge-Detect', a lightweight, accurate deep learning model designed for intrusion detection on resource-constrained edge nodes, effectively identifying DDoS attacks with high accuracy and efficiency.

Contribution

Developed a novel edge-friendly deep learning model using RNNs that maintains high accuracy while reducing resource usage and model size for IoT security.

Findings

Achieves 99% detection accuracy on UNSW2015 dataset

Model size is nearly three times smaller than existing models

Requires significantly less CPU and memory during testing

Abstract

Edge nodes are crucial for detection against multitudes of cyber attacks on Internet-of-Things endpoints and is set to become part of a multi-billion industry. The resource constraints in this novel network infrastructure tier constricts the deployment of existing Network Intrusion Detection System with Deep Learning models (DLM). We address this issue by developing a novel light, fast and accurate 'Edge-Detect' model, which detects Distributed Denial of Service attack on edge nodes using DLM techniques. Our model can work within resource restrictions i.e. low power, memory and processing capabilities, to produce accurate results at a meaningful pace. It is built by creating layers of Long Short-Term Memory or Gated Recurrent Unit based cells, which are known for their excellent representation of sequential data. We designed a practical data science pipeline with Recurring Neural Network to learn from the network packet behavior in order to identify whether it is normal or attack-oriented. The model evaluation is from deployment on actual edge node represented by Raspberry Pi using current cybersecurity dataset (UNSW2015). Our results demonstrate that in comparison to conventional DLM techniques, our model maintains a high testing accuracy of 99% even with lower resource utilization in terms of cpu and memory. In addition, it is nearly 3 times smaller in size than the state-of-art model and yet requires a much lower testing time.