An IoT Architecture Leveraging Digital Twins: Compromised Node Detection Scenario

TL;DR

This paper proposes a fog-based IoT architecture using digital twins to detect compromised nodes exhibiting malicious behaviors, achieving high accuracy with minimal overhead through deep learning methods.

Contribution

It introduces a novel fog-based digital twin framework for IoT security, focusing on energy-efficient monitoring and misbehavior detection in complex IoT environments.

Findings

High detection accuracy achieved with deep learning models.

Negligible system overhead demonstrated in evaluations.

Effective identification of malicious IoT nodes in diverse scenarios.

Abstract

Modern IoT (Internet of Things) environments with thousands of low-end and diverse IoT nodes with complex interactions among them and often deployed in remote and/or wild locations present some unique challenges that make traditional node compromise detection services less effective. This paper presents the design, implementation and evaluation of a fog-based architecture that utilizes the concept of a digital-twin to detect compromised IoT nodes exhibiting malicious behaviors by either producing erroneous data and/or being used to launch network intrusion attacks to hijack other nodes eventually causing service disruption. By defining a digital twin of an IoT infrastructure at a fog server, the architecture is focused on monitoring relevant information to save energy and storage space. The paper presents a prototype implementation for the architecture utilizing malicious behavior datasets to perform misbehaving node classification. An extensive accuracy and system performance evaluation was conducted based on this prototype. Results show good accuracy and negligible overhead especially when employing deep learning techniques such as MLP (multilayer perceptron).