ALMANET: A hybrid online learning IDS for real-time IoT security

Abstract

Although some modern Intrusion Detection Systems (IDSs) for Internet of Things (IoT) have explored online machine learning (ML) approaches to build these IDSs, most IoT-based IDSs are designed using offline ML techniques. IDSs built with offline ML approaches cannot adapt to rapidly changing IoT network conditions. They need continuous retraining and require a lot of computational power. To address these limitations, we propose ALMANET (ALMA+NET), a hybrid intrusion detection approach combining Approximate Large Margin Algorithm (ALMA) with Stochastic Weight Averaging (SWA) and an online neural network (NET). ALMANET leverages the power of online learning, which updates models incrementally and allows real-time adaptation to evolving network traffic, making it suitable for IoT environments. We validated ALMANET on four benchmark datasets, namely, NF BoT IoT, NF ToN IoT, NF UNSW, and NF CSE 2018 datasets. We demonstrated the proposed technique’s performance in terms of accuracy, recall, ROCAUC, and robustness against adversarial attacks. We compared the performance of ALMANET against RF, SVM, LR, and ALMA. ALMANET records up to 98.58% ROCAUC and demonstrates high throughput, low false positive rates, and efficient memory usage of 14.64 KB across all datasets, making it feasible for deployment on edge devices.