Detecting Unusual Repetitive Patterns of Behavior Indicative of a Loop-Based Attack in IoT

Given the high risk of Internet of Things (IoT) device compromise, it is crucial to discuss the attack detection aspect. However, due to the physical limitations of IoT, such as battery life and sensing and processing power, the widely used detection techniques, such as signature-based or anomaly-based detection, are quite ineffective. This research extracted loop-based cases from the transmission session dataset of "CTU-IoT-Malware-Capture-7-1" ("Linux, Mirai") and implemented a loop-based detection machine learning approach. The research employed nine machine learning models to illustrate how the loop patterns of the datasets can facilitate detection. The results of this study indicate that the XGBoost model achieves the best performance in terms of "Accuracy: 8.85%", "Precision: 96.57% (Class)", "Recall: 96.72% (Class 1)", and "F1-Score: 6.24%". The XGBoost model demonstrated exceptional performance across all metrics, indicating its capability in handling large IoT datasets effectively. It provides not only high accuracy but also strong generalization, which is crucial for detecting intricate and diverse patterns of malicious behavior in IoT networks. Its precision and recall performance further highlight its robustness in identifying both attack and normal activity, reducing the chances of false positives and negatives, making it a superior choice for real-time IoT threat detection.