Efficient IDS for IoT Networks Using Host-Based Data Aggregation and Multi-Entropy Analysis

IoT devices have limited computational resources, posing challenges to implementing adequate security measures. As a result, numerous attacks targeting vulnerabilities in IoT devices have been observed. Against this backdrop, research on Intrusion Detection Systems (IDSs) leveraging machine learning in IoT environments has been actively conducted. However, packet-based and flow-based IDSs proposed in existing studies are vulnerable to attacks such as DoS and DDoS, which involve numerous packet or flow combination patterns. These methods also face challenges related to computational resource burdens caused by the increased volume of input data. This study proposes a lightweight IDS with the host-based approach, representing communication behaviors with multiple entropies. The host-based approach aggregates features from different communications sent by the same host, enabling a reduction in input data. Additionally, the method captures host-level communication behaviors by leveraging multiple entropies, focusing on characteristic patterns of IoT devices, such as periodic communication with specific servers during normal operation. This enables the reduction of computational resources during detection processing while maintaining detection accuracy, even when using fewer features and lightweight machine learning algorithms. The evaluation results demonstrate that the proposed method achieves a maximum reduction of 99.7% (2916 milliseconds) in processing time and 86.4% (633 MiB) in memory usage while maintaining an intrusion detection accuracy of 99.97%, proving its feasibility in constrained environments comparable to IoT gateways.