Distributed Intrusion Detection with Change Point Analysis in Resource Constrained Networks

The rapid expansion of the Internet of Things (IoT) has driven the development of innovative solutions across all layers of society. The increasing interconnection of IoT devices has also expanded the attack surface. In this context, Intrusion Detection Systems (IDS) play a crucial role in detecting suspicious activity. Both host and network-based metrics can indicate intrusions, but most research doesn’t tackle the use of host-based metrics for detecting network intrusion. To address this gap, the primary objective of this research is to develop a distributed intrusion detection system with a change point analysis using in-device operational metrics. This system uses the energy consumption of the own device as a key metric for change point analysis, creating a decentralized IDS framework to reduce communication overhead present in centralized approaches. We evaluate the proposed system by implementing a Denial of Service (DoS) Flooding attack scenario in a simulated IoT network. All scenarios present an individual mote detection rate above 92%.