The document presents 'iot-shield,' a novel approach for detecting DDoS attacks on IoT devices, which are increasingly vulnerable due to their limited resources. It combines machine learning and process mining techniques to predict and mitigate such attacks, showcasing high accuracy in various algorithm evaluations. The authors aim to develop a real-time detection and mitigation platform for IoT and IIoT devices in the future.

1. Title:
IoT-Shield: A Novel DDoS Detection Approach for IoT-Based Devices
Authors with Affiliation:
Ghazaleh Shirvani , Department of Computer Engineering Iran University of Science and Technology
Saeid Ghasemshirazi , Department of Industrial Engineering Iran University of Science and Technology
Behzad Beigzadeh , Department of Electrical and Computer Engineering Tarbiat Modares University
Presenter :Ghazaleh Shirvani
11th Smart Grid Conference (SGC 2021)
1

2. Introduction:
2
An IoT device is simply an electronic device that is connected to the Internet.
There are several basic properties that qualify a device as an “IoT” device:
▪ A physical device/object
▪ Contains controller(s), sensor(s), and or actuator(s)
▪ Connects to the Internet
Denial of Service Attack: an attack on a computer or network that prevents legitimate use of its resources
DDoS Attacks Increasing in Size, Frequency & Complexity.

3. Background:
3
Data Mining vs. Process Mining
Process Mining Phases:
• Discovery
• Monitoring
• Optimization

4. PROBLEM STATEMENT:
4
❖ Almost every piece of technology we buy is “Connected” to the internet.
❖ IoT devices appear to be more vulnerable to security attacks
❖ Security management is difficult because of IoT devices characterized by limited resources.

5. Contribution:
5
❖ We are proposed a combination model of machine learning & process mining approach
named IoT-Shield.
❖ IoT-Shield can predict DDoS attacks and misbehavior on IoT Devices.

6. Proposed method:
6

7. Detailed view of process mining block
7

8. Dataset:
8
❖ We used the NSL-KDD Dataset
❖ Improvements to the KDD'99 dataset
Type Number of features
Categorical 4
Binary 6
Discrete 23
Continuous 10

9. Results:
9
Algorithm
Evaluation Metrics
Accuracy F1-Score
Training
Time
XGBoost 99.58% 0.99 10s
ADABoost 98.99% 0.98 13s
Decision Tree 99.38% 0.97 2s
KNN 99.61% 0.99 21s
Random
Forest
94.89% 0.94 4s
Naïve Bayes 53.04% 0.34 <1s
MLP 96.11% 0.96 15s
Experimental setup:
❖ A two-core Xeon processor with 2.2 GHz
❖ 33 GB HDD
❖ 13 GB RAM

10. CONCLUSION AND FUTURE WORK
10
✓ Security threats are a big issue with IoT devices due to limited resources (CPU, battery, and
memory).
✓ We are inspired to create a Real-Time DDoS detection with multiple-class classification and
mitigation platform for IoT and IIoT devices in the future.
75
80
85
90
95
100
Data Mining
Process Mining
Proposed Method
Performance Comparison
Without Feedback With Feedback

11. Thank You for
Attention
11