Intelligent Recognition of TCP Intrusions for Embedded Micro-controllers

Abstract

IoT end-user devices are attractive and sometime easy targets for attackers, because they are often vulnerable in different aspects. Cyberattacks, started from those devices, can easily disrupt the availability of services offered by major internet companies. People that commonly get access to them across the world may experience abrupt interruption of services they use. In that context, this paper describes an embedded prototype to classify intrusions, affecting TCP packets. The proposed solution adopts an Artificial Neural Network (ANN) executed on resource-constrained and low-cost embedded micro controllers. The prototype operates without the need of remote intelligence assist. The adoption of an on-the-edge artificial intelligence architecture brings advantages such as responsiveness, promptness and low power consumption. The embedded intelligence is trained by using the well-known KDD Cup 1999 dataset, properly balanced on 5 types of labelled intrusions patterns. A pre-trained ANN classifies features extracted from TCP packets. The results achieved in this paper refer to the application running on the low cost widely available Nucleo STM32 micro controller boards from STMicroelectronics, featuring a F3 chip running at 72 MHz and a F4 chip running at 84 MHz with small embedded RAM and Flash memory.