Rapid: Real-time anomaly-based preventive intrusion detection

Abstract

Intrusion detection systems (IDSs) today face key limitations with respect to detection and prevention of challenging IoT-empowered attacks. We address these limitations by proposing a novel IDS called RAPID, which is based on an online scalable anomaly detection and localization approach. We show that the anomaly detection algorithm is asymptotically optimal under certain conditions, and comprehensively analyze its computational complexity. Considering a real dataset and an IoT testbed we demonstrate the use of RAPID in two different IoT-empowered cyber-attack scenarios, namely high-rate DDoS attacks and low-rate DDoS attacks. The experiment results show the quick and accurate detection and prevention performance of the proposed IDS.