| ABSTRACT |
The growth of Internet of Things (IoT) devices in Small and Medium Enterprise (SME) has resulted in a security gap that is critical because traditional Network Intrusion Detection Systems (NIDS) are frequently computationally infeasible in the edge case. The project is a development of Lightweight Hybrid NIDS to be used in resource-constrained product platforms (like Raspberry Pi and low-end server PCs) with optimized memory utilization. To address the trade-off between the speed and accuracy of the system, the system uses a Dual-Layered Detection architecture. The Layer 1 employs the deterministic signature engine to block the known web security threats (SQL Injection, XSS, DoS) at zero latency. The Layer 2 combines a dual engine AI-based service- Supervised Learning (Random Forest) of familiar patterns and Unsupervised Learning (Isolation Forest) of zero-day abnormalities to cover all the threats. The methodology uses a custom Python pipeline that uses Scapy to capture and preprocess stateful flow stateful flows in real-time with 35 statistical features in accordance with the CICIDS-2017 dataset. The major contribution of this work is the addition of Explainable AI (XAI) that provides a way to decode the anomaly scores to overcome the so-called Black Box problem of security associated with ML. In addition, the system progresses to Active Defence, where the system is able to propagate blocklists to victim hosts in real-time using a distributed firewall synchronization protocol. As the experimental findings show, the system is effective to prevent the multi-vector attacks at low resource overheads. Also, automated threat intelligence and DBSCAN based alert clustering reduce alert fatigue, making the system a hardy and costeffective defence solution to the latest edge networks.
|
