A Two-Tier Anomaly-based Intrusion Detection Approach for IoT-Enabled Smart Cities

The Internet of Things (IoT), like other network infrastructures, requires Intrusion Detection Systems (IDSs) to be protected against attacks. When deploying an IDS in IoT-based smart city environments, the balance between latency and node capacity must be considered, which justifies a distributed IDS with specific classifiers based on the location of the system processing nodes. This paper proposes a two-level classification technique for collaborative anomaly-based IDSs deployed on fog and edge nodes. A Gradient Boosting Classifier (GBC) is used in the lower layer classifier at the edge, while a Convolutional Neural Network (CNN) is used in the upper layer classifier at the fog. Experimentation has demonstrated that the suggested IDS architecture outperforms previous solutions. For instance, in some scenarios, when comparing our proposal with Random Forest, the former obtained an accuracy equal to 99.1%, while the latter obtained 95.3%. Furthermore, our proposal can better select the most important network traffic features, reducing 76% of the data to be analyzed and improving privacy.