34
A. M. Said et al.
algorithm outputs an optimal hyper-lane which categorizes new examples. In
two dimensional space this hyper-lane is a line dividing a plane in two parts
where each class lays in either side. It uses a mathematical function named the
kernel to reformulate data. After these transformations, it defines an optimal
borderline between the labels. Mainly, it does some extremely complex data
transformations to find a solution how to separate the data based on the labels
or outputs defined. The concept of SVM learning approach is based on the
definition of the optimal separating hyper-plane (Fig. 5) [21] which maximizes
the margin of the training data [17,18]. The choice of this machine learning
algorithm refers to one important point, it works well with the structured data
as tables of values compared to other algorithms.
Fig. 5. SVM classification.
We implement the IDS in the smart IoT gateway shown in Fig. 1.
5 IDS Solution and Results
To investigate the effectiveness of our proposed IDS, we implement three scenarios of rank attack using Contiki-Cooja simulator [19]. We assess how our
IDS module can detect them. We present next the simulation setup, evaluation
metrics, and we discuss the results achieved.
5.1 Simulation Setup
Our simulation scenario consists of a total 11 motes spread across an area of
200 × 200 m (Simulation of area of hospital where different sensors are placed in
every area to control the patient rooms). The topology is shown in Fig. 6 using
four scenarios. There is one sink (mote ID:0 with green dot) and 10 senders
(yellow motes from ID:1 to ID:10). Every mote sends packet to the sink at the
rate of 1 packet every 1 min. We implement the centralized anomaly based IDS
at the root mote or the sink and we collect and analyze network data as shown in
A. M. Said et al.
algorithm outputs an optimal hyper-lane which categorizes new examples. In
two dimensional space this hyper-lane is a line dividing a plane in two parts
where each class lays in either side. It uses a mathematical function named the
kernel to reformulate data. After these transformations, it defines an optimal
borderline between the labels. Mainly, it does some extremely complex data
transformations to find a solution how to separate the data based on the labels
or outputs defined. The concept of SVM learning approach is based on the
definition of the optimal separating hyper-plane (Fig. 5) [21] which maximizes
the margin of the training data [17,18]. The choice of this machine learning
algorithm refers to one important point, it works well with the structured data
as tables of values compared to other algorithms.
Fig. 5. SVM classification.
We implement the IDS in the smart IoT gateway shown in Fig. 1.
5 IDS Solution and Results
To investigate the effectiveness of our proposed IDS, we implement three scenarios of rank attack using Contiki-Cooja simulator [19]. We assess how our
IDS module can detect them. We present next the simulation setup, evaluation
metrics, and we discuss the results achieved.
5.1 Simulation Setup
Our simulation scenario consists of a total 11 motes spread across an area of
200 × 200 m (Simulation of area of hospital where different sensors are placed in
every area to control the patient rooms). The topology is shown in Fig. 6 using
four scenarios. There is one sink (mote ID:0 with green dot) and 10 senders
(yellow motes from ID:1 to ID:10). Every mote sends packet to the sink at the
rate of 1 packet every 1 min. We implement the centralized anomaly based IDS
at the root mote or the sink and we collect and analyze network data as shown in