Decision Tree Based Interference Recognition for Fog Enabled IOT Architecture

: The cyber-attacks nowadays are becoming more and more erudite causing challenges in distinguishing them and confining. These attacks affect the sensitized information’s of the network by penetrating into the network and behaving normally. The paper devises a system for such interference recognition in the internet of things architecture that is aided by the FOG. The proposed system is a combination of variety of classifiers that are founded on the decision tree as well as the rule centered conceptions. The system put forth involves the JRip and the REP tree algorithm to utilize the features of the data set as input and distinguishes between the benign and the malicious traffic in the network and includes an decision forest that is improved with the penalizing attributes of the previous trees in the final stage to classify the traffic in the network utilizing the initial data set as well as the outputs of the classifiers that were engaged in the former stages. The proffered system was examined using the dataset such BOT-Internet of things and the CICIDS2017 to evince its competence in terms of rate of false alarm, detection, and accuracy. The attained results proved that the performance of the proposed system was better compared to the exiting methodologies to recognize the interference.


Introduction
The internet of things that has enabled the tangible things to communicate over internet, has become more and more vulnerable as it carries numerous of information's that are sensitized. Recently cyber-attacks that are highly erudite aims in attacking exclusively the systems that hold or compute information's that are very sensitive. Important infrastructures of the nations are the key targets of cyber-attacks, since vital information or services rely on their systems causing major problem for the both government administrations as well as the nation's security. Bouts against these vital structures include penetrations into their network and the deployment of malicious software or programs that can expose sensitive data or alter the actions of specific physical equipment. To counter the progress in the interference, researchers and business professionals are working together to build new technologies and processes that can protect their technologies. In addition to other preventive protection measures, such as regulation on accessing and verification, the attack distinguisher system (ADS) are used as a second line of security. ADS is founded on particular rules or patterns of the system's usual behavior to distinguish the normal from the harmful attacks. Based on the distinguishing procedures followed the ADS are categorized as rule centered, hybrid and the ill use detector. The ADS are so far proffered under various taxonomies, and are capable of functioning in online by providing a constant monitoring in real time as well as in offline by operating over the data that are already gathered and reserved over a particular duration. The industrial regulation organization presently has devised ADS with new taxonomies that could be categorized as three different types, they are the methods based on the protocol examination, control process analysis and traffic mining.
The information that were collected from the previous attack were used as a fundamental sources to develop the identification system, better the identification process less would be the damages caused by the attacks in the network. But the network faces certain penalties due to the countermeasures taken than the attack itself. So to elude the consequences caused by the remedial measures and improve the performance of the attack detection system by finding even the attacks that are more similar to the network activities the proposed attack distinguishing system is devise, the ADS is developed is incorporated in the fog enabled internet of things architecture and validated using the BOT-internet of things dataset.
The proposed-ADS with the aim of distinguishing the common and the uncommon attacks with the higher rate of detection and less rate of false alarms is encompassed with the related works in section 2, proposed work in section 3, results analysis in section 4 and the conclusion in section 5. ISSN: 2582-4104 Ahmim, et al [7] proposes the "A novel hierarchical intrusion detection system based on decision tree and rules-based models." Raj, Jennifer S. et al [8], puts forth the A Novel Classification via Clustering Method for Anomaly Based Network Intrusion Detection System Wang. et al [9] elaborates the designing of "A new approach to intrusion detection using Artificial Neural Networks and fuzzy clustering." Govindarajan, et al [10] proposes the "Intrusion detection using neural based hybrid classification methods." Chung. et al [11] puts forth the development of "A hybrid network intrusion detection system using simplified swarm optimization (SSO)." Kim et al [12] proposes "A novel hybrid intrusion detection method integrating anomaly detection with misuse detection." Kevric, et al [13] describes the designing of "An effective combining classifier approach using tree algorithms for network intrusion detection." Adnan et al [14] presents the "Forest PA: Constructing a decision forest by penalizing attributes used in previous trees." This is used as the third stage classifier in the proposed model to distinguish both the attack traffic and the specific type of attack Frank. et al [15] is the "Reduced-error pruning with significance Frank tests. Used in the parallel classification stage to distinguish between the normal network traffic and the attacked" Cohen, et al [16] puts forth the "Fast effective rule induction." This is used as second classifier employed in the parallel stage to distinguish between the specific types of the attacks. Koroniotis et al [17] develops a "the realistic botnet dataset in the internet of things for network forensic analytics." Folino et al [18] puts forth the "Evolving meta-ensemble of classifiers for handling incomplete and unbalanced datasets in the cyber security domain."

Proposed Frame Work
The inadequacy of the data set used in the machine learning is the major cause for the degradation in the performance of the classification algorithms. This was primarily due to two main reasons, one is the simple accuracy used as the key objective in the classification and the other one is due to the improper distribution of classes, leading to misjudging and inappropriate classification. Distinguishing the malicious as normal and the normal as the attacker.
To bring down the rate of false alarms and enhance the rate of identification as well as accuracy in distinguishing the network activities the paper devises an ADS constructed with three various classifiers that are founded on the decision tree and the rule centered conceptions to form a hierarchical architecture to recognize and distinguish the interferences. The block diagram below shows the proposed frame of ADS.  The proposed ADS employs two classifier, one binary and one multiclass in parallel and engages another classifier in the final stage to reduce the consequences of the inadequacy in the data in the classification process. The hierarchical architecture put forth scopes to distinguish correctly among the normal and the malicious and to in return reduce the false alarms and maximize the rate of identification. The in parallel stage one classifier engaged distinguishes between the malicious and the normal traffic and the next one distinguishes the categories of bouts, using the various dataset features as input. The third classifier takes in the initial data set and the outputs of the parallel stage classifier as input and distinguishes the normal from the malicious as well the specific category of attack form the each row of dataset that is provided as input. The three classifiers used are reduced error pruning-REP tree [15], JRip [16], and the DF with penalizing attributes [14], the classifiers accurately classifies the datasets by framing rules according to the values of the features.

Figure.2 ADS in FOG Enabled IOT
The ADS is incorporated into the multi-tier FOG enabled IOT, and placed in the fog computing layer. The ADS distinguishes the malware from the normal by undergoing the training and the testing, the parallel stage classifiers are trained initially and the final stage classifiers are trained using the output of the parallel stage classifiers. In the parallel stage one distinguisher is trained with the attacks and the normal traffic and the other is trained using the normal and the specific category of attacks, this enables to identify both common and the uncommon attacks that affect the network. So we get two frame of data set, this is used in training the third classifier in the final stage, after the training of the each classifier is performed using the normalized features of the dataset. The preprocessing stages convert the symbolic values to numeric values and scales the numeric valued attributes in a greater numeric ranges dominating those in the smaller numeric ranges. The system proffered also enables to elude the numeric difficulties during the estimations. The

Result Analysis
In this portion, the data set used in conjunction with the data pre-processing method is discussed in detail. We also give measurements of the results used in our experiments. In addition, we're showing our concept structure. Finally, a comparative analysis is given between our model and that of different classifiers. The tests are carried out on a Windows 10, 64-bit PC with 8 GB of RAM and Intel(R) I5 2.7 GHz CPU. The proposed system is tested over the two data sets (i) CICIDS 2017 and the (ii) Bot-IoT dataset since both the datasets fulfills the eleven important features of a legitimate ADS dataset, namely Anonymity, Full Network Setup , Complete Collection, , Attack Diversity, Supported Protocols, Full Interaction, Set of Functions, , Complete Traffic Heterogeneity, Metadata and Labelling.
The Bot-IoT dataset encompasses, more than72, 000,000.001 records created on the 74 files with every row holding 46 features and the CICICDS contains 2, 30,743.01 rows segregated into 8 files and with every row holding 46 features. Rows with the identical feature are sorted out and eliminated after which the subsets that unique in each row are used for training, the rows are selected randomly after performing the process of suppression.
The table1 below s the total attacks of the data set used and the number of data used in training and testing. The performance of the system is measured on the basis of accuracy, false alarm rate and the detection rate. The results obtained shows the improved detection rate achieved by the proposed method, the figure .3 depicts the detection rate of the proposed ADS.
The Table.2 below provides the comparison of results obtained on the proposed method over the existing methods.

Conclusion
The interference recognize system or the ADS put forth in the paper is the combination of three various classifiers with two employed in parallel and one in the final stage where the output of the two parallel classifiers are fed. The proposed model was validated using two data set and was found outstanding compared to the other similar existing systems that were framed in this regard.