Insider Threat Detection in Lorawan-Based Iot Systems Using Isolation Forest

Abstract

The Internet of Things (IoT) networks, especially LoRaWAN networks, has allowed for the transmission of low power and long range for many smart applications. But the growing number of connected devices creates a huge security problem, as it includes threats from insiders, which are either compromised or malicious and act in an inappropriate manner. Insider attacks are hard to detect because of the access they have and their ability to present themselves as a normal network activity. In this paper, an intelligent insider threat detection framework for LoRaWAN-based IoT systems is proposed based on Isolation Forest (IF) algorithm, an unsupervised machine learning model for anomaly detection. The proposed approach aims at identifying deviations based on the analysis of sensor measurements, communication pattern, and the characteristics of the device at the node level when it behaves maliciously. The framework continuously observes the traffic patterns of IoT, identifies the abnormal ones without any prerequisites of attack signatures or labeled datasets. The experimental results show that the proposed model can effectively detect insider anomalies and lower the complexity of the computation and increase the detection efficiency. This solution increases the security, scalability, and reliability of LoRaWAN IoT networks against the ever-changing insider threat.