IoT Equipment Monitoring System Based on C5.0 Decision Tree and Time-Series Analysis

• Published in: IEEE access Vol. 10; pp. 36637 - 36648
• Main Authors: Zhu, Biaokai, Hou, Xinyi, Liu, Sanman, Ma, Wanli, Dong, Meiya, Wen, Haibin, Wei, Qing, Du, Sixuan, Zhang, Yufeng
• Format: Journal Article
• Language: English
• Published: Piscataway IEEE 2022; The Institute of Electrical and Electronics Engineers, Inc. (IEEE)
• Subjects: C5.0 decision tree; Data analysis; Data models; Decision analysis; Decision trees; Deep learning; Internet of Things; IoT device identification; Machine learning; Monitoring; Monitoring systems; Real-time systems; Security; Time series; Time series analysis; Time-series model; traffic feature extraction; Traffic models
• ISSN: 2169-3536; 2169-3536
• DOI: 10.1109/ACCESS.2021.3054044

Abnormal traffic and vulnerability attack monitoring play an important role in today's Internet of Things (IoT) applications. The existing solutions are usually based on machine learning for traffic, and its disadvantage is that a large number of manual operations are needed in the classification process, and the adaptability is poor. Moreover, for unknown attacks, the system cannot make a relative response in time. In this work, we design a monitoring system of IoT based on C5.0 decision tree and time-series analysis. The system transforms time-series into GAF graph, and uses CNN-LSTM combination model to monitor the traffic. The time-series model based on deep learning can also improve the inefficiency and manual intervention caused by data analysis. At the same time, the system introduces LSTM technology, which can solve a series of problems that may be caused during long sequence training. We select KDD Cup 99 data set for simulation experiments and comparison with traditional traffic monitoring methods. The results show that the average error rate of abnormal traffic attack types is 3.22%. The evaluations show that the system can effectively monitor unknown attacks with 96% accuracy. We further use whitelist matching technology to identify IoT device models. After comparison of experiments, it is proved that this method has its superiority in the monitoring of IoT devices.