On the Impact of Blackhole-Attack Variations on ML-based Intrusion Detection Systems in IoT.

Intrusion detection systems (IDS) are crucial components in a defense strategy for IoT networks, as such networks have applicability in safety-critical environments such as healthcare, manufacturing, and smart cities, to name but a few. A promising approach is to train IDS models using machine learning (ML) with data from previous attacks. Unfortunately, the models are only as good as the data provided in the training, and often access to realistic attack data is limited. In this paper we focus on Blackhole attacks in low-power and lossy IoT networks. Specifically, we study the impact of Blackhole attack variations on a ML-based IDS. We implemented the variation strategies in the Cooja network simulator, with the objective to create new data sets and to quantity the impact of an attack variation on the network and IDS model performance. Our initial results show that variations of the Blackhole attack have a negative impact on the performance of the IDS, and thus, paves the way forward for further research on how attack variations and corresponding data set complexity can improve the performance of an IDS.