
Abstract Although the Internet of Things (IoT) is a rapidly developing technology, it also brings a number of security challenges, such as IoT attacks. Currently, research on IoT anomaly detection in Software-Defined Networking (SDN) relies only on the control plane. In this study, we aim to detect IoT anomalies by covering the advantages of the control and data plane. First, we collected real-time network telemetry data from the data plane based on the capabilities of the P4. Then, using this telemetry data, we built different anomaly detection models and compared their performance. Among them, the one-Dimensional Convolutional Neural Network (1D CNN) model classified our data best and showed the highest performance, so we proposed this model for IoT anomaly detection on the control plane. To our knowledge, our approach is the first solution that integrates the control plane and data plane for IoT anomaly detection. Finally, when evaluating the performance of our proposed 1D CNN model, the accuracy, F1 score, and Matthews correlation coefficient (MCC) are the same or better than existing studies.
sdn, p4, 1d-cnn, Electrical engineering. Electronics. Nuclear engineering, iot security, in-band network telemetry(int), TK1-9971
sdn, p4, 1d-cnn, Electrical engineering. Electronics. Nuclear engineering, iot security, in-band network telemetry(int), TK1-9971
| selected citations These citations are derived from selected sources. This is an alternative to the "Influence" indicator, which also reflects the overall/total impact of an article in the research community at large, based on the underlying citation network (diachronically). | 2 | |
| popularity This indicator reflects the "current" impact/attention (the "hype") of an article in the research community at large, based on the underlying citation network. | Average | |
| influence This indicator reflects the overall/total impact of an article in the research community at large, based on the underlying citation network (diachronically). | Average | |
| impulse This indicator reflects the initial momentum of an article directly after its publication, based on the underlying citation network. | Average |
