AI-Assisted Intrusion Detection and Forensic Analysis Framework for IoT Ecosystems

Abstract

The Internet of Things (IoT) has revolutionized the way the world works, offering unprecedented levels of connectivity and automation in a variety of industries. This explosive growth has also brought with it significant vulnerabilities and cyber security issues, which are not effectively mitigated by traditional security solutions. Conventional signature-based and rule-based IDS are not able to handle the scale, heterogeneity and dynamism of IoT networks. At the same time, legacy digital forensic tools are not designed to provide the necessary automation and contextual intelligence to track increasingly complex cyber-attacks in a distributed IoT environment. This paper suggests a blended artificial intelligence-based framework combining the capabilities of Deep Learning (DL) and Machine Learning (ML) algorithms to detect anomalies in real time, perform forensic trace analysis, and provide a threat intelligence solution in IoT ecosystems. The framework uses three benchmark IoT security datasets: BoT-IoT, TON_IoT, and CICIDS2021 to identify temporal intrusions by employing Long Short-Term Memory (LSTM) networks and to correlate forensic evidence with Random Forest classifiers. Experimental results show that the hybrid framework yields a detection accuracy of 95.04%, the false positive rate is 0.40% for DDoS attacks and the forensic attribution accuracy is up to 96.8% for attacks in all categories, while the mean time to attribution is less than 3.5 seconds for all attack categories. The framework can be scaled to support a million traffic flows and reduce the inference latency to less than 420 ms, which shows its ability to be deployed in the real IoT environment.