CEPIDS: Um IDS baseado no Processamento de Eventos Complexos para Internet de Coisas.

Abstract

With the Internet of Things (IoT) expansion, an increase can be observed in the development of services and applications which use large numbers of sensors and context-aware devices incorporated into smart environments. Those devices continuously produce large amounts of data raising the need for faster and more precise defense mechanisms against malicious traffic to ensure that network services will not be disrupted. Complex Event Processing (CEP) is an emerging and promising technology that enables real-time analysis of the event in the continuous data flow. The integration of an Intrusion Detection System (IDS) with CEP can be used to handle event patterns by processing a huge amount of data. This paper proposes the CEPIDS system, a real-time IoT intrusion detection system that uses CEP rules to identify attacks, which trigger alerts. We evaluated the performance of the proposed system in a Raspberry Pi, one of the most used commodity single-board computers, while running the CEPIDS. Results show that CEPIDS can be run on devices with reduced resources and can effectively be used as IDS in a distributed system. Also, the outcomes indicate that CEP is a viable solution to improve real-time performance of IDS in IoT.