OCIDS: An Online CNN-Based Network Intrusion Detection System for DDoS Attacks with IoT Botnets

As the number of IoT devices increases considerably, the need for accurate and fast malicious traffic detection systems for DDoS attacks with IoT botnet has become apparent. Several deep learning-based and accurate network intrusion detection systems (NIDS) were developed to address this challenge. However, many of these systems depend on traffic flow features, and they may not provide a real-Time solution. Ones that are implemented as online systems either do not use any temporal features of the traffic or use recurrent deep learning models to keep the short-Term temporal features. We propose an online CNN-Based NIDS that leverages both temporal and spatial features. Inserting two additional memories, we can store features of earlier traffic in the longer term, and we can track labels of the flows to save detection time by avoiding feeding all the packets into a time-consuming deep learning model. Experimental evaluations show that the proposed model offers a fast and accurate online NIDS for DDoS traffic created by IoT botnets.