Detection of Security Attacks in Industrial IoT Networks: A Blockchain and Machine Learning Approach

Round 1

Reviewer 1 Report

The authors are encouraged to do the following to enhance the quality of the paper:

1- The figures in the conclusion section should not be there and must be moved to another section.

2- Conclusion is too long, should be revised.

3- The number of references is insufficient and authors need to add between 10-15 recent references.

4- The related work section must be improved with recent and similar studies related to the subject.

5- Authors need to enhance the quality if the statistical analysis of the paper by doing either ANOVA or confidence interval with a significance level of 85% or more.

Author Response

Thanks to the reviewer for these recommendations. We honestly appreciate them since we understand this is a required process to improve the quality of the work and, in this sense, we have adopted the necessary changes to fulfill as much as possible all the recommendations. Sincerely, we hope these changes could accomplish the recommended improvements.

1- The figures in the conclusion section should not be there and must be moved to another section. Answer: The figures were relocated to the previous section in the paper.

2- Conclusion is too long, should be revised. Answer: The conclusions were reduced.

3- The number of references is insufficient and authors need to add between 10-15 recent references. Answer: There were added 12 new references, 3 references in the introduction section and 9 in the related projects section.

4- The related work section must be improved with recent and similar studies related to the subject. Answer: There were added 12 new references, 3 references in the introduction section and 9 in the related projects section.

5- Authors need to enhance the quality if the statistical analysis of the paper by doing either ANOVA or confidence interval with a significance level of 85% or more. Answer: Confidence interval results were added for the machine learning approach.

These corrections can be seen in the attached paper manuscript, which is highlighted with the corrections.

Author Response File: Author Response.pdf

Reviewer 2 Report

This work is basically focused on a combination of blockchain technology and machine learning methods to detect security attacks in industrial IoT environments.

From a methodology point of view, the work does not add any novelty since all the involved techniques (blockchain, KNN) are well known and studied.

Some concerns follow:

- The classification model in Fig. 2 is well known since the KNN classifier is widely adopted into IDS literature to improve the recognition of malicious flows from normal ones. My suggestion is to customize in a more specific way the algorithm so to stress the novelty element of being applied into IIoT environments.

- In the experimental stage, it is not clear if the Authors refer to a specific IIoT environment. Generically, in Sect. 4.2 the Authors claim to refer to a threat collection such as spoofing attacks aimed at compromising network interfaces, and DoS attack aimed at compromising part of a network. Such attacks are very common in all IP-based environments, not only into IIoT environments. Thus, if the Authors really want to differentiate from the existing literature, they have to make an effort of using data coming from a real (or at least simulated as closer as possible to industrial scenarios) industrial IoT environment (since they claim from the title that the work relates to IIoT). Otherwise, it remains a work with absolutely no novelty.

- Related Work section should be improved. It would be a good idea to take some recent survey in this field as a guideline (see e.g. “Smart Anomaly Detection in Sensor Systems: A Multi-Perspective Review”, Information Fusion, 2020).

Author Response

Thanks to the reviewer for these recommendations. We honestly appreciate them since we understand this is a required process to improve the quality of the work and, in this sense, we have adopted the necessary changes to fulfill as much as possible all the recommendations. Sincerely, we hope these changes could accomplish the recommended improvements.

1- The classification model in Fig. 2 is well known since the KNN classifier is widely adopted into IDS literature to improve the recognition of malicious flows from normal ones. My suggestion is to customize in a more specific way the algorithm so to stress the novelty element of being applied into IIoT environments. Answer: Many values of the number of neighbors and traces were considered to find the best parameters configuration in order to achieve the best performance of the KNN algorithm.

2- In the experimental stage, it is not clear if the Authors refer to a specific IIoT environment. Generically, in Sect. 4.2 the Authors claim to refer to a threat collection such as spoofing attacks aimed at compromising network interfaces, and DoS attack aimed at compromising part of a network. Such attacks are very common in all IP-based environments, not only into IIoT environments. Thus, if the Authors really want to differentiate from the existing literature, they have to make an effort of using data coming from a real (or at least simulated as closer as possible to industrial scenarios) industrial IoT environment (since they claim from the title that the work relates to IIoT). Otherwise, it remains a work with absolutely no novelty. Answer: We selected the UNSWNB15 dataset to evaluate our proposed scheme. This dataset was generated by the Cyber Range Lab of the Australian Centre for Cyber Security (ACCS), which corresponds to a new generation of industrial IoT (IIoT) dataset in order to evaluate and calibrating the performance of artificial intelligence/machine learning cybersecurity applications. Our KNN approach was trained and tested considering this dataset.

3- Related Work section should be improved. It would be a good idea to take some recent survey in this field as a guideline (see e.g. “Smart Anomaly Detection in Sensor Systems: A Multi-Perspective Review”, Information Fusion, 2020). Answer: There were added 12 new references, 3 references in the introduction section and 9 in the related projects section. One of the references corresponded to "Smart Anomaly Detection in Sensor Systems: A Multi-Perspective Review".

These corrections can be seen in the attached paper manuscript, which is highlighted with the corrections.

Author Response File: Author Response.pdf

Round 2

Reviewer 1 Report

The authors addressed my previous comments.

Reviewer 2 Report

The Authors have satisfied all my concerns raised during the first revision. In particular they:

• Have clarified the original contribution by better customising the process around the kNN algorithm;
• Have stressed the "Industrial" qualification of IIoT by using the data coming from the UNSWNB15 dataset;
• Have improved the related work section.

In my opinion, the paper is now good as is.