AIBPSF-IoMT: Artificial Intelligence and Blockchain-Based Predictive Security Framework for IoMT Technologies

Abstract

The latest advancements in artificial intelligence (AI) technologies, including machine and deep learning models, in prediction, recommending, and automating processes have greatly impacted IoT devices in general, and protect them from cyberattacks in particular. Blockchain also has features that assist in creating more secure IoT devices due to its abilities of traceability, acceptability, and trust. This paper studies the current advancements in the IoT and blockchain, their architectures, and their effect on security. The paper proposes a novel framework that takes into consideration the advantages and benefits of machine/deep learning models and blockchain in order to provide a solution that makes IoT devices more secure. This framework is based on the IoT four-layer architecture, and it aims to enhance the way IoT devices detect and recognise cyberattacks using blockchain and machine/deep learning algorithms. Machine and deep learning algorithms are responsible for detecting security attacks in the IoT, based on their patterns. The blockchain platform is responsible for verifying whether a specific request is secure, and it also uses cryptography to sign all new requests in order to recognise them in future requests. The MQTTset dataset, which is contains data associated with intrusion detection cases, has been used to implement a case study that aims to prove the validity of this framework. Various machine and deep learning algorithms have been used in this case study which have all achieved high results with regard to precision, recall, accuracy, and F1 performance measurements. Such results have proven the validity and reliability of the proposed framework to detect and predict new attacks before their requests are processed within a particular IoT system.

1. Introduction

The capabilities in the fields of IoT, blockchain, and AI technologies represent a great opportunity in overcoming many of the security issues in many other fields [1]. Recent studies expect that more than 20 billion IoT devices are going to be connected to the internet by 2022 [2]. It is expected that the market of the IoT industry will be around USD 58 billion by 2025, seeing an increase of 34% from 2020 [3]. In another study, the number of IoT devices is expected to reach more than 76 billion by 2026 [4].

IoT devices can face several challenges related to security, privacy, cost, service insufficiency, defective architecture, and data manipulation [5]. There are also other common challenges faced by IoT devices related to standardisation, connectivity, and integration [6]. In fact, IoT can be considered as the technology that might be the risk of being attacked most nowadays [7]. IoT devices are considered to be weak against cyberattacks due to their limitations of storage, computation, and network capacity [8]. Several works in the literature have aimed to propose solutions to these challenges using blockchain technologies. For example, the works of Novo [9] and Javaid et al. [10] provide solutions that address the privacy of IoT using blockchain technologies. More works that address the challenges of IoT are the solutions by Yu et al. [11] and Javaid et al. [12], who have provided solutions for the data manipulation issue.

Blockchain was first introduced in 2008 as an application of bitcoin by Nakamoto [13]. Blockchain’s main objective is to be a trusted distributed ledger; its implementation is mostly based on cryptography [14]. Blockchain can be described as a sequence of blocks, in which each block records a list of transactions that cannot be tampered with [15]. Blockchain has received much attention within the last few years, and is becoming the focus of multiple industries. It has gained most of its popularity for its application in the financial services [16]. However, it has been recently used in many other fields such as healthcare [17,18], IoT [19,20], and others.

Integrating blockchains within IoT is called an ‘IoT blockchain’, defined as a blockchain system that is constructed to empower IoT applications [21]. The great benefit of such integration is creating an automated secure transaction of data using a decentralised approach [7]. There are several attempts being made to develop applications that are mature and combine the advantages of both technologies, such as the work of Bahga et al. [22] and Huh et al. [23]. Moreover, there were even some early attempts that took into consideration how to provide secure systems using IoT blockchains, such as the work of Sharma et al. [24]. However, it has been identified that many of these applications require more advancements in order to fully leverage the IoT blockchain [21].

The use of IoT technologies have lately raised a number of security issues and concerns. These are a result of several features that are associated with the structure of IoT technologies. The most common challenges are caused as a result of the heterogeneity of IoT devices, as they have to interact with many objects and need to adapt to various types of security requirements and protocols [25]. Additionally, IoT devices, in many cases, operates in complex environments with insufficient computational power, which could cause many challenges, including those related to security [26].

It is without any doubt that the integration of IoT devices with blockchain can significantly impact their advancements, such as using the greatest benefits of blockchain as a technology that is a resilient and distributed P2P. Such an integration in this case can lead to more efficient processes that are verifiable, less complex, and save cost and time [27]. It can also greatly benefit the security of any system, including IoT systems, and such benefits include enhancing data security and improving trustworthiness [28].

Unfortunately, most existing AI systems that aim to detect cyberattacks use fixed databases which have knowledge of previous attacks in order to recognise new ones [28]. Therefore, it is necessary to have intelligent systems that can detect and predict new attacks before their requests are processed within a particular IoT system, and this is the problem that this paper addresses. This paper proposes a novel framework that takes into consideration the key features and benefits of AI and blockchain technologies in order to enhance the security of IoT systems. This framework aims to provide IoT systems with an automated methodology that can help them detect existing cyberattacks and learn from them to predict new ones.

The remainder of this paper is organised as follows. Section 2 provides an understanding of the background of the IoT, its architecture, and how it can improve security. Section 3 gives an explanation of the blockchain technology, including its importance, structure, and impact on data security. Section 4 illustrates the proposed framework, its different components, and how it is integrated within a specific IoT architecture. Section 5 and Section 6 show how to apply this framework on a case study and its results, to prove its validity and reliability. Section 7 summarises the outcomes of this paper and proposes future extensions of this work.

2. Internet of Things (IoT) in Brief

Recently, the IoT has gained more attention and become popular among academics and in industry generally. This has been caused by a number of reasons, mainly associated with advancements that have occurred in wireless sensor networks (WSNs) in previous years [29]. This section will briefly discuss IoT architectures, security principles related to the IoT, and how AI can advance the security of the IoT.

2.1. IoT Architecture

The IoT can be defined as several objects (e.g., RFID, sensors, and mobile phones) that interact with each other to accomplish specific objectives [30]. A toaster that was capable of being turned on and off remotely can be described as the first IoT device. It was connected to the internet through a computer equipped with a TCP/IP network and was created by John Romkey in 1990 [31].

In the literature, there are several proposals for designing an IoT architecture, depending on the scope and objective of that IoT. The study of Burhan et al. [32] illustrated that there are three layers representing an IoT architecture: the perception layer, network layer, and application layer. Due to the three-layer architecture limitation, a four-layer architecture was proposed, containing an additional support layer between the perception and network layers [33]. Another proposal that uses the four-layer architecture for IoT was defined by ITU-T, and these layers consist of application, support, network, and devices [34]. The other proposal has shown that there could be some improvements to the IoT architecture by defining a five-layer architecture. The main improvement consists of adding a layer to the three-layer architecture that handles the entire functioning and models of the IoT systems called the business layer, while the other is called the process layer, made to handle the storage and processing of data [35]. A summary of these different types of IoT architectures is illustrated in Figure 1.

As a result of the changing requirements of IoT services, there exist several approaches of designing architectures depending on the scope of the project being addressed [36]. For example, many of these architectures have various types of software and hardware that make it more difficult to interact with installed IoT [37]. This has caused a number of challenges and issues with regard to deploying IoT in any project, and hence there is a great need for developing a standardised platform for IoT [38].

2.2. IoT Security Principles

It has been stated that there are a number of basic security principles which any IoT system needs to follow, such as confidentiality, integrity, privacy, availability, and authenticity [39]. However, these principles face a number of security challenges such as mobility, heterogeneity, scalability, computation complexity, and communication complexity [40]. There are several works that aim to overcome these security challenges and achieve IoT security. For example, the works of Oualha et al. [41], Guo et al. [42], and Touati et al. [43] define techniques that address the stated security issues of the IoT for preserving the confidentiality of the security principles of the IoT.

Privacy is another important IoT security principle, which faces several security challenges that need to be considered. There exist several works that aim to adhere to the privacy principle and take into consideration the security challenges of IoT, such as Huang et al. [44], Evans et al. [45], Appavoo et al. [46], Alcaide et al. [47], and Gheisari et al. [48]. The IoT security principle of availability has been also addressed in several studies which have suggested solutions to overcome the security challenges associated with it. These include the works of Maleh et al. [49], Kumar et al. [50], Kasinathan et al. [51], and Cusack et al. [52].

Another solution was proposed to address the authentication concerns between the IoT transport and application layers using the RSA algorithm [53]. A public key infrastructure-based framework was developed to consider the security issues caused by operations between clients and services [54,55]. Furthermore, Wu et al. [56] suggested a signature-encryption-based model to consider security requirements for the IoT, such as anonymity and trustworthiness. In this regard, a solution was developed to be a mutual authentication protocol using an elliptic curve cryptography algorithm that aims to preserve the privacy of the IoT [57].

Other classifications of security issues facing IoT devices were defined by Khan et al. [8] who classified them in three levels; low, intermediate, and high. Security issues that are classified as low-level are related to jamming adversaries, insecure initialisation, and sleep deprivation attacks [8]. Cyberattacks such as replay, buffer reservation, and RPL routing are classified as intermediate-level issues [8]. Security issues such as insecurity of interfaces, insecurity of software, and security of middleware are considered to be high-level [8].

Developing a secure framework for IoT systems has been defined in the literature in several works. This includes the work of Chakrabarty and Engels which defined a secure framework for IoT used in smart cities as one consisting of four blocks (i.e., black network, trusted SDN controller, unified registry, and key management system) [58]. Branitskiy et al. [59] addressed the problem of detecting attacks on the IoT using a combined method based on parallel data processing and machine learning. Statistical algorithms based on the CRPS metric have been used in a recent work to detect anomalies in IoT devices in which the detection occurred at the fog layer of the IoT architecture [60].

Research published by Mrabet et al. [61] and Mishra et al. [62] has illustrated the types of attacks that every layer in the IoT architecture might encounter; these are shown in Figure 2. Moreover, there are other types of attacks that are related to each IoT layer. For example, the perception layer is exposed to node capturing attacks [63], eavesdropping and interference attacks [64], and malicious code and false data injection attacks [5]. Cyberattacks through phishing sites [65] and access [66] are mostly directed towards the IoT network layer. With regards to the middleware layer, it has faced significant cyberattacks such as man-in-the-middle, SQL injection, and signature wrapping [5].

It can be seen that these solutions are directed towards specific projects. Then, it is necessary to develop a generic framework that can be applied to various types of IoT projects, regardless of their scope or objectives.

2.3. Impact of Artificial Intelligence on IoT Security

AI technologies such as machine learning algorithms can play a major role in making systems more secure [67]. On the contrary, they can also be used to launch more accurate and successful cyberattacks [68]. A study in this field has been conducted by Ucci et al. [69], in which they defined an approach that aims to detect malware using machine learning techniques. Likewise, a model was proposed to detect botnet cyberattacks in IoT using a hybrid deep learning algorithm [70]. In the same context, multi-layer deep learning algorithms have been used to detect botnet cyberattacks in industrial IoT [71].

Cyberattacks on IoT devices can be categorised into two types: network-based and host-based [72]. Network-based solutions include Al-Haija and Al-Dala’ien’s work, where they developed the ELBA-IoT, a model based on machine learning using decision tree algorithms to detect botnet attacks facing IoT networks [72]. Another work consisting of several supervised machine learning models was developed for the purpose of detecting attacks on the IoT network layer [73]. Host-based attack solutions also exist in the literature including in the works of Özçelik at al. [74], where there are edge-based detection and preventing approaches against DDoS attacks on IoT devices.

Machine learning models have also been used in other works to define more secure solutions for IoT recently. For example, the work of Roldán et al. [75] defined an intelligent solution that integrates the technologies of complex event processing and machine learning in order to detect cyberattacks (e.g., malware, DDoS, and privacy breaches) in real time. The work of Ahmed et al. surveyed the solutions based on machine learning schemes to create more secure IoT with regards to their authentication and authorisation, and provided a taxonomy for them [76]. In fact, there exist many works in the literature that focus on using machine learning algorithms for the security of IoT, and such works are defined in [77,78,79,80,81]. However, selecting the most appropriate solution is still a challenge, and the work of Shafiq et al. [82] has outlined this problem and identified a framework for that purpose.

A more detailed classification of such works is to divide them into categories with relation to the type of the machine learning model used in them (i.e., supervised, unsupervised, and reinforcement). Supervised machine learning solutions aim to work as a detection technique for network intrusion and spoofing attacks in IoT devices using SVM and KNN algorithms and are shown in [83,84,85]. Examples of unsupervised machine learning solutions that are used to detect cyberattacks on IoT devices is shown in Tan et al. [86], who use the analysis of multivariate correlation to detect DoS attacks. Reinforcement learning solutions have also been defined in the literature in order to obtain more secure IoT devices, such as in the studies of [87,88].

Furthermore, deep learning algorithms have also been widely used in creating models that make IoT devices more secure towards adversaries and cyberattacks. For example, there are several studies that define models for detecting anomaly cyberattacks on IoT [89,90,91,92]. Such developments are based on supervised deep learning techniques such as LSMT, RNN, and GNN [93]. Furthermore, there also exist many studies that provide anomaly intrusion detection models using other deep learning techniques (e.g., CNN, DBN, and DML), including in the works of [94,95,96,97,98].

3. Blockchain Background and Security-Related Research

Blockchain has recently gained popularity, and more specifically in applications developed to overcome the COVID-19 pandemic [99]. A popular use in this regard is the development of trusted solutions that track movements of infected people with COVID-19 in order to mitigate the pandemic [100]. Most applications developed for the purpose of mitigating COVID-19 are system-centric, technologies including IoT and blockchains, that aim to prevent people from being infected with COVID-19 [101]. In a review study conducted by Tanwar et al. [102], they classified the use of blockchains into five major categories (i.e., detection, monitoring, prediction, response, and prevention). This section will give an overview of the blockchain technology in more details, its structure, and how it can enhance the security of IoT.

3.1. Blockchain Structure

Blockchain is a technology that is based on a distributed ledger and aims to record transactions in a mechanism that is consensual and secured [103]. It is a technology that aims to reduce cost and provide more effective and trustworthy transactions between different parties without the need for a centralised authority to govern these transactions [28]. The use cases of blockchain are not only related to cryptocurrencies but in fact cover many other sectors. Blockchain use cases can be categorised into different categories, and one study classifies them into five categories. These are related to data storage management, trading of goods and data, identity management, rating systems, and others [104].

It has been stated that the most important characteristics of blockchain consist of information storage, transaction execution, function performance, and generating trust [105]. There are specific security properties that must be present in blockchain applications consisting of tamper-resistance, resistance to DDoS and double-spending attacks, and pseudonymity [105].

Blockchain technologies can be classified into three categories, public, consortium, and private, and this classification depends on their accessibility, construction, and verification [105]. The basic structure of most blockchain applications consists of six layers (i.e., application, contract, incentive, consensus, network, and data) [105], as shown in Figure 3. The structure of each block in the blockchain is divided into four parts comprising the main data, the hash of the previous and current block, the time span of generating the block, and other information such as the block signature [106].

This structure gives distributed entities the ability to interact in a distributed, secure, scalable P2P network [107]. In order to put in place reliable security properties for blockchain, Zhang et al. [105] suggested seven security requirements for online transactions. These are consistency, integrity, availability, prevention, confidentiality, anonymity, and unlinkability [105].

3.2. Security of Blockchains

Blockchain carries a number of risks associated with its usage including vulnerabilities exposure, private key security, criminal activity, and transaction privacy leakage [108]. With regards to cybersecurity, blockchain can be seen as a promising approach for handling many security-related issues. For example, Meng et al. [109] suggested implementing a collaborative intrusion detection system based on a blockchain environment. Blockchain is the technology behind promoting bitcoin as a cryptocurrency, but this has caused the blockchain technology to face several attacks including double-spending and mining pool [110]. Another use of applying blockchain technology is in developing anomaly detection systems for various types of projects including electrical vehicle and bitcoin transactions, as mentioned by Signorini et al. [111], Jin et al. [112], and Morishima [113].

With regards to the importance of blockchain on the security of systems, there are several works that have recently investigated this problem. The work of Medhane et al. [114] proposed a distributed security framework based on blockchain using software-defined networking on the edge cloud. The aim is to detect the security attacks at the cloud layer, and as a result the IoT edge layer will have fewer attacks [114]. Moreover, Rathore et al. [115] proposed similar work, relying on blockchain to deliver a security framework that is decentralised and uses mobile edge computing. This framework is defined to detect security attacks based on SDN at the IoT network layer [115].

3.3. Blockchain and IoT Integration from a Security Perspective

In a survey, Panarello et al. [116] categorised the types of studies that consider the integration of blockchain with IoT into five types, based on the security principle addressed. These addressed security principles are as follows: confidentiality, authentication, integrity, availability, and non-repudiation. However, there are some challenges often facing these solutions, mostly related to privacy, computation and mining nodes, time consumption, communication overhead, and scalability [117].

The importance of integrating IoT with blockchain technologies has been studied recently in several works, and there exist several proposals in this regard [118]. For example, the work of Alphand et al. [119] defined an E2E solution that uses blockchain technologies in order to provide a secure access of IoT. FairAccess is another decentralised pseudonymous framework that depends on blockchain technologies to provide a secure access control manager for IoT [120]. Similarly, ControlChain is a blockchain-based access control architecture which was proposed to provide secure interactions with IoT devices [121].

For a similar purpose, Novo et al. [122] proposed a distributed solution to manage IoT using blockchain technologies. Mishra et al. [123] defined another blockchain-based model for IoT to provide decentralised authorisation based on the smart contract concepts. ELIB is a model defined by Mohanty et al. [124] to integrate blockchain technologies with IoT for smart homes. The model aims to establish a secure transmission of data between IoT entities in smart homes and monitor all requests between them. There are also other solutions in the literature that integrate blockchain with IoT for the purpose of having more secure entities, such as the Spacechain architecture [125], G-PBFT protocol [126], BlockMedCare healthcare system [127], and LSB system [128].

A recent advancement in regards to combining AI and blockchain is the concept of decentralised AI (DAI) [129]. DAI is mainly about performing data analytics and making decisions based on a trusted and secure data that is shared on the blockchain [129,130]. One work proposed BlockDeepNet, which is a secure framework that is based on blockchain and deep learning [131]. This work aims to protect IoT devices from data poisoning cyberattacks at the device level [131]. Moreover, it is a solution that relies on blockchain and deep learning algorithms to detect intrusions on IoT used in transportation systems [132].

It can be seen that these solutions are not capable of detecting and predicting new attacks before their requests are processed within a particular IoT system. An exception in this field is the work of Alsemmeari et al. [133], which defined a resilient framework using TNN and blockchain to make IoMT more secure. However, this paper proposes a different novel framework that takes into consideration the key features and benefits of AI and blockchain technologies in order to enhance the security of IoT systems by providing IoMT systems with an automated methodology that can help them detect existing cyberattacks and learn from them to predict new ones.

4. Discussion of the Proposed Framework: AIBPSF-IoMT

It is understood that as long as new devices are connected to the internet, new unknown cyberattacks will occur over time [118]. Therefore, it is important to have a secure protocol that is based on machine learning and blockchain technologies to identify new attacks on IoT [134]. This section addresses this challenge and shows a framework that integrates both AI and blockchain technologies to IoT architectures in order to make them more secure. In addition, it also shows a complete flowchart of the modified architecture and how to interact with the different types of layers of the IoT architecture. It finally illustrates how to implement the modified architecture on a real case study using specific AI algorithms applied on a dataset of intrusion detection cases.

4.1. AI Blockchain-Based Secure IoT Architecture Framework

AIBPSF-IoMT is a secure framework that is based on the IoT four-layer architecture. It aims to enhance the way that IoT devices detect cyberattacks using machine/deep learning algorithms and blockchains. This framework is unique and takes into consideration all the challenges and weaknesses of securing IoT objects. The framework as shown in Figure 4 consists of two components: the first one is the typical IoT architecture with all of its four layers and objects. The second component is the machine/deep learning blockchain-based predictive agent.

4.2. AI Blockchain Predictive Security Agent

This section demonstrates how the agent works in collaboration with IoT devices (Figure 5 shows this agent’s flowchart). The agent consists of a number of components that work in collaboration with each other in order to provide secure communications with IoT devices. The agent starts working as soon as the IoT device receives a request from an outside device. The main goal of this agent is to check whether or not all outside requests are legitimate and will not cause any harm to the platform in which the IoT device is functioning. The agent consists of three main components (i.e., blockchain platform, data source, and AI processor). Moreover, the agent should perform a number of operations to ensure a secure flow of data within the IoT device. More details about these three components are shown below.

4.2.1. Blockchain Platform

This can be considered as the first component in the agent. The basic role of the blockchain platform is to ensure that all transactions and requests are cryptographically signed. This platform’s main goal is to verify all requests made from outside the IoT architecture. Once a request is made by an outsider to the IoT device, the device will start engaging with the blockchain platform to check whether or not the request is altered or not. Then, it will return a signed message that contains information about the requester who made the initial request to the IoT device. Such information is passed towards the second step in the platform, containing details on whether the request can be verified.

The second operation performed by the blockchain platform is to sign all requests which have been classified as secure using a sequence of blocks. This is considered to be the last operation of the agent, and it is only performed for secure transactions. Once a return message is triggered by the platform, indicating that the request is genuine and secure, the blockchain platform signs it cryptographically in order to further secure it in this regard.

4.2.2. Data Source (DS)

The second operation performed by the agent is to check with its data source (DS) if the pattern of the coming request is recognised. It will receive a responding message containing information consisting of whether the incoming pattern is recognised or not. In the case that it recognises the incoming request, it will give details about its level of security. However, if it does not recognise the incoming request, it will notify the agent as such and about all patterns similar to the incoming request. Then, it will be necessary to process the request using the AI processor.

DS is also responsible for providing the agent with information regarding the security level of the incoming requests. Based on such information, the agent can decide whether to proceed to the next level in case the AI processor describes it as secure, or to decline the request if the AI processor describes it otherwise. The AI processor is also responsible for updating the DS with its decision regarding this new request.

The DS consists of several entities that aim to give reliable results regarding the security of requests to the IoT devices. The first entity is responsible for saving all the machine learning algorithms that have been found to be effective in predicting cyberattacks on IoT devices. The second is responsible for having the details of all cyberattacks and their patterns which have been found in the past that target IoT devices. The third component is responsible for handling all the requests from the platform and matching them with the patterns stored in the DS.

4.2.3. Artificial Intelligence (AI) Processor

The third component in the security predictive agent is the AI processor, which has a number of tasks to perform in order to minimise the number of requests made from adversaries to IoT devices. This processor is responsible for analysing all requests that are not recognised by the DS. This analysis is performed using a number of machine learning algorithms that compare patterns of any request with previous requests in order to identify whether it is secure or not. Once this analysis is complete, then it will perform two additional tasks. One is to update the DS with all the details of this request, including its source and security level. This will ensure that such requests will be saved in the DS and can be recognised much faster in the future. The second task is to return the security level of the request to the agent in order to perform its final operations.

4.3. Cyberattacks on IoT and Their AI Detection Algorithms

As shown previously, AI methods such as ML and DL algorithms have been used in different works to predict and mitigate cyberattacks on IoT devices. This section summarises existing cyberattacks according to their attack types, the IoT architecture layer, and the AI method used to detect them. Figure 6 shows this analysis, which has been generated from different resources, including the works of Tahsien et al. [135], Abdullahi et al. [136], Thakkar et al. [137], Aljuhani [138], Aldhaheri et al. [139], and Kuzlu et al. [140].

Although most AI techniques have shown promising results with regards to detecting and mitigating cyberattacks against IoT, they still have some limitations. These limitations include the accuracy rate of some of these techniques, computation power, training time, and their complexity [136]. However, Figure 6 can be described as the first step towards having a data source for the framework defined in this section. The DS of the AI agent needs to contain information that defines the suspected type of attack and its most promising AI algorithm to help detect it. The most important thing here is not to add any detection method unless it has been tested and proven to be accurate.

5. IoT Medical Case Study

This section illustrates how to validate the framework defined in this work (AIBPSF-IoMT) by implementing the part which relates to AI detection methods on recognised and unrecognised patterns to a real case study (the other part of the framework is related to the blockchain platform which can be designed as a public blockchain scheme in this paper since its validity has been proven in many cases [133]). This case study is based on a dataset called MQTTset, and below is a detailed illustration of this experiment.

5.1. Dataset Used in Context

The dataset used in this case study is called MQTTset, which has been developed by Vaccari et al. [141]. MQTTset is based on the protocol of MQTT that is commonly used in IoT networks. MQTTset has been proven to be a reliable dataset in training machine learning models for providing a detection approach for cyberattacks on IoT devices.

This dataset has been developed using the IoT-Flock tool that is capable of analysing IoT network traffic and implementing various types of cyber threats against CoAP and MQTT protocols [142]. The data in the MQTTset has been collected from several sensors designed to give measurements of data related to the physical environment and patient-monitoring sensors.

5.2. Pre-Processing Features

MQTTset has three files, and each of these files has information related to IoT network flows collected from a specific ICU. Each of these files has 50 fields, with information that is related to sensing IoT. The MQTTset environment and patient-monitoring files are considered a normal behaviour of data flow from and to the IoT. For the purpose of this case study, these files have been modified by inserting a new label to show whether the data in every record is either recognised as a non-attack record by the system or not. Such records that are considered as recognised are labelled with 1 and those which are not recognised are labelled with 0. MQTTset attack file is the third file of this dataset, and is the one which represents attacks that were generated from different sources. For the purpose of validating this framework (AIBPSF-IoMT), records in this file have been classified into two categories: one is labelled with 3, representing data previously not recognised, and others are labelled with 4, representing attacks previously recognised.

Two different case studies have been used to verify the validity of the framework developed in this paper. One is to label records with labels of either recognised or not, that are associated with a specific attribute in the files. In this case, records which are generated from specific IP sources are labelled with either recognised or not. This is of course applied to the three files (i.e., records that are considered to be attacks or not). The other case is to label records in the three files with either recognised or not without relating them to specific features. The main reason is to identify whether the model will be capable of giving better results for those attacks which have patterns or features that have been recognised previously.

5.3. Selection Features

The feature selection step is one of the most important steps in developing machine or deep learning models. Feature selection is the step which identifies those features which may lead to better predictions, and hence identifying those ones which can cause the opposite. This step has to be performed using a strategy that aims to reduce overfitting, employ less training time, and be less exposed to test failures. In this experiment, the logistic regression technique has been used to extract features that are relevant to the dataset used in this case. Moreover, a cross-validation technique called stratified KFold, using 10-folds, has been used to validate the model against overfitting.

5.4. ML and DL Algorithm Selection

There are distinct types of ML and DL algorithms that have proven to be applicable for classifying data with multiclass classification, similar to the case being investigated in this case. As mentioned previously, this experiment is based on inserting a new label into the dataset being studied, which is considered a multiclass classification label. Therefore, it is important to choose ML and DL algorithms that have shown to give higher reliability in predicting results for this model.

5.4.1. Machine Learning Algorithms

In this experiment, several machine learning algorithms have been chosen to test their ability to validate the model developed here. The naive Bayes algorithm is one of the ML algorithms that can predict models and give reliable results. A special type of naive Bayes called categorical naive Bayes has been chosen for this experiment. It is one of the most suitable classifiers for models where the features are categorically distributed.

The other ML chosen for this experiment is the k-nearest neighbours, which is also a reliable classifier for models with multiclassified features. The k-nearest neighbours algorithm has been implemented with the number of neighbours set to 5 for this experiment. Another ML algorithm used in this experiment is the decision tree, which is a common supervised classifier for multiclass classification models. This algorithm is common due to its ability to predict models from preparing little data, its simplicity, and its lower cost when compared to other algorithms. This algorithm has been used with certain parameters in order to give more predictive results consisting of the criterion set as ‘gini’, random state set to 100, maximum depth of 10, and leaf nodes minimum number of 5.

Another ML algorithm is the random forest, which is a powerful classifier for supervised learning models. Similarly, a number of parameters have been used in the random forest classifier in order to give more reliable results. These parameters consist of setting the tree maximum depth to 10 and setting the random state to 100 (the random state controls the features’ randomness and sampling). Gradient boosting is another classifier used in this study since it is known to be a common algorithm used in classification problems. The parameters used in this study for this classifier consist of setting the performed number of boosting stages to 100, learning rate to 1.0, maximum depth to 1, and the random state to 0.

5.4.2. Deep Learning Algorithms

There exist several deep learning algorithms that are capable of predicting models and giving reliable results for supervised learning models. An example of such an algorithm is a convolutional neural network (CNN). A CNN has been used in this experiment due to its importance in pattern recognition. CNNs are popular for their simple structure, higher adaptability, and requiring a lower number of training parameters. Conv1D is a two-dimensional neural network and is used for the purpose of this experiment; it uses a single spatial convolution layer. The first layer of convolution uses ReLU activation, 64 filters, and 2 kernels. Another algorithm used in this context is the recurrent neural network (RNN). RNN is also popular in contexts similar to this case study due to its ease of use and customisation. A simple RNN is used in this work, using ReLU activation and 64 filters.

The third DL algorithm used in this work is long short-term memory (LSTM). LSTM is another powerful DL algorithm that is famous for its powerful performance. For this work, LSTM uses 64 filters and the return sequence (which defines whether or not to return the last output) is set to true. The final DL algorithm used is the gated recurrent unit (GRU). GRU is another powerful deep learning algorithm, and it uses 64 filters and the return sequence is set to true for this case study. Furthermore, some of these algorithms have been combined together in order to verify whether these would give better predictions than if they were applied on their own. These algorithms include combining CNN and LSTM, CNN and RNN, CNN and GRU, RNN and GRU, RNN and LSTM, and finally RNN and CNN.

All of these different models have been used with 48 dense layers at two stages. The first one is to make a model density of 16 deeply connected layers, applying a 1D maximum pooling operation, and flattening the input. The second stage is to make a model density of 32 deeply connected layers. The models are then compiled with loss of sparse categorical cross-entropy and Adam. Fitting the model is also another important step; we use a batch size of 128 and 10 epochs in this case study.

6. Case Study Results Analysis

This section analyses the results of the case study described above with regard to a number of performance evaluation measurements. This section will first illustrate how the dataset studied in this paper is prepared for the experiment. Then, it outlines how the measurement are used in this analysis and how they are applied in the case studied in this paper. Lastly, an interpretation of the results will be given and discussed in more detail.

6.1. Dataset Preparation

The model described in this paper has been applied to the MQTTset. The MQTTset has 188,694 records distributed on three files. The environment monitoring file contains 31,758 and the patient monitoring file has 76,810 records. The attacks file, which has 80,126 records, is the one which has all the cyberattack records.

For the purposes of this case study, two versions of these three files have been created. Each file is divided into roughly two halves in order to have balanced sets, and hence obtain reliable results. The inserted label for each half either indicates that patterns of the related record are recognised or not. The inserted label in the first version (V1) of these files is randomly distributed (i.e., it is not directly associated with any particular features). The second version (V2) of these files has a label that indicates whether the record has a pattern that is recognised or not in association with a particular feature. In this version, the records with specific IP sources haven been labelled as either recognised or not. All records in these files that are considered to be non-attack records are labelled with ‘0’ if they are not recognised, and with ‘1’ if they are recognised. In addition, those records which are considered to be security attacks are labelled with ‘3’ if they are not recognised and with ‘4’ if they are recognised.

6.2. Performance Evaluation Measurements

In order to analyse the results of the case study described above, four performance evaluation metrics have been chosen to validate the results of this model. These metrics are ones which have been widely used in similar cases, consisting of precision, accuracy, recall, and F1 score.

6.2.1. Precision

The precision metric is represented by the ratio of samples that are identified as true positives to the samples that are identified as either true positives and false positives. This metric can be expressed as shown in Equation (1).

$$Precision=\frac{TP}{TP+FP}$$

(1)

6.2.2. Accuracy

The accuracy metric measures the ratio of the number of samples that are accurately identified to the total number of samples. It can be expressed as shown in Equation (2).

$$Accuracy=\frac{TP+TN}{TP+FP+TN+FN}$$

(2)

6.2.3. Recall

The recall metric is expressed by the ratio of samples that are identified as true positives to the samples that are identified as either true positives and false negatives. This metric can be illustrated as in Equation (3).

$$Recall=\frac{TP}{TP+FN}$$

(3)

6.2.4. F1 Score

The F1 score metric is calculated by measuring the weighted average of the recall and precision metrics. It can be expressed as shown in Equation (4).

$$F1\text{-}score=2\times \frac{Precision\times Recall}{Precision+Recall}$$

(4)

6.3. Discussion of Results

Table 1. Machine learning algorithms’ performance evaluation measurements.

Classifier	Performance Measurements
	Precision		Recall		Accuracy		F1 Score
	V1	V2	V1	V2	V1	V2	V1	V2
NB	78.6480	96.4624	78.5683	96.3131	78.2341	96.5710	78.5292	96.1949
KNN	81.6286	97.1058	81.6171	97.1411	82.4633	97.4667	81.6045	97.1172
RF	89.9983	99.9872	89.8325	99.9878	90.2591	99.9894	89.7879	99.9875
GB	87.6908	99.7180	87.6105	99.7640	87.9219	99.7403	87.5802	99.7406
DT	96.8762	100.0	96.8635	100.0	96.5710	100.0	96.8562	100.0

shows the performance evaluation metrics after applying the specific ML algorithms on the dataset as described previously. It can be seen clearly that the model is giving a good prediction with both versions of the dataset. However, it also clearly shows that V2 of the dataset, which has the records labelled with data with an association with specific features (i.e., IP sources), gives better measurements with regards to all of the measurements. Hence, more reliable predictions can be inferred in this regard.

Table 2. Deep learning algorithms’ performance evaluation measurements.

Classifier	Performance Measurements
	Precision		Recall		Accuracy		F1 Score
	V1	V2	V1	V2	V1	V2	V1	V2
CNN	78.1730	99.3337	76.8360	99.3684	77.1795	99.3057	76.5439	99.3470
RNN	80.9068	99.7547	80.8552	99.7465	81.5729	99.7880	80.8283	99.7501
GRU	87.5437	99.6448	86.4697	99.6505	86.5440	99.6979	86.2995	99.6473
LSTM	85.0663	99.8090	84.6829	99.8041	85.2244	99.8357	84.6397	99.8064
CNN + LSTM	84.8737	99.6155	84.1229	99.6275	84.4506	99.6767	83.9883	99.6192
CNN + GRU	85.2915	99.5167	84.7879	99.5487	85.0760	99.5919	84.6826	99.5291
RNN + GRU	86.5751	99.8186	86.2702	99.8080	86.4380	99.8410	86.1876	99.8126
RNN + LSTM	86.9917	99.5003	86.7917	99.5153	86.9256	99.5760	86.7354	99.5038
RNN + CNN	85.1768	99.8542	84.4807	99.8590	84.9170	99.8781	84.3648	99.8563

shows how the various number of DL algorithms performed when applied to the same dataset, in accordance with the model described here. It can be clearly seen that all of these metrics performed very well when applied to the V2 dataset. This is not the case when applied to the V1 dataset, where although it has similar results, CNN did not give results above 80s. However, CNN tended to perform well either on its own or when combined with other DL algorithms when applied to versions of the dataset that have multiclass classifications labels associated with certain features, as in V2.

Another observation with regards to Table 2 is that algorithms GRU, RNN + GRU, and RNN + LSTM tended to give better results when applied to V1 of the dataset. On the other hand, algorithms LSTM, RNN + GRU, and RNN + CNN gave better results when applied to V2 of the dataset. It can be also identified that RNN + GRU is the algorithm which tends to give better results for the dataset in both versions V1 and V2. Hence, it could be seen as the most reliable algorithm for this context.

To further verify the results of the model described in this paper, a comparison of these results was conducted with another model that considers the same dataset. The benchmark was taken from the work of Hussain et al. [143].

Table 3. Performance evaluation measurement comparison between V2 and benchmark.

Classifier	Performance Measurements
	Precision		Recall		Accuracy		F1 Score
	Benchmark	V2	Benchmark	V2	Benchmark	V2	Benchmark	V2
NB	79.6711	96.4624	99.7053	96.3131	52.1823	96.5710	68.5092	96.1949
KNN	99.6502	97.1058	99.6867	97.1411	99.4873	97.4667	99.5869	97.1172
RF	99.7068	99.9872	99.7952	99.9878	99.5123	99.9894	99.6535	99.9875
DT	99.6944	100.0	99.7993	100.0	99.4789	100.0	99.6388	100.0

shows the results of the comparison, showing the results of ML for V2 of the model described in this paper. Four ML algorithms that are common between the two works are shown. It can be seen that V2 of the model has better results in reference to the RF and DT algorithms but that was not the case with regards to the KNN algorithm. The NB results vary between the two models but in general it performed much better with regards to precision, accuracy, and F1 score.

It is clearly shown that the model defined by this paper can give reliable and accurate results. In addition, it can be indicated that this model can give better predictions when used with DL algorithms than most ML algorithms. Therefore, these results prove the reliability of this model. The other point that these results show is that most of the DL algorithms, especially when combined with others, can give better predictions than ML algorithms for multiclass classification models. It can also be concluded that these ML and DL algorithms can also give good predictions for cyberattacks, as shown in previous studies.

7. Conclusions

IoT is an evolving technology that has lately begun to receive considerable amount of attention. However, this technology is still developing and requires more work to be conducted towards overcoming its inherent challenges. The most prominent characteristics of IoT consist of being heterogeneous and having multiple interconnections which lead to the production of data that are huge and hard to manage. Such characteristics and others have caused a number of security threats that IoT architectures have started to face recently. Therefore, it is essential to put in place a framework that considers such threats from an early stage in order to develop more secure IoT systems.

This paper proposes a novel framework that takes into consideration the advantages and benefits of ML and DL algorithms and blockchain in order to secure IoT devices. It has been shown how this framework works towards all requests made in any layer of the IoT architecture, and this makes this framework unique. There are many cyberattacks that can target different layers of the IoT architecture. However, this framework ensures that many of these cyberattacks can be handled and contained using the AI agent proposed by this framework.

Finally, the paper concludes by providing an experiment in which the proposed framework is applied to a real dataset. The MQTTset dataset has been used in this experiment using a number of relevant ML and DL algorithms to verify the reliability of this model. A number of evaluation performance measurements (i.e., precision, recall, accuracy, and F1) have been used in order to evaluate the model. The results have shown the high reliability and good predictions of this model, especially when cyberattack patterns are known and recognised.

More investigations should be conducted in order to identify which AI models can give more reliable results, as an extension to this work. Furthermore, future work could also aim to identify how to protect each IoT layer from certain cyberattacks, using this framework on different datasets generated from IoMT devices.