Abstract
With the increase relay on the internet, and the shift of most business to provide remote services, the burdens of protecting the network and detecting any attack quickly become more significant, as the attack surface and Cyberattack increases in return. Most current Wireless Sensor Networks (WSNs) intrusion detection models that use machine learning methods to identify non-previously seen attacks utilize one layer of detection, meaning that a costly algorithm should be run before detecting any suspicious activity. In this paper, we propose a multi-layer intrusion detection framework for WSN; in which we adopt a defense-in-depth security strategy, where two layers of detection are deployed. The first layer is located on the network edge sensors are distributed; it uses a Naive Bayes classifier for real-time decision making of the inspected packets. The second layer is located on the cloud and utilizes a Random Forest multiclass classifier for an in-depth analysis of the inspected packets. The results demonstrate that our proposed multi-layer detection model gives a relatively high performance of the TPR, TNR, FPR, and FNR, additionally achieving a high Precision rate with values of, 100%, 90.4%, 99.5%, 97%, 99.9% for the Normal, Flooding, Scheduling, Grayhole, and Blackhole attacks, respectively.