Abstract
Security breaches can seriously harm the Internet of Things (IoT) and Industrial IoT (IIoT) environments. The damage can exceed financial and material losses to threaten human lives. Overcoming these security risks is challenging given IoT ubiquity, complexity, and restricted resources. Security intrusion management is a cornerstone in fortifying the defensive security process. This paper presents an integrated multilayered framework facilitating the orchestration of the security intrusion management process and developing security decision support systems. The proposed framework incorporates four layers with four dedicated processing phases. This paper focuses mainly on the analytical layer. We present the architecture and models for predictive intrusion analytics for reactive and proactive defense strategies. We differentiate between the device and network levels to master the complexity of IoT infrastructure. Benefiting from the singularity of IIoT devices traffic, we approach the reactive security intrusion prediction through outlier detection models mean. We thoroughly experiment with ten outlier detection models on the IIoT wustl realistic dataset. The obtained results show the adequacy of the approach with an area under the curve (AUC) results surpassing 98% for several models with a good level of precision and time efficiency. Furthermore, we investigate the use of survival analysis semi-parametric predictive models to forecast the security intrusion before its occurrence for the proactive security strategy. The experiments show encouraging results with a concordance index (c-Index) reaching 89% and an integrated brier score (IBS) of 0.02. By integrating outlier intrusion detection and survival forecasting, the framework provides a valuable means to monitor the security intrusions in IoT.