eBF: An Enhanced Bloom Filter for Intrusion Detection in IoT

Abstract Intrusion detection is an essential process to identify malicious incidents and continuously alert the many users of the Internet of Things (IoT). The constant monitoring of events generated from more than millions of devices connected to the IoT and the extensive analysis of every event based on predefined security policies consumes enormous resources. Accordingly, performance enhancement is a crucial concern of intrusion detection in IoT and other massive Big Data Systems to ensure a secure environment efficiently. Like many Big Data systems, intrusion detection system of the IoT need to employ the fast membership filter, Bloom Filter, to quickly identify possible attacks. Bloom Filter is an admiringly fast and space-efficient data structure that quickly handle elements of extensive datasets in a small memory space. However, the trade-off between the query performance and the number of hash functions, and memory space and false positive probability remain issues of Bloom Filter. Thus, this article presents an enhanced Bloom Filter (eBF) that remarkably improves memory efficiency and introduces new techniques to accelerate the speed of search processing demand of intrusion detection system in IoT. We experimentally show the efficacy of eBF using real dataset of intrusion detection. The experimental result shows that the proposed filter is remarkably memory efficient, faster, and more accurate than the state-of-the-art filters. eBF requires 15x, 13x, and 8x less memory compared with Standard Bloom Filter, Cuckoo filter, and robustBF, respectively. Therefore, this new system will significantly impact the enhancement of the performance of intrusion detection of IoT that concurrently monitors several billion events crosschecking with the defined security policies.