报告详情
  1. 活动首页
  2. 报告清单
  3. 报告详情
Drift-Aware Real-Time Intrusion Detection for IoT Data Streams via Incremental Hoeffding Tree Learning
编号：177 访问权限：仅限参会人 更新：2026-11-10 17:02:52 浏览：10次 Online

报告开始：2026年11月20日 14:45（Asia/Kolkata）

报告时间：15min

所在会场：[S7] Networking, Security and Blockchain Systems [S7-1] Networking, Security and Blockchain Systems

暂无文件

摘要
Securing the Internet of Things poses a challenge that sits at the intersection of hardware scarcity and data velocity: edge nodes operate under severe compute budgets yet must make millisecond-scale security decisions against continuously evolv-ing attack traffic. Batch-trained classifiers impose mandatory retraining pauses that leave the network unguarded whenever attack behaviour drifts beyond a historical training boundary, while signature engines remain permanently blind to novel threat patterns. This paper describes a stream-native detection framework built around an incrementally trained Hoeffding Tree that processes every incoming flow record exactly once, in the order of arrival, without retaining historical data or interrupting classification for model updates. Raw IoT device traffic is ingested through an Apache Kafka message bus, per-flow statistics are materialised inside five-second tumbling windows managed by Apache Flink, and each resulting feature vector is forwarded to a River HoeffdingTreeClassifier that issues a prediction before absorbing the verified ground-truth label. Concept drift at individual decision tree leaves is identified and addressed by ADWIN, a statistically grounded change-detection component that resets only the subtrees affected by distributional shifts, leaving stable branches undisturbed. The complete pipeline was evaluated against 650,000 labelled flow records from the CICIoT 2025 and  benchmark dataset under a strictly prequential assessment protocol, which prohibits any sample from informing a prediction made before its arrival. The system attained a macro-average accuracy of 94.3% and a corresponding F1-score of 94.4%, with a median end-to-end detection latency of 47 ms on commodity workstation hardware. SYN flood events were resolved at 97.4% accuracy in a median of 38 ms. Following a controlled mid-stream regime substitution, the drift-aware configuration recovered to stable accuracy approximately 35% faster than the non-adaptive baseline, confirming that localised leaf resetting maintains detection quality as attack patterns evolve without disrupting branches where no change has occurred.
Index Terms—IoT intrusion detection; Hoeffding Tree; online machine learning; Apache Flink; stream processing; ADWIN; CICIoT 2025; concept drift; real-time anomaly detection
 
关键词
Intrusion Detection System (IDS),Network Security,Machine Learning, Hoeffding Tree,Data Stream Mining,Concept Drift
报告人
MUKESH P R
STUDENT student

稿件作者
MUKESH P R student
发表评论
验证码 看不清楚，更换一张
全部评论
重要日期

  • 会议日期

    11月20日

    2026

    至

    11月22日

    2026

  • 10月31日 2026

    初稿截稿日期

  • 11月07日 2026

    提前注册日期

  • 11月22日 2026

    注册截止日期

主办单位
United Societies of Science
承办单位
Pondicherry University
协办单位
IEEE Section
IEEE Madras Section
联系方式
登录查看完整联系方式
移动端
在手机上打开
小程序
打开微信小程序
客服
扫码或点此咨询