ГИБКАЯ IDPS НА ОСНОВЕ АЛГОРИТМОВ МАШИННОГО ОБУЧЕНИЯ ДЛЯ МОНИТОРИНГА И ЗАЩИТЫ ПЕРИФЕРИЙНЫХ IoT-УСТРОЙСТВ

Abstract

The growing number of edge IoT devices in smart city infrastructures poses new challenges related to a fragmented attack surface and the limitations of traditional intrusion detection tools. Existing IDS systems typically operate in isolation, generate redundant alerts, and are unable to adapt to distributed environments. This paper proposes the architecture of a flexible IDS that leverages machine learning algorithms to improve the monitoring and protection of edge devices. The architecture includes modules for normalization, deduplication, correlation, and ML analysis, with the ability to provide feedback between the monitoring center and edge nodes. The architectural description of the monitoring environment is based on a hierarchical representation consistent with the Purdue model, allowing for the distinction between edge, local, and centralized levels of protection. Experimental evaluation on the BoT-IoT and TON_IoT datasets demonstrated a reduction in event correlation latency by approximately 62% and a decrease in the false positive rate by 29–31% compared to baseline approaches. The obtained results confirm the potential of the proposed architecture for smart city infrastructures.