Simulation of watchdog placement for cooperative anomaly detection in Bluetooth Mesh Intrusion Detection System

Cyber-attacks on the Internet of Things (IoT) are growing at an alarming rate as IoT technologies are literally connecting everything into networks. In 2020 more than 25% of identified attacks in enterprises will involve the IoT. Hence, it is very important to treat IoT security as a mandatory design factor. Moreover the deployed IoT system should be continuously monitored to detect malicious behaviour such as packet dropping, worm propagation or jammer attacks. In the paper we propose the anomaly based Intrusion Detection System dedicated to Bluetooth Mesh networks. The machine learning algorithm is used to classify traffic and detect malicious behaviour in IoT networks. The proposed solution involve cooperative decision making which is done by multiple watchdogs distributed in different regions of the considered network - which are responsible for processing of mostly local traffic. The optimal placement of watchdogs is proposed based on simulations done by BMWatchSim software. The experimental results coming from our testbed confirm that the watchdog placement proposed by simulator allow on effective detection of real-world intrusions.