Design of Complex Event-Processing IDS in Internet of Things

With the development of Internet of Things (IoT), there have been more and more services and applications deployed in physical spaces and information systems. Massive number of situation-aware sensors and devices are embedded in IoT environments, which produce huge amounts of data continuously for the IoT systems and platforms. Processing these data stream generated by the IoT networks with different patterns has raised new challenges for the real-time performance of intrusion detection system (IDS) in IoT environments, which has to react quickly to the hacking attacks and malicious activities to IoT. In recent years, Complex Event Processing (CEP) technology provides new solutions in the field of complex pattern identifications and real-time data processing, which can be used to improve the performance of traditional IDS in IoT environments. IDS integrated with CEP can be used to deal with patterns among events and process large volumes of messages with low latency. In this paper we proposed an event-processing IDS architecture in IoT environments on the basis of security requirements analysis for IDS. Then the implementation details for real-time event processing are also proposed, which is developed by Esper, a CEP engine for complex event processing and event series analysis.