Kalis — A System for Knowledge-Driven Adaptable Intrusion Detection for the Internet of Things

In this paper, we introduce Kalis, a self-adapting, knowledge-driven expert Intrusion Detection System able to detect attacks in real time across a wide range of IoT systems. Kalis does not require changes to existing IoT software, can monitor a wide variety of protocols, has no performance impact on applications on IoT devices, and enables collaborative security scenarios. Kalis is the first comprehensive approach to intrusion detection for IoT that does not target individual protocols or applications, and adapts the detection strategy to the specific network features. Extensive evaluation shows that Kalis is effective and efficient in detecting attacks to IoT systems.

I. Introduction

As the Internet of Things (IoT) enables many novel applications, it also increases the risk of cyber security attacks [6], [15], [44], [45]. Most applications-such as mission-critical tasks, industrial control or medical monitoring-have stringent requirements with respect to reliability, data privacy, and trustworthy data delivery. IoT security is thus critical.