Internet users have been dynamically attacked over the past 10 years by worms and viruses that are distributed over email. This is not because the Internet is significantly more secure; rather, it is more likely a result of attackers' focus shifting to infecting and controlling victim PCs, a type of threat that offers greater opportunity for individual gain and offensive capabilities. As per a Gartner report [1], by 2030, the number of Internet of Things (IoT) devices linked over the internet is predicted to reach 50 billion. These IoT devices are not just used in electronic gadgets; they have also made their way into other industries, including smart agriculture, hospitals, and homes [2]. Several strategies are used to attack threats and give users access to a secure network. In particular, blockchain, machine learning (ML), and deep learning (DL) technologies are studied in this paper as intrusion detection strategies. By using either the signature-based or anomaly-based types of cyber-analysis, machine learning may be used to identify attacks. Some publications in the literature [3] employ signature-based approaches to identify attacks. The four different machine learning algorithms are used to understand the features of some frequent attacks in the paper. The detection of botnet patterns in the network traffic was employed by using signature-dependent methods [4]. These methods were also employed to detect infected workstations by analysis of botnet network traffic patterns. The two fundamental weaknesses of signature-dependent techniques are that they cannot identify previously undetected phishing attacks and that their effective usage necessitates regular human updating of attack traffic signatures. Anomaly-based detection is the second class of detection techniques. This class simulates typical network behavior, and any unusual behavior is regarded as an attack. Many IoT gadgets, including security cameras with IP-enabled systems, printers with wireless connectivity, baby monitors, etc., have weak security configurations that Mirai took advantage of to turn the above-mentioned devices into harmful bots. The above harmful bots joined together to form a botnet that launched many DDoS attacks against a DNS provider. Later, the Mirai botnet's source code was made public on Hackers Forum, and it was looked into how these IoT devices came to be a target of the Mirai botnet [5]. Traditional DDoS attacks are usually stopped by installing expensive, complex equipment or using outside service providers who charge a lot for their services [6, 7]. To overcome the issue with centralized DDoS mitigation methods, Blockchain introduces a database which is distributed and depends on the network with peer-to-peer connectivity, which presents a high intensity of trust which also includes dependability. A node broadcasts a new block to the rest of the network after receiving it. After verifying the block, each node that has received it distributes it to other nodes. The block can only be added to the blockchain by the miners.

Several industries are using blockchain to facilitate trust and data privacy. This is because it supports parties to make different types of transactions in order to transfer information by retaining trust of the users. Intrusion Detection System with blockchain technology can be used together to detect different kinds of threats in order to protect personal and sensitive data of the clients stored on cloud technology and also IoT networks. The Collaborative Intrusion Detection Systems (CIDSs) are assumed as economical and scalable for inspecting different cloud nodes. The major challenges in the cloud technologies will be the storage capacity to maintain the privacy of data and provide assurance for trust management amongst multi-cloud service providers [8].

Privacy-preserving mechanisms are frequently implemented to convert, alter, or hide original material in order to secure it from unwanted access, along with the process of finding attack events employing CIDSs in the cloud services [9]. The blockchain structure and smart contract technologies are popular forms for preserving privacy, which provides cloud elements with authentication and integrity. Numerous security weaknesses in blockchain attacks and related technologies, like bitcoin and Ethereum, have been recently brought to light [10]. As this article says, it is important to use machine learning to create an IDS-based blockchain system in the cloud. This will help find cyberattacks and protect the data of IDS engines that are installed at different cloud nodes.

We can summarize our contributions through this article as:

•  On the basis of a machine blockchain framework (MBF), a system for detecting intrusions has been proposed. This system keeps data secure and private in cloud networks.

•  The detection of cyberattacks in IoT networks can be made better by looking at how efficiently machine learning algorithms will be able to work on a recent type of IoT dataset.

•  Get the current features from the datasets and choose the most useful ones to improve the performance of a machine learning algorithm.

The proposed system and prescribed methods have been evaluated with the help of data sets of UNSW-BN15 and N-BaIoT of the network, the performance of the system is compared with different intrusion detection techniques to determine its effectiveness while deploying it to the cloud.

31.png

Figure 1. Proposed cloud-based system architecture for cloud data centers using the MBF installed at NIDS

32.png

Figure 2. A DBF transaction's period of security event aggregation

33.png

Figure 3. Proposed XGBoost model for intrusion detection

B. Data preprocessing:

We employed the max-min normalization, in which the input data are to be mapped according to the range of the values between 0 and 1 [22], as the preprocessing step. For the system's implementation, we employed various Python libraries, including Scikit-learn, Keras, and TensorFlow. Scikit-learn is a supporting tool for effectively implementing a variety of machine learning methods. Additionally, it offers the ability to divide datasets into several subsets, including the ability to divide training and test datasets. We have partitioned the chosen dataset into training and testing datasets using this package. Additionally, we experimented with the help of a tree-based approach and naive bayes using this library. In this case, we use TensorFlow, which is a more complicated framework designed for distributed numerical computation with the help of data flow graphs. It can run on top of Keras, the high-level efficient neural network of the Python-API.

Data cleaning: The IoT Botnet dataset contains properties of a comparable type and quantity with somewhat different attack types. Before normalizing this dataset, the null values are taken out, the redundant indices are removed, and the data types are changed to the right type (float). This is done to avoid problems.

Numericalization: Each dataset's feature data types must be identified in advance for numericalization. As the N BaIoT Data Set dataset lacks a category value. By using label encoding, these category variables are transformed into numeric data. Label encoding uses little memory and produces the same dimension of the dataset as previously, while giving repeated labels the same values. So, label encoding is used to turn the category-type features in all four of these datasets into numbers. For label encoding in this study, we employed the scikit-learn library. The steps are as follows: (i) Create a LabelEncoder; (ii) Instance and save it in the LabelEncoder variable/object; (iii) Then, fit and transform are used to assign numerical values to categorical values, and the results are kept in a new column named "State N."

Normalizing: Following numericalization, the five relevant dataset’s continuous numerical data, particularly those with a high range, are subjected to the StandardScaler technique for normalization. StandardScalar scales the data using a normal distribution by dividing by the standard deviation and subtracting the mean of 0.

$\frac{x_i-\operatorname{mean}(x)}{\operatorname{std} \cdot \operatorname{dev}(x)}$          (1)

The mean and standard deviation of the x features are determined for feature x_i, and xi is scaled using Eq. (1) above.

C. Classification:

The network detection mechanism classifies the specified features as either normal or attacks using classification algorithms. Three classifiers are used to analyse the data: Logistic Regression (LR), Random Forest (RF), and XGBoost (a proposed technique), and the data is classified by botnet, attack, and device. Below, we have a detailed explanation of each.

Logistic Regression (LR):

A machine learning classifier called logistic regression (LR) is used to simulate the probability of a given class value. Although LR may be expanded to classify more than one class, in its most basic form, LR models a binary dependent variable using a logistic function. It is possible to employ a weighting of the factors to lower the level of the penalties from a complete penalty to a very small penalty. The L2 penalty is employed by the LogisticRegression class by default with a weighting of coefficients set to 1.0. Although not all solvers support all penalty types, the type of penalty may be chosen through the "penalty" parameter with values of "l1", "l2", or "elasticnet" (e.g., both). The "C" option allows the penalty's coefficient weighting to be modified [23].

Random Forest (RF):

The Random Forest algorithm belongs to the category of supervised learning. Random Forest is unique in that it may be used with both classification and regression methods. A random forest, to put it simply, is a collection of decision trees that use the bulk of their outputs to enhance prediction and outcomes. In this study, the Random Forest model is used to predict the accuracy of the Mirai or Gafgyt malware in the dataset. The LR and XGBoost models are also used to predict and compare the precision value, recall value, and F-1 score.

Algorithm XGBoost (Proposed model):

Test and train data were included in the dataset. To combine the data into one file, the two sets were first concatenated. The Python environment is used to run the combined data. The dataset has been opened on the Python platform, and the XGBoost algorithm for the N-BotIoT dataset was run by configuring different XGBoost-related settings. XGBoost was basically created by utilizing gradient-boosted decision trees to improve the speed and performance. It represents a method for applying boost to machines, or machine boosting. A general architecture of the XGBoost algorithm is shown in Figure 4. For tree boosting algorithms, XGBoost, also known as extreme gradient boosting, which helps in making use of all the available within the specified hardware and memory resources. It offers the advantages of algorithm improvement, model tuning process, and deployment in computing with different environments. The three main gradient boosting methods—Gradient Boosting, Regularized Boosting, and Stochastic Boosting—can all be carried out by XGBoost. In contrast to other libraries, it also enables the insertion and fine-tuning of regularization parameters.

34.png

Figure 4. A general XGBoost architecture

The technique makes the best use of memory resources while being very successful at decreasing computation time. It has the special ability to execute boosting on additional data along with the trained model, which can be sparse-aware or can efficiently handle the missing values. It also provides a parallel structure for the tree construction along with several other notable features. The objective function has two parts: a training loss and a regularization. The training loss is the first portion of the objective function.

$\operatorname{obj}(\varphi)=T L(\varphi)+R(\varphi)$          (2)

In Eq. (2), R stands for the regularization term, while TL represents training loss. Simply said, the TL is a measurement of the proposed model's predictive power. Regularization helps maintain the model's complexity within desirable bounds by removing issues like data overstacking or overfitting, which may result in the model having lower accuracy. All of the trees created from the dataset are simply added together by XGBoost, who then optimizes the outcome. At each stage, XGBoost adds a tree while attempting to optimize the learned tree (training). Taylor's theorem says that, at step t, the new objective function usually has up to the second order and looks like an expansion.

$o b j^{(t)}=\sum_{i=1}^n\left[m_i f_t\left(p_i\right)+\frac{1}{2} c_i f_t^2\left(p_i\right)\right]$          (3)

where, m_i and c_i are taken as inputs.

The new tree that decides to join the model, the outcome reflects the intended optimization. In order to handle loss functions like logistic regression, XGBoost does it in this manner. To continue, regularization is crucial in determining the tree complexity defined in terms of R. Tree f(p) can be more precisely defined as:

$f_t(p)=w_q(p), w \in R^L, q: R^d \rightarrow\{1,2,3 \ldots, L\}$          (4)

In the above equation, the function q assigns leaves to the relevant data points, and w represents a vector of leaf scores (same score for data points utilizing the same leaf). The number of leaves is L. Given the intricacy of XGBoost,

$R(f)=\alpha L+\frac{1}{2} \beta \sum_{j=1}^L w_j^2$          (5)

By using the normalization equation in the theorem, it is possible to get the proposed control objective function at the step t, also known as the t^th tree. The model will represent recently upgraded tree models and also provide an assessment of the quality (p) of the tree structures. Since it's hard to compute all tree options at the same time, the regularization, leaf scores, and objective function are all calculated at each level to define the tree structure. The gain of the tree structure is calculated at each and every level by splitting the leaf into a left leaf and a right leaf. The gain value of the current leaf is calculated by applying the regularization to all potential subsequent leaves. If the benefit is less than the additional regularization value, that particular branch is severed (by using the concept also called "tree pruning"). XGBoost uses this method to classify data and explore trees in depth. The extracted features are fed into the XGBoost model. Then, during every round, we employ the weighted column method to subsample columns, allowing XGBoost to concentrate on features that can better classify attacks. As a result, this strategy may lower the impact of redundancy features while improving classification accuracy and computational resource savings. As a result, accuracy values and other parameters can be calculated.