A Novel Multi Algorithm Approach to Identify Network Anomalies in the IoT Using Fog Computing and a Model to Distinguish between IoT and Non-IoT Devices

Botnet attacks, such as DDoS, are one of the most common types attacks in IoT networks. A botnet is a collection cooperated computing machines or Internet Things gadgets that criminal users manage remotely. Several strategies have been developed to reduce anomalies networks, DDoS. To increase accuracy anomaly mitigation system and lower false positive rate (FPR), some schemes use statistical machine learning methodologies anomaly-based intrusion detection (IDS) mitigate an attack. Despite proposed techniques, DDoS networks remains concern. Because similarity between normal network flows, leading problems high FPR, low accuracy, rate, majority methods fail. Furthermore, limited resources devices make it difficult implement techniques. In this paper, efficient has for through design implementation attack uses method combines three algorithms: exponentially weighted moving average (EWMA), K-nearest neighbors (KNN), cumulative sum algorithm (CUSUM). The integration fog with created effective framework implementing strategy address security issues threats. module was evaluated using Bot-IoT dataset. From results, we conclude our model achieved (99.00%) (FPR). We also good results distinguishing non-IoT devices, which will help networking teams distinction well.