Affiliations: [a] Department of Computer Engineering, Boroujerd Branch, Islamic Azad University, Boroujerd, Iran
| [b] Department of Computer Sciences, Amirkabir University of Technology, Tehran, Iran
| [c] Department of Computer Engineering, Ayatollah Boroujerdi University, Boroujerd, Iran
Correspondence:
[*]
Corresponding author. Mohammad Ebrahim Shiri Ahmad Abadib, Department of Computer Sciences, Amirkabir University of Technology, Tehran, Iran. Tel.: +989392065302; E-mail: shiri@aut.ac.ir.
Abstract: Today, due to increasing dependence on the internet, the tendency to make smart and the Internet of things (IoT), has risen. Also, detecting attacks, and malicious activity as well as anomalies on the internet networks, and preventing them from different layers is a necessity. In this method, a new hybrid model of IWC clustering and Random Forest methods are introduced to identify normal and abnormal conditions. It also shows unauthorized access and attacks to different layers of the Internet of Things, especially the application layer. The IWC is a clustering and improved model of the k-means method. After being tested, evaluated, and compared with previous methods, the proposed model indicates that identifying anomalies in, its data has been efficient and useful. Unlabeled data from the Intel data set IBRL is used to cluster its input data. The NSL-KDD data set is also used in the proposed method to select the best classification and identify attacks on the network.
