DESIGN AND IMPLEMENTATION OF A MODEL TO DETECT MITM ATTACKS IN IoT NETWORKS: A MACHINE LEARNING APPROACH

Abstract

The rapid expansion of the Internet of Things (IoT) has transformed the way smart devices communicate, monitor environments, and exchange information across various sectors, including healthcare, manufacturing, transportation, agriculture, and smart homes. Despite these benefits, IoT environments remain highly susceptible to cybersecurity threats because many connected devices possess limited computational resources, restricted memory, and minimal built-in security mechanisms. One of the most dangerous attacks targeting IoT communication is the Man-in-the-Middle (MitM) attack, where an attacker secretly intercepts communication between two legitimate devices, enabling unauthorized monitoring, manipulation, or falsification of transmitted data without the knowledge of either party.

In a typical IoT architecture, sensor nodes continuously collect environmental information such as temperature, humidity, gas concentration, and vibration levels from geographically distributed locations. These readings are transmitted to a gateway or master device, which subsequently forwards the data to cloud servers or centralized databases through wireless communication channels. Because IoT devices are generally designed to maximize energy efficiency, reduce production costs, and operate for extended periods on limited power sources, manufacturers often prioritize performance and battery life over comprehensive security. Consequently, IoT networks have become attractive targets for cybercriminals seeking to exploit communication vulnerabilities such as Address Resolution Protocol (ARP) cache poisoning, which facilitates MitM attacks.

Compromised sensor data can have severe consequences, particularly in critical infrastructures where decisions depend on accurate real-time information. Altered environmental readings may trigger false alarms, disrupt industrial automation, compromise healthcare monitoring systems, or lead to incorrect operational decisions. Therefore, developing intelligent techniques capable of identifying malicious data manipulation has become an essential requirement for improving IoT security.

The primary objective of this research is to design and implement a machine learning-based detection model capable of distinguishing legitimate sensor data from manipulated data generated during man-in-the-middle attacks. Rather than relying solely on traditional rule-based intrusion detection systems, the proposed approach leverages machine learning algorithms to identify abnormal communication patterns and classify network traffic based on behavioral characteristics.

To achieve this objective, an experimental IoT test environment was developed to simulate both normal network communication and malicious attack scenarios. The testbed consists of a NodeMCU ESP32 microcontroller serving as the central IoT gateway, integrated with multiple environmental sensors, including a DHT22 temperature and humidity sensor, an MQ-2 gas sensor, and an SW-420 vibration sensor. A wireless router provides network connectivity, enabling collected sensor data to be transmitted to the ThingSpeak cloud platform for storage and monitoring.

To simulate cyberattacks, a separate adversarial workstation was configured using a Dell Core i3 laptop running the Kali Linux operating system. The attacker system performs ARP cache poisoning to position itself between the ESP32 gateway and the wireless network. Once communication is intercepted, the attacker modifies sensor readings before forwarding them to the cloud platform, thereby mimicking a realistic man-in-the-middle attack scenario.

During the normal operational phase, sensor measurements are collected directly from the connected devices and transmitted to the cloud without modification. These records are labeled as Normal instances. In the attack phase, intercepted sensor values are deliberately altered before transmission to the cloud server. These manipulated records are labeled as attack instances, creating a balanced dataset suitable for supervised machine learning.

The collected dataset undergoes preprocessing, feature selection, and classification using the WEKA machine learning environment. Five widely used supervised learning algorithms are implemented and evaluated for their effectiveness in detecting malicious sensor data. These algorithms include Support Vector Machine (SVM), Naïve Bayes, Decision Tree, K-Nearest Neighbor (KNN), and AdaBoost. Performance evaluation is conducted using standard classification metrics such as accuracy, precision, recall, F1-score, and confusion matrix analysis.

Experimental findings demonstrate that machine learning techniques can effectively distinguish compromised sensor readings from legitimate IoT traffic. Among the evaluated algorithms, the decision tree classifier achieved the highest overall performance, recording an accuracy of 95.13%, thereby outperforming support vector machine, Naïve Bayes, K-nearest neighbor, and AdaBoost classifiers. The results indicate that decision tree models are highly effective for detecting data manipulation resulting from ARP-based man-in-the-middle attacks within IoT environments while maintaining relatively low computational complexity suitable for resource-constrained systems.

This study contributes to the growing body of knowledge in IoT cybersecurity by demonstrating the feasibility of integrating machine learning techniques into intrusion detection systems for smart environments. The proposed detection framework enhances network resilience by providing an intelligent mechanism capable of identifying malicious communication behavior before compromised data affects critical decision-making processes. Furthermore, the research provides a practical foundation for developing lightweight, scalable, and real-time security solutions that can be deployed across modern IoT infrastructures.