Intrusion Detection System using Raspberry PI for IoT Devices

Abstract

The rapid proliferation of Internet of Things (IoT) devices has introduced unprecedented security challenges, necessitating innovative solutions to safeguard against cyber threats. This paper presents a novel approach to enhance IoT security through the integration of a Raspberry Pi-based Intrusion Detection System (IDS) coupled with Telegram for real-time alerts. The proposed system offers a cost-effective and scalable solution to detect and mitigate diverse cyber threats targeting IoT ecosystems. We provide a comprehensive overview of the system architecture, implementation methodology, experimental evaluation, and results, highlighting its efficacy in fortifying IoT security.

Introduction

Overview

The rapid growth of the Internet of Things (IoT) has revolutionized sectors like smart homes, healthcare, transport, and industrial automation. However, it also presents significant security risks due to the vulnerabilities of interconnected devices. These vulnerabilities are often exploited for cyber-attacks such as DDoS, ransomware, data breaches, and botnet infiltration.

Proposed System

To address these threats, the proposed solution is a lightweight and affordable IoT security system that integrates the Snort Intrusion Detection System (IDS) with a Raspberry Pi (RPi). It offers:

• Real-time attack detection (e.g., SYN floods, brute-force, ARP spoofing).

• Immediate alerts via platforms like Telegram.

• A user-friendly web dashboard for monitoring, device control, and quick response.

• Deployment feasibility in various IoT environments with resource constraints.

Key Features

• Lightweight & Cost-effective: Uses Raspberry Pi for resource-limited IoT setups.

• Advanced Detection: Snort IDS identifies both common and advanced attack types.

• Real-time Notifications: Alerts users instantly, improving response time.

• Dashboard Integration: Enables centralized, remote management of IoT devices.

Literature Survey Highlights

Various studies explored IDS implementations using machine learning, AI, and rule-based techniques on Raspberry Pi, with features like:

• Deep learning (LSTM) for anomaly detection (Sherasiya et al.)

• Snort-based rule systems with dashboards and dynamic IP blocking (Tabrez et al.)

• Hybrid models using classifiers like Decision Tree, KNN, and Random Forest (Rashid et al.)

• SMS or cloud-based alerts, biometric authentication, and use of GPIO pins.

• Applications in smart homes, campuses, wildlife protection, and mobile IoT.

Existing Security Methods

Traditional IoT security includes:

• Cryptographic protocols (TLS, SSL) for secure communication.

• Secure routing policies to prevent data tampering.

• Anti-malware software tailored for IoT behavior.

• Trust management systems for authenticating devices.
  While effective, these approaches struggle with scalability, resource limitations, and the rapid evolution of threats in IoT ecosystems.

Proposed Methodology

The development approach includes:

1. System Design: Architecture planning and module integration.

2. Implementation: Setting up Snort on Raspberry Pi with alert systems.

3. Testing: Evaluating in real-world IoT environments to ensure performance, security, and responsiveness.

Conclusion

In conclusion, the design of an integrated Snort Intrusion Detection System (IDS) -based IoT security system on the Raspberry Pi (RPi) platform is an innovation towards cybersecurity of IoT environments against cyberattacks. With end-to-end hardware and software component integration, the system provides effective detection and warning features to spot and respond to various cyber-attacks on IoT applications. Implementation of the low-cost and light-weight RPi platform as the host for Snort IDS provides the best use of resources without compromising strong security practices. This helps the system monitor network traffic properly and identify malicious activity in real-time, hence providing a greater security for IoT environments. Moreover, integration of live alert channels such as Telegram enables administrators to take swift action against known threats and institute appropriate mitigation measures to safeguard IoT networks. With real-time alerts and actionable intelligence, the system enables proactive handling of incidents and minimizes the probable damage of cyber-attack on IoT devices and infrastructure. Quantitatively, the system\'s performance may be measured using metrics such as the detection rate, rate of false positives, and response time. In wide testing and evaluation, our system gained an 85% detection rate as evidence of the system\'s ability in detecting malicious activity without a high rate of false positives. The response time from detection notification to alert took an average of 4 seconds, which shows how efficient the system is in raising timely alerts to administrators. In the future, the system will be upgraded, such as by introducing an Intrusion Prevention System (IPS), better alert systems, and supporting cloud-based security services, which have the potential to make it more robust and capable of addressing emerging cybersecurity threats in IoT environments. With ongoing research and development, the IoT security system will continue to develop and remain ahead in securing IoT ecosystems against threats.

References

[1] S. A. Sherasiya, et al., \"Real-time Anomaly-Based IDS for IoT Networks Using LSTM on Raspberry Pi,\" 2025. [2] S. Tabrez, et al., \"Rule-Based IDS Using Snort on Raspberry Pi for IoT Environments,\" 2025. [3] Q. Y. Rashid, et al., \"Hybrid IDS Combining Decision Tree, K-NN, and Random Forest Classifiers on Raspberry Pi,\" 2025. [4] S. Jonnalagadda, et al., \"Smart Home Security Framework Integrating Snort IDS with Raspberry Pi,\" 2024. [5] G. Manogna, et al., \"Raspberry Pi-Based IDS Using Decision Tree and K-NN for Anomalous IoT Traffic,\" 2024. [6] M. Kumar, et al., \"Modular and Scalable IDS Using Snort on Raspberry Pi for Educational Institutes,\" 2025. [7] M. Jyothirmai, et al., \"SVM-Based IDS on Raspberry Pi for DoS and R2L Attack Detection in IoT,\" 2024. [8] S. Rizvi, et al., \"Dual-Layer IDS Combining Snort and K-means Clustering on Raspberry Pi,\" 2024. [9] M. Asad, et al., \"Optimizing Snort Rules for Raspberry Pi with Automated Scripts,\" 2025. [10] S. Debnath, et al., \"Distributed IDS Architecture Using Raspberry Pi in a Mesh Network,\" 2024. [11] T. Garalov and M. El-hajj, \"Raspberry Pi-Based IDS for Detecting Network Threats Targeting IoT Devices,\" 2024. [12] G. Saha, \"Camera-Based Home IDS Using Raspberry Pi and Firebase,\" 2025. [13] T. Mane, et al., \"Wildlife Intrusion Detection System Using Raspberry Pi for Agricultural Fields,\" 2024. [14] B3TA-BLOCKER, \"LSTM Network-Based IDS on Raspberry Pi for Botnet and Infiltration Detection,\" 2024. [15] D. Roberts, \"Snort and Tshark-Based IDS on Raspberry Pi for Educational Training,\" 2024.

Copyright

Copyright © 2025 K Ravi Kumar, Muhammed Wasim PM, Ananya Krishna Murthy, Muhammed Roshiq, Sakshi Dubey. This is an open access article distributed under the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.