Machine learning based approach to intrusion detection in internet of things environments

Abstract

The growing security requirements of Internet of Things (IoT) networks where heterogeneous networks and resource-constrained devices offer exponentially increased attack surface, was addressed using machine learning based intrusion detection system. Open source secondary quantitative IoT intrusion traffic data was obtained and trained using machine learning models. The dataset comprises of over one million labeled flow records consisting of 34 kinds of attacks and benign traffic. First, extensive preprocessing including managing of missing values, encoding features, scaling, and removal of redundancy was carried out followed by the training of three supervised machine learning (ML) classifiers namely Decision Tree (DT), Random Forest (RF), and Support Vector Machine (SVM) for the differentiation of the different types of intrusions. The performance evaluation of the ML models was conducted by evaluating the accuracy, precision, and recall, and F1-score. It was observed that Decision Tree model was the most outstanding in terms of overall accuracy (99.36%) and respectable performance in prevalent attack classes, and was closely followed ccy Random Forest (99.27%) while SVM lagged behind with an accuracy of 80.08% due to computational constraints in handling massive amounts of big data. Inter-arrival time and total packet size were identified as the significant discriminators in malicious behavior through feature-importance analysis. Conclusively, the tree-based models, and specifically Decision Trees, offer extremely effective and interpretable solution for real-time IoT intrusion detection, and provide future avenues in handling class imbalance and examining lightweight, ensemble, and deep-learning approaches for robust detection of rare and unknown threats. This study contributes to cybersecurity via the identification and classification of intrusions in IoT devices for proper mitigation.