IoT Intrusion Detection Using Machine Learning with a Novel High Performing Feature Selection Method
Source abstract
Abstract
The Internet of Things (IoT) ecosystem has experienced significant growth in data traffic and consequently high dimensionality. Intrusion Detection Systems (IDSs) are essential self-protective tools against various cyber-attacks. However, IoT IDS systems face significant challenges due to functional and physical diversity. These IoT characteristics make exploiting all features and attributes for IDS self-protection difficult and unrealistic. This paper proposes and implements a novel feature selection and extraction approach (i.e., our method) for anomaly-based IDS. The approach begins with using two entropy-based approaches (i.e., information gain (IG) and gain ratio (GR)) to select and extract relevant features in various ratios. Then, mathematical set theory (union and intersection) is used to extract the best features. The model framework is trained and tested on the IoT intrusion dataset 2020 (IoTID20) and NSL-KDD dataset using four machine learning algorithms: Bagging, Multilayer Perception, J48, and IBk. Our approach has resulted in 11 and 28 relevant features (out of 86) using the intersection and union, respectively, on IoTID20 and resulted 15 and 25 relevant features (out of 41) using the intersection and union, respectively, on NSL-KDD. We have further compared our approach with other state-of-the-art studies. The comparison reveals that our model is superior and competent, scoring a very high 99.98% classification accuracy.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Network Security and Intrusion Detection · Advanced Malware Detection Techniques · Anomaly Detection Techniques and Applications
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
Computer Science Department, University of Idaho, Moscow, ID 83844, USA
Department of Computer Science/Cybersecurity, Princess Sumaya University for Technology (PSUT), Amman 11941, Jordan
Department of Computer Science, College of Computer, Qassim University, Buraydah 51452, Saudi Arabia
School of Electrical Engineering and Computer Science, Washington State University, Pullman, WA 99164, USA
Department of Mathematics and Computer Science, Ashland University, Ashland, OH 44805, USA
References (78)
Show source-provided references
1. Turton, W., and Mehrotra, K. (2021, October 01). Hackers breached colonial pipeline using compromised password. Available online: https://www.bloomberg.com/news/articles/2021-06-04/hackers-breached-colonial-pipeline-using-compromised-password.
2. Smadi, A.A., Ajao, B.T., Johnson, B.K., Lei, H., Chakhchoukh, Y., and Al-Haija, Q.A. (2021). A Comprehensive Survey on Cyber-Physical Smart Grid Testbed Architectures: Requirements and Challenges. Electronics, 10.10.3390/electronics10091043 ↗
3. Albulayhi, K., Smadi, A.A., Sheldon, F.T., and Abercrombie, R.K. (2021). IoT Intrusion Detection Taxonomy, Reference Architecture, and Analyses. Sensors, 21.10.3390/s21196432 ↗
4. A review on internet of things (IoT)
5. Aborujilah, A., Nassr, R.M., Al-Hadhrami, T., Husen, M.N., Ali, N.A., Al-Othmani, A., Syahela, N., and Ochiai, H. (2019). Security Assessment Model to Analysis DOS Attacks in WSN. International Conference of Reliable Information and Communication Technology, Springer.10.1007/978-3-030-33582-3_74 ↗
6. Smart agriculture using IOT: A futuristic approach
7. Device-to-device communication based IoT system: Benefits and challenges10.1080/02564602.2018.1476191 ↗
8. CISOMAG (2021, July 12). IoT Connections to Reach 83 Billion by 2024: Report. Available online: https://cisomag.eccouncil.org/iot-connections-to-reach-83-billion-by-2024-report/.
9. Comparative Study on Ant Colony Optimization (ACO) and K-Means Clustering Approaches for Jobs Scheduling and Energy Optimization Model in Internet of Things (IoT)
10. Feature selection for intrusion detection system in Internet-of-Things (IoT)10.1016/j.icte.2021.04.012 ↗
11. Albulayhi, K., and Sheldon, F.T. (2021, January 10–13). An Adaptive Deep-Ensemble Anomaly-Based Intrusion Detection System for the Internet of Things. Proceedings of the 2021 IEEE World AI IoT Congress (AIIoT), Seattle, WA, USA.10.1109/AIIoT52608.2021.9454168 ↗
12. Passban IDS: An Intelligent Anomaly-Based Intrusion Detection System for IoT Edge Devices10.1109/JIOT.2020.2970501 ↗
13. Evolutionary design of intrusion detection programs
14. Ilgun, K., and Ustat, A. (1992). A Real-Time Intrusion Detection System for Unix. [Master’s Thesis, University of California Santa Barbara].
15. Machine learning based intrusion detection systems for IoT applications10.1007/s11277-019-06986-8 ↗
16. Deep Learning: A Comprehensive Overview on Techniques, Taxonomy, Applications and Research Directions10.1007/s42979-021-00815-1 ↗
17. An Agile Approach to Identify Single and Hybrid Normalization for Enhancing Machine Learning-Based Network Intrusion Detection10.1109/ACCESS.2021.3118361 ↗
18. A Novel Attack Detection Scheme for the Industrial Internet of Things Using a Lightweight Random Neural Network10.1109/ACCESS.2020.2994079 ↗
19. Heigl, M., Weigelt, E., Fiala, D., and Schramm, M. (2021). Unsupervised Feature Selection for Outlier Detection on Streaming Data to Enhance Network Security. Appl. Sci., 11.10.3390/app112412073 ↗
20. Deep Cybersecurity: A Comprehensive Overview from Neural Network and Deep Learning Perspective10.1007/s42979-021-00535-6 ↗
21. Balogh, S., Gallo, O., Ploszek, R., Špaček, P., and Zajac, P. (2021). IoT Security Challenges: Cloud and Blockchain, Postquantum Cryptography, and Evolutionary Techniques. Electronics, 10.10.3390/electronics10212647 ↗
22. Alrubayyi, H., Goteng, G., Jaber, M., and Kelly, J. (2021). Challenges of Malware Detection in the IoT and a Review of Artificial Immune System Approaches. J. Sens. Actuator Networks, 10.10.3390/jsan10040061 ↗
23. Building an Intrusion Detection System Using a Filter-Based Feature Selection Algorithm10.1109/TC.2016.2519914 ↗
24. Mutual information-based feature selection for intrusion detection systems10.1016/j.jnca.2011.01.002 ↗
25. Sung, A.H., and Mukkamala, S. (2003, January 27–31). Identifying important features for intrusion detection using support vector machines and neural networks. Proceedings of the 2003 Symposium on Applications and the Internet, Orlando, FL, USA.
26. Jose, S., Malathi, D., Reddy, B., and Jayaseeli, D. (2018). A Survey on anomaly-based host intrusion detection system. Journal of Physics: Conference Series, IOP Publishing.10.1088/1742-6596/1000/1/012049 ↗
27. Survey of intrusion detection systems: Techniques, datasets and challenges10.1186/s42400-019-0038-7 ↗
28. Biesiada, J., and Duch, W. (2007). Feature Selection for High-Dimensional Data—A Pearson Redundancy Based Filter, in Computer Recognition Systems 2, Springer.10.1007/978-3-540-75175-5_30 ↗
29. Jin, X., Xu, A., Bie, R., and Guo, P. (2006). Machine learning techniques and chi-square feature selection for cancer classification using SAGE gene expression profiles. International Workshop on Data Mining for Biomedical Application, Springer.10.1007/11691730_11 ↗
30. Thang, N.D., and Lee, Y.-K. (2010, January 19–23). An improved maximum relevance and minimum redundancy feature selection algorithm based on normalized mutual information. Proceedings of the 2010 10th IEEE/IPSJ International Symposium on Applications and the Internet, Seoul, Korea.
31. Normalized Mutual Information Feature Selection10.1109/TNN.2008.2005601 ↗
32. Feature selection based on mutual information criteria of max-dependency, max-relevance, and min-redundancy10.1109/TPAMI.2005.159 ↗
33. Input feature selection by mutual information based on Parzen window10.1109/TPAMI.2002.1114861 ↗
34. Wrappers for feature subset selection10.1016/S0004-3702(97)00043-X ↗
35. Osman, H., Ghafari, M., and Nierstrasz, O. (2017, January 21). Automatic feature selection by regularization to improve bug prediction accuracy. Proceedings of the 2017 IEEE Workshop on Machine Learning Techniques for Software Quality Evaluation (MaLTeSQuE), Klagenfurt, Austria.10.1109/MALTESQUE.2017.7882013 ↗
36. Induction of decision trees10.1007/BF00116251 ↗
37. Han, J., Pei, J., and Kamber, M. (2011). Data Mining: Concepts and Techniques, Elsevier.
38. Abu Al-Haija, Q., and Zein-Sabatto, S. (2020). An Efficient Deep-Learning-Based Detection and Classification System for Cyber-Attacks in IoT Communication Networks. Electronics, 9.10.20944/preprints202011.0508.v2 ↗
39. Bendiab, G., Shiaeles, S., Alruban, A., and Kolokotronis, N. (2020, January 29–31). IoT Malware Network Traffic Classification using Visual Representation and Deep Learning. Proceedings of the 2020 6th IEEE Conference on Network Softwarization (NetSoft), Ghent, Belgium.10.1109/NetSoft48620.2020.9165381 ↗
40. AAbu Al-Haija, Q., McCurry, C.D., and Zein-Sabatto, S. (2021). Intelligent Self-reliant Cyber-Attacks Detection and Classification System for IoT Communication Using Deep Convolutional Neural Network. Selected Papers from the 12th International Networking Conference, Rhodes, Greece, 19–21 September 2020, Springer.10.1007/978-3-030-64758-2_8 ↗
41. Taher, K.A., Jisan, B.M.Y., and Rahman, M. (2019, January 10–12). Network intrusion detection using supervised machine learning technique with feature selection. Proceedings of the 2019 International Conference on Robotics, Electrical and Signal Processing Techniques (ICREST), Dhaka, Bangladesh.10.1109/ICREST.2019.8644161 ↗
42. An Adaptive Ensemble Machine Learning Model for Intrusion Detection10.1109/ACCESS.2019.2923640 ↗
43. Sapre, S., Ahmadi, P., and Islam, K. (2019). A robust comparison of the KDDCup99 and NSL-KDD IoT network intrusion detection datasets through various machine learning algorithms. arXiv.
44. Chowdhury MM, U., Hammond, F., Konowicz, G., Xin, C., Wu, H., and Li, J. (2017, January 19–21). A few-shot deep learning approach for improved intrusion detection. Proceedings of the 2017 IEEE 8th Annual Ubiquitous Computing, Electronics and Mobile Communication Conference (UEMCON), New York, NY, USA.10.1109/UEMCON.2017.8249084 ↗
45. Javaid, A., Niyaz, Q., Sun, W., and Alam, M. (2015, January 3–5). A Deep Learning Approach for Network Intrusion Detection System. In Proceedings of the 9th EAI International Conference on Bio-inspired Information and Communications Technologies (formerly BIONETICS), New York, NY, USA.10.4108/eai.3-12-2015.2262516 ↗
46. Imamverdiyev, Y., and Sukhostat, L. (2016, January 12–14). Anomaly detection in network traffic using extreme learning machine. Proceedings of the 2016 IEEE 10th International Conference on Application of Information and Communication Technologies (AICT), Baku, Azerbaijan.10.1109/ICAICT.2016.7991732 ↗
47. Machine Learning Based Model to Identify Firewall Decisions to Improve Cyber-Defense10.18517/ijaseit.11.4.14608 ↗
48. CANN: An intrusion detection system based on combining cluster centers and nearest neighbors10.1016/j.knosys.2015.01.009 ↗
49. A GA-LR wrapper approach for feature selection in network intrusion detection10.1016/j.cose.2017.06.005 ↗
50. A feature reduced intrusion detection system using ANN classifier10.1016/j.eswa.2017.07.005 ↗
51. Decision tree based light weight intrusion detection using a wrapper approach10.1016/j.eswa.2011.06.013 ↗
52. Building lightweight intrusion detection system using wrapper-based feature selection mechanisms10.1016/j.cose.2009.01.001 ↗
53. Ullah, I., and Mahmoud, Q.H. (2020). A Scheme for Generating a Dataset for Anomalous Activity Detection in IoT Networks, Springer International Publishing.10.1109/SMC42975.2020.9283220 ↗
54. Qaddoura, R., Al-Zoubi, A.M., Almomani, I., and Faris, H. (2021). A Multi-Stage Classification Approach for IoT Intrusion Detection Based on Clustering with Oversampling. Appl. Sci., 11.10.3390/app11073022 ↗
55. A Lightweight Concept Drift Detection and Adaptation Framework for IoT Data Streams10.1109/IOTM.0001.2100012 ↗
56. IoT Network Attack Detection using Supervised Machine Learning
57. Abe, N., and Kudo, M. (2005). Entropy criterion for classifier-independent feature selection. International Conference on Knowledge-Based and Intelligent Information and Engineering System, Springer.10.1007/11554028_96 ↗
58. Ukil, A., Sen, J., and Koilakonda, S. (2011, January 4–5). Embedded security for Internet of Things. Proceedings of the 2011 2nd National Conference on Emerging Trends and Applications in Computer Science, Shillong, India.10.1109/NCETACS.2011.5751382 ↗
59. Soldatos, J. (2020). A 360-Degree View of IoT Technologies, Artech House.
60. Siddiqi, M.A., and Pak, W. (2020). Optimizing Filter-Based Feature Selection Method Flow for Intrusion Detection System. Electronics, 9.10.3390/electronics9122114 ↗
61. Cybersecurity, C.I.f. (2022, April 21). Available online: https://www.unb.ca/cic/datasets/nsl.html.
62. Kang, H., Ahn, D.H., Lee, G.M., Yoo, J.D., Park, K.H., and Kim, H.K. (2022, February 02). IOT Network Intrusion Dataset. Available online: https://ieee-dataport.org/open-access/iot-network-intrusion-dataset.
63. Data mining: Practical machine learning tools and techniques with Java implementations10.1145/507338.507355 ↗
64. Chu, W.-L., Lin, C.-J., and Chang, K.-N. (2019). Detection and Classification of Advanced Persistent Threats and Attacks Using the Support Vector Machine. Appl. Sci., 9.10.3390/app9214579 ↗
65. Cyberattack and Fraud Detection Using Ensemble Stacking10.3390/ai3010002 ↗
66. Carrera, F., Dentamaro, V., Galantucci, S., Iannacone, A., Impedovo, D., and Pirlo, G. (2022). Combining Unsupervised Approaches for Near Real-Time Network Traffic Anomaly Detection. Appl. Sci., 12.10.3390/app12031759 ↗
67. Iliyasu, A.S., Abdurrahman, U.A., and Zheng, L. (2022). Few-Shot Network Intrusion Detection Using Discriminative Representation Learning with Supervised Autoencoder. Appl. Sci., 12.10.3390/app12052351 ↗
68. Cao, B., Li, C., Song, Y., Qin, Y., and Chen, C. (2022). Network Intrusion Detection Model Based on CNN and GRU. Appl. Sci., 12.10.3390/app12094184 ↗
69. Fu, Y., Du, Y., Cao, Z., Li, Q., and Xiang, W. (2022). A Deep Learning Model for Network Intrusion Detection with Imbalanced Data. Electronics, 11.10.3390/electronics11060898 ↗
70. Kareem, S.S., Mostafa, R.R., Hashim, F.A., and El-Bakry, H.M. (2022). An Effective Feature Selection Model Using Hybrid Metaheuristic Algorithms for IoT Intrusion Detection. Sensors, 22.10.3390/s22041396 ↗
71. A Double-Layered Hybrid Approach for Network Intrusion Detection System Using Combined Naive Bayes and SVM10.1109/ACCESS.2021.3118573 ↗
72. Imrana, Y., Xiang, Y., Ali, L., Abdul-Rauf, Z., Hu, Y.C., Kadry, S., and Lim, S. (2022). χ 2-BidLSTM: A Feature Driven Intrusion Detection System Based on χ 2 Statistical Model and Bidirectional LSTM. Sensors, 22.10.3390/s22052018 ↗
73. Pervez, M.S., and Farid, D.M. (2014, January 18–20). Feature selection and intrusion classification in NSL-KDD cup 99 dataset employing SVMs. Proceedings of the 8th International Conference on Software, Knowledge, Information Management and Applications (SKIMA 2014), Dhaka, Bangladesh.10.1109/SKIMA.2014.7083539 ↗
74. Ingre, B., and Yadav, A. (2015, January 2–3). Performance analysis of NSL-KDD dataset using ANN. Proceedings of the 2015 international conference on signal processing and communication engineering systems, Vijayawada, India.10.1109/SPACES.2015.7058223 ↗
75. Qaddoura, R., Al-Zoubi, M., Faris, H., and Almomani, I. (2021). A Multi-Layer Classification Approach for Intrusion Detection in IoT Networks Based on Deep Learning. Sensors, 21.10.3390/s21092987 ↗
76. Song, Y., Hyun, S., and Cheong, Y.-G. (2021). Analysis of Autoencoders for Network Intrusion Detection. Sensors, 21.10.3390/s21134294 ↗
77. Enhancement performance of random forest algorithm via one hot encoding for IoT IDS
78. Two-step ensemble approach for intrusion detection and identification in IoT and fog computing environments10.1016/j.compeleceng.2022.107694 ↗