Fine tuned multi-attack recognizer system of IoT computing environments

doi:10.21203/rs.3.rs-3745498/v1

Download PDF

Research Article

Fine tuned multi-attack recognizer system of IoT computing environments

https://doi.org/10.21203/rs.3.rs-3745498/v1

This work is licensed under a CC BY 4.0 License

Version 1

posted

You are reading this latest preprint version

In the present era, there has been a swift global proliferation of Internet of Things (IoT) applications, driven by their ability to enhance various facets of business operations, industry, and daily routines. Nonetheless, these IoT devices remain vulnerable to malicious network activity, posing a risk of detrimental outcomes and disruptions to their functionality. As a result, it is imperative to devise a screening method for network traffic that can effectively identify and categorize such malicious behavior, thereby reducing its adverse effects. This paper introduces an intrusion detection system designed for IoT environments, utilizing the extensive IoTID20 dataset, comprising 83 features and three class labels. The first label distinguishes between normal network traffic and potential anomalies, while the second classifies anomaly traffic into four distinct categories, including Mirai, denial of service (DoS) attack, Scan attack, and man-in-the-middle (MITM) attacks. Further refinement is achieved with the third-class label, which provides additional granularity, categorizing Mirai attacks into specific types like Ackflooding, HTTP Flooding, Hostbruteforceg, and UDP Flooding, and similarly, differentiating Scan attacks into port-based classifications. The methodology employed involves a systematic approach, encompassing critical stages such as data preprocessing, feature selection, hyperparameter optimization, and classification. Notably, data preprocessing plays a pivotal role in enhancing dataset integrity by removing identifier features, handling null values, and addressing noisy feature distributions. This process led to a streamlined feature set of 67, paving the way for subsequent feature selection techniques. Correlation coefficient, particle swarm optimization (PSO), and grey wolf optimization (GWO) feature selection methods were thoughtfully integrated, resulting in a refined feature subset of 17, 16, and 22 features for label, category, and subcategory, respectively. A strategic commonality approach further condensed this feature set to just four key features - 'Bwd_Seg_Size_Avg', 'Pkt_Len_Var', 'Src_Port', and 'Dst_Port'. The system's efficacy was further bolstered through the utilization of CHIO for fine-tuning the decision tree model, resulting in promising accuracy rates of 99.96%, 99.56%, and 77.6% for label, category, and subcategory classification, respectively. This comprehensive system showcases exceptional potential in fortifying IoT network security against a spectrum of potential threats.

Intrusion Detection System

Internet of Things

Particle Swarm Optimization

Grey Wolf Optimization

Coronavirus Herd Immunity Optimizer

In today's internet-driven world, trends appear to be evolving due to the emergence of smart objects capable of generating and transmitting data over the internet, much like humans. The Internet of Things (IoT) is the newest technologies and applications that can transform our way of life. IoT is widespread and used in nearly all parts of our lives. Governments worldwide use the IoT to gather data from several sectors and enhance initiatives pertaining to security, development, governance, and health (Alghuried 2017).

On a global scale, the adoption of IoT has seen a significant surge in recent times. In 2017, the count of interconnected IoT devices exceeded 27 billion, and this number is anticipated to escalate rapidly due to market demands, potentially reaching around 125 billion by 2030 (Graham 2017). Hostile actors are increasingly focusing on critical infrastructures like smart cities and electricity transmission systems. If these facilities remain susceptible to cyber-attacks, there could be grave consequences in the future. Consequently, safeguarding equipment from malicious activities has become a crucial and urgent endeavor, as such intrusions can present severe risks.

Intrusion detection systems (IDS) are instruments employed in information systems to monitor for recognized threats or unusual activities. These IDS can take the form of network-based or host-based systems. Firewalls are implemented to provide protection for computers against potential risks originating from network-based attacks or end-users. The network in question may be applicable to an IoT network, whereby an IoT system, such as sensing equipment, might operate as an end-user device. Furthermore, IDS may be seen in the form of an integrated hardware and software solution (Steinberg 2015). Additionally, there are two distinct approaches for detecting: signature-based detection and anomaly-based detection. Signature-based detection systems have shown efficacy in the identification of known attacks via the examination of network traffic or computer memory data for predetermined patterns. Anomaly-based detection is a method used for the purpose of identifying unfamiliar dangers by the continuous monitoring of the behaviors shown by the whole system, objects, or traffic. This monitoring process involves comparing the observed behavior with a pre-established standard of behavior that is considered to be normal. Any separation from a normal operation is known as a possible attack (A Survey on IPS Methods and Techniques 2016).

In light of the increasing proficiency of malicious actors and the proliferation of zero-day attacks, an anomaly-based intrusion detection system (IDS) is considered highly suitable for the current security environment (I. Ullah and Mahmoud 2020). Anomaly-based IDS use the functionalities of artificial intelligence (AI) and machine learning (ML) to detect deviations from normal patterns. The underlying principle of AI and ML is to enable a machine to learn autonomously and distinguish between normal and abnormal system activities (Buczak and Guven 2016).

IoT network cybersecurity involves safeguarding IoT devices and networks from cyber threats, including attacks, unauthorized access, data tampering, and network data breaches. Just like traditional communication networks, every IoT network necessitates three essential security components: availability, integrity, and confidentiality (Mohamad Noor and Hassan 2019). However, these aspects can be compromised by intrusions within the network. The advent of IoT brings a host of security challenges, primarily driven by malicious network attacks. According to the statistics provided by Kaspersky Lab, during the second quarter of 2018, a total of 962 million unauthorized intrusions were documented across 187 countries. This data reveals a consistent increase trajectory in the occurrence of such intrusions. Furthermore, the proliferation of mobile networking has contributed to the escalating severity of the issue by causing a surge in cyber-attacks targeting mobile devices, which have shown an erratic pattern of expansion (Gao et al. 2019).

An IDS is a widely utilized tool for identifying vulnerabilities in networks. Many IDSs employ efficient machine-learning algorithms for attack detection (Lima Filho et al. 2019). However, when combining various methods into a single system, the limitations of each approach can become significant. This research is primarily driven by the goal of creating an IDS capable of predicting potential attacks within the high volumes of traffic entering IoT networks, utilizing various machine-learning methods. Additionally, we intend to safeguard these diverse devices, which often have constrained resources, by taking into account performance metrics, real-time system support, and necessary training time (Otoum 2022).

This study presents a novel intrusion detection system designed specifically for IoT scenarios. The system offers many notable contributions.

Using IoTID20 dataset, comprising 83 features and three class labels, enables the categorization of network traffic as either typical or probable irregularities. Further categorization of anomaly traffic into four distinct types: man-in-the-middle (MITM), Mirai, Scan, and denial of service (DoS) attacks. Further granularity in categorization, distinguishing specific types within Mirai and Scan attacks.
Employed a systematic methodology involving critical stages: data preprocessing, feature selection, hyperparameter optimization, and classification.
Effective data preprocessing for enhanced dataset integrity, involving removal of identifier features, handling null values, and addressing noisy feature distributions. This step streamlined feature set of 67 after data preprocessing.
Integration of three feature selection techniques (Grey Wolf Optimization (GWO), correlation coefficient, an Particle Swarm Optimization (PSO)), resulting in refined feature subsets for label, category, and subcategory. Further strategic commonality approach further condensed feature set to four key features.
Utilization of Coronavirus Herd Immunity Optimizer (CHIO) for fine-tuning the decision tree model, enhancing system efficacy. Achieved promising accuracy rates for label, category, and subcategory classification.

The subsequent sections of this study are structured as follows: the second part presents an overview of the relevant literature for intrusion detection system and provides a comparative summary of them. The third section provides an explanation of IoTID20 dataset and the methodology steps in detail. The fourth section provides the experimental results of the study, the evaluation of it and a discussion on these results. Last section concludes the study.

Related Work

In their study, Qaddoura et al. (Qaddoura et al. 2021) introduced a three-step strategy that incorporates a clustering with reduction stage, an oversampling stage, and a classification using a Single Hidden Layer Feed-Forward Neural Network (SLFN). During the first phase, the training data undergoes k-means clustering to generate three distinct clusters. Subsequently, a reduction of 10% is applied to the clusters, followed by an aggregation of the three resulting reduced clusters. In the subsequent phase, the aggregated data is oversampled using the SVM-SMOTE oversampling approach, using an oversampling ratio of 0.9. The third step involves the creation of a classification model for the oversampled data using the SLFN classification approach. The evaluation of the proposed model using the testing data achieved 93.51% accuracy and 94.53% G-mean on IoT Intrusion Dataset 2020 (IoTID20).

Alkahtani and Aldhyani (Alkahtani and Aldhyani 2021) employed three advanced deep learning algorithms for intrusion classification on the IoTID20 dataset: a long short-term memory (LSTM), a convolutional neural network (CNN), and a hybrid CNN with LSTM (CNN-LSTM) model. Dimensionality reduction was used to decrease the complexity of the network dataset. In order to improve the system's performance, the particle swarm optimization approach (PSO) was used to identify relevant characteristics from the dataset. The aforementioned characteristics were subjected to processing using deep learning techniques. The experimental findings revealed the accuracy of the system as CNN = 96.60%, LSTM = 99.82%, and CNN-LSTM = 98.80%.

In their study, Song et al. (Song, Hyun, and Cheong 2021) performed an evaluation using a stacked autoencoder model, employing several configurations of the model. The empirical results obtained from three distinct datasets, namely NSL-KDD, IoTID20, and N-BaIoT, collected from both traditional and IoT networks, have shown that the performance of the Network Intrusion Detection System (NIDS) is influenced by the model's capacity and latent size. The stacked autoencoder models used in our study had the greatest F1-score of 0.895 when evaluated using the NSL-KDD dataset.

Reddy et al. (Reddy et al. 2021) introduced a network intrusion detection system utilizing the Gradient Boosting ensemble method. The purpose of this system is to facilitate the deployment of devices in fog nodes, with the primary objective of promptly and accurately detecting malicious activity to protect critical infrastructure. A thorough investigation was carried out to ascertain the most suitable learning parameters for machine learning classifiers using the IoTID20 dataset. The present work included conducting an experimental investigation and subsequent examination of the outcomes obtained via the use of the XGBoost algorithm in modeling. The findings of this study indicate that this strategy has considerable potential in the field of intrusion detection, outperforming other ML techniques in attack categorization. In binary classification, all models exhibited high accuracy of over 98% in distinguishing normal behavior from anomalies. In the context of multi-classification, the algorithms RF, DT, Bagging, GB, and XGBoost demonstrated a noteworthy overall accuracy of 99% when considering the target feature (Category). XGBoost demonstrated a classification accuracy of 82% for the target feature (SubCategory), accurately categorizing instances associated with Scan-Host Port, Scan-Port OS, and Mirai-Host Brute Force.

In their study, Lahasan et al. (Lahasan and Samma 2022) used a two-layer optimization strategy to enhance the performance of a simplified deep autoencoder model. The process included the concurrent selection of input characteristics, training instances, and the number of hidden neurons. The development of the revised deep model was influenced by two key factors: the performance of a K-nearest neighbor (KNN) classifier in terms of accuracy, and the complexity of the autoencoder model. In order to evaluate its efficacy, the improved model underwent testing using the N-baiot intrusion detection dataset. The data given indicate that the suggested model attained a noteworthy accuracy of 99% in detecting anomalies. The task was successfully completed by using a streamlined autoencoder model that included an average of around 30 input characteristics and a mere 2 output hidden neurons. Also, the proposed approach is tested against IoTID20 dataset and achieved 98.12% accuracy with 25 input features.

Ullah et al. (S. Ullah et al. 2022) introduced an IDS based on a deep convolutional neural network (DCNN). The architecture of the DCNN consists of two convolutional layers and three fully linked dense layers. The purpose of developing the model was to optimize performance while limiting the use of computing resources. The IoTID20 dataset was used for conducting experimental assessments. The performance evaluation of the suggested model exhibited noteworthy outcomes, achieving accuracies of 99.84% for binary classification, 98.12% for category classification, and 77.55% for sub-category classification.

The authors Alsulami et al. (Alsulami et al. 2022) proposed a predictive machine learning model that was specifically developed for the purpose of identifying and classifying network activity in an IoT system. The model provides a clear differentiation between typical and irregular network activity, effectively categorizing network traffic into five discrete groups: normal, Mirai assault, DoS attack, Scan attack, and MITM attack. In order to assess the effectiveness of identifying and categorizing network activities in IoT systems, a total of five supervised learning models were used. These models included decision trees (DT), k-nearest neighbor (kNN), shallow neural networks (SNN), support vector machine (SVM), and bagging trees (BT). The evaluation of the models was conducted using a vast dataset of IoT assaults known as the IoTID20 dataset. Furthermore, a comprehensive feature engineering methodology was used to augment the precision of the machine learning models. The experimental findings exhibited a perfect detection accuracy of 100% across all applied models, along with a classification accuracy that varied between 99.4% and 99.9%.

Krishnan et al. (Krishnan, Neyaz, and Liu 2021) employed three different feature selection methods (Sequential Forward Processing, Recursive Feature Elimination (RFE), Sequential Backward Processing) and implemented three different classficiation techniques (SVC, Random Forest, and XGBoost) for each selection method. They first preprocessed the IoTID20 datasets by removing duplicate, correlated, constant and quasi constant features. The dataset had 33 features after preprocessing from the original 83 features. Then feature selection is used and selected 8 features out of the 33. Then three classification techniques are used and achieved good results. This suggests that these methodologies may be used to anticipate a potential assault on IoT devices inside a supervised learning framework.

The authors Fatani et al. (Fatani et al. 2022) proposed a novel approach to feature engineering in the context of IDS, which integrates the benefits of swarm intelligence (SI) methodologies. In order to evaluate the efficacy of this IDS approach, four well recognized public datasets, namely KDD99, CIC2017, BoT-IoT, and NSL-KDD, were used for testing purposes. In their study, Keserwani et al. (Keserwani et al. 2021) introduced a methodology aimed at collecting essential information from Internet of Things (IoT) networks to enhance intrusion detection capabilities. The proposed methodology integrates the GWO algorithm with the PSO algorithm. The performance of this technique was assessed by the researchers using three datasets: CICIDS-2017, NSL-KDD, and KDDCup99.

Table 1 shows a comparison between the related work in terms of the used technique and the achieved accuracy.

Table 1

Related Work Summary
Study	Technique	Accuracy
Qaddoura et al., 2021	k-means-SLFN-SVM-SMOTE	93.51%
Alkahtani and Aldhyani, 2021	CNN, LSTM, CNN-LSTM	LSTM = 99.82%, CNN = 96.60%, CNN-LSTM = 98.80%.
Song et al., 2021	stacked autoencoder	95.2%
Reddy et al., 2021	RF, DT, Bagging, GB, and XGBoost	99%
Lahasan et al., 2022	deep autoencoder with kNN	98.12%
Ullah et al., 2022	CNN	99.84% binary, 98.12% category, and 77.55% sub-category
Alsulami et al., 2022	DT, Bagging, ANN, kNN and SVM	99.4–99.9%
Krishnan et al., 2021	SVC, Random Forest, and XGBoost	N/A
Fatani et al., 2022	swarm intelligence with CNN	99% binary and category

IoTID20 Dataset

The testbed used for the IoTID-20 dataset (I. Ullah and Mahmoud 2020) comprises a confluence of networked infrastructures and IoT devices. A conventional smart home setting has been established, using the EZVIZ Wi-Fi camera and SKT NGU for the purpose of creating the IoTID-20 dataset. Figure 4.1 presents a comprehensive depiction of the testbed setup for the IoTID-20 dataset. The two IoT devices are linked to the WiFi routers of the smart home. Furthermore, the smart home router is also responsible for connecting many other devices, such as tablets, laptops, and smartphones. The EZVIZ Wi-Fi camera and SKT NGU are used as victim devices inside the IoTID-20 dataset testbed, whilst the other devices are specifically identified as attacker devices. The IoTID-20 dataset was recently produced and obtained from Pcap files accessible on the Internet (I. Ullah and Mahmoud 2020).

The researchers used the CIC-flowmeter program (Lashkari et al. 2017) to extract relevant characteristics from the Pcap files and produce the IoTID-20 dataset in CSV format. The subsequent step involved labeling each instance within the IoTID-20 dataset. The dataset comprises 83 attributes and 625,783 instances. It includes labels for intrusion detection, category, and subcategory. Table 2 presents a comprehensive summary of the binary, class, and sub-class labels included inside the IoTID20 dataset.

Table 2

Binary, category, and sub-category of IoTID20 Dataset
Binary	Category	Subcategory
Normal	Normal	Normal
Anomaly	DoS	DoS-Synflooding
	Mirai	Mirai-UDP Flooding Mirai-Hostbruteforceg Mirai-HTTP Flooding Mirai-Ackflooding
	MITM	MITM ARP Spoofing
	Scan	Scan Host Port Scan OS Port

The distribution of dataset records between normal and invasive procedures is shown in Table 3. The proliferation of more formidable threats has resulted in an increased susceptibility of IoT devices to security breaches. The dataset consisted of many harmful actions, including DoS, MITM, Distributed Denial of Service (DDoS), and active scanning, which were identified and monitored as the most often seen.

Table 3

Normal and attacked instances in IoTID20 Dataset
Subcategory	Count
Normal	40073
DoS-Synflooding	59391
Mirai-UDP Flooding Mirai-Hostbruteforceg Mirai-HTTP Flooding Mirai-Ackflooding	183554 121181 55818 55124
MITM ARP Spoofing	35377
Scan Host Port Scan OS Port	22192 53073

The IoTID-20 dataset offers a significant advantage by mirroring a contemporary trend in IoT networks. This dataset is notable for being one of the limited numbers of publicly accessible datasets specifically designed for IoT intrusion detection. The present study focuses on a specific kind of DoS attack (Cloudflare 2022), as described in reference [22], which entails the deliberate inundation of synchronized (SYN) packets into TCP-based connections. SYN packets are often used for the purpose of initiating TCP connections between communicating entities, hence allocating resources on both ends, including ports and buffers. This kind of attack has the potential to target the accessibility of servers and/or computers belonging to the victim. In addition, the use of Hyper-Text Transfer Protocol (HTTP) flooding, acknowledgment flooding, and User Datagram Protocol (UDP) packets has been seen as means to replicate DDoS attacks in the context of IoT Mirai.

Additionally, a brute force attack (Kara 2019) was employed to decrypt the data, compromising its confidentiality. A MITM attack was performed in order to change the Address Resolution Protocol (ARP) table, therefore linking the attacker's Media Access Control (MAC) address with the Internet Protocol (IP) address of the router. Consequently, the unauthorized individual will assume the identity of the network router and interfere with the communication between various network entities. The primary objective of this assault is to intercept or alter data during its transmission. The features of the dataset are listed and described in Table 4.

Table 4

Dataset Features Description
#	Feature Name	Feature Description
1	Flow ID	Flow Identifier
2	Src IP	Source IP Address
3	Src Port	Source Port Number
4	Dst IP	Destination IP Address
5	Dst Port	Destination Port Number
6	Protocol	Utilized IP
7	Timestamp	Packet Time-stamp
8	Flow duration	Flow Duration in Microseconds
9	total Length of Fwd Packet	Total Packet Size Forward
10	total Fwd Packet	Total Packets Forward
11	total Bwd packets	Total Packets Backward
12	Fwd Packet Length Min	Minimal Packet Size Forward
13	total Length of Bwd Packet	Total Packet Size Backward
14	Fwd Packet Length Max	Maximal Packet Size Forward
15	Bwd Packet Length Min	Minimal Packet Size Backward
16	Fwd Packet Length Mean	Average Packet Size Forward
17	Fwd Packet Length Std	Standard Deviation Packet Forward
18	Bwd Packet Length Mean	Average Packet Size Backward
19	Bwd Packet Length Max	Maximal Packet Size Backward
20	Flow Packets/s	Flow Packets per Second
21	Bwd Packet Length Std	Packet Standard Deviation Backward
22	Flow Bytes/s	Flow Bytes per Second
23	Flow IAT Mean	Average Time Between Flow Packets
24	Flow IAT Max	Maximal Time Between Flow Packets
25	Flow IAT Std	Time Standard Deviation Between Flow Packets
26	Flow IAT Min	Minimal Time Between Flow Packets
27	Fwd IAT Min	Minimal Time Between Forward Packets
28	Fwd IAT	Standard Deviation Time Between Forward Packets
29	Fwd IAT Total	Total Time Between Forward Packets
30	Fwd IAT Max	Maximal Time Between Forward Packets
31	Fwd IAT Mean	Average Time Between Forward Packets
32	Bwd IAT Min	Minimal Time Between Backward Packets
33	Bwd IAT Std	Standard Deviation Time Between Backward Packets
34	Bwd IAT Max	Maximal Time Between Backward Packets
35	Bwd IAT Mean	Average Time Between Backward Packets
36	Bwd IAT Total	Total Time Between Backward Packets
37	Fwd URG Flags	URG Flag Set in Forward Packets
38	Fwd PSH flags	PSH Flag Set in Forward Packets
39	Bwd PSH Flags	PSH Flag Set in Backward Packets
40	Bwd URG Flags	URG Flag Fixed in Backward Packets
41	FWD Packets/s	Forward Packets per Second
42	Fwd Header Length	Total Forward Header Bytes
43	Bwd Header Length	Total Backward Header Bytes
44	Bwd Packets/s	Backward Packets per Second
45	Packet Length Min	Minimal Packet Length
46	Packet Length Std	Packet Standard Deviation Length
47	Packet Length Max	Maximal Packet Length
48	Packet Length Mean	Average Packet Length
49	Packet Length Variance	Packet Variance Length
50	SYN Flag Count	Packets with SYN Flag
51	FIN Flag Count	Packets with FIN Flag
52	ACK Flag Count	Packets with ACK Flag
53	RST Flag Count	Packets with RST Flag
54	PSH Flag Count	Packets with PUSH Flag
55	CWR Flag Count	Packets with CWR Flag
56	URG Flag Count	Packets with URG Flag
57	ECE Flag Count	Packets with ECE Flag
58	down/Up Ratio	Upload/Download Ratio
59	Average Packet Size	Mean Packet Size
60	Fwd Bytes/Bulk Avg	Mean Forward Bulk Rate (Bytes)
61	Fwd Packet/Bulk Avg	Average Forward Bulk Rate (Packets)
62	Fwd Segment Size Avg	Mean Observed Size Forward
63	Bwd Segment Size Avg	Average Backward Bulk Rate (Bytes)
64	Bwd Bytes/Bulk Avg	Mean Backward Bulk Rate (Bytes)
65	Fwd Bulk Rate Avg	Average Forward Bulk Rate (Packets)
66	Bwd Packet/Bulk Avg	Mean Backward Bulk Rate (Packets)
67	Subflow Fwd Bytes	Mean Bytes in Forward Sub Flow
68	Subflow Bwd Packets	Mean Packets in Backward Sub Flow
69	Bwd Bulk Rate Avg	Mean Backward Bulk Rate (Packets)
70	Subflow Fwd Packets	Mean Packets in Forward Sub Flow
71	Fwd Init Win bytes	Total Bytes Sent in Initial Window Forward
72	Subflow Bwd Bytes	Mean Bytes in Backward Sub Flow
73	Bwd Init Win bytes	Total Bytes Sent in Initial Window Backward
74	Active Min	Minimal Active Flow Duration Before Idle
75	Active Mean	Average Active Flow Duration Before Idle
76	Fwd Act Data Pkts	Packets with ≥ 1 Byte Payload (Forward)
77	Fwd Seg Size Min	Minimal Observed Segment Size (Forward)
78	Active Max	Maximal Active Flow Duration Before Idle
79	Active Std	Standard Deviation Active Flow Duration Before Idle
80	Idle Mean	Average Idle Flow Duration Before Active
81	Idle Max	Maximal Idle Flow Duration Before Active
82	Idle Min	Minimal Idle Flow Duration Before Active
83	Idle Std	Standard Deviation Idle Flow Duration Before Active
84	Label	Anomaly or Normal
85	Cat	Attack Category or Normal
86	Sub-Cat	Attack Sub-category or Normal

Methodology

In this section, we are describing the methodology used in this study. The methodology framework is shown in Fig. 2. The methodology unfolds with the initial step of acquiring the IoTID20 dataset, laying the foundation for subsequent analyses. A crucial stride follows, encompassing meticulous data preprocessing aimed at purging noise and enhancing the dataset's integrity. The process advances organically to feature selection, a pivotal phase orchestrated through a judicious fusion of correlation coefficient assessment, PSO, and GWO techniques. This synergistic approach culminates in the identification of a distilled set of features primed for optimal information encapsulation. Harnessing these curated features, the classification stage takes center stage, leveraging the prowess of a decision tree algorithm to decipher underlying patterns. Furthermore, the methodology demonstrates a commitment to refinement through hyperparameter optimization, where the innovative Coronavirus herd immunity optimizer (CHIO) is harnessed. This final touch amplifies system accuracy, ultimately yielding a robust framework poised to navigate the intricacies of the IoTID20 dataset with precision and efficacy.

Data Preprocessing

In the data preprocessing phase, a systematic approach was adopted to enhance the dataset's quality. Initially, features tied to network packet identification, namely 'Flow_ID', 'Src_IP', 'Dst_IP', and 'Timestamp', were discerned as extraneous and consequently excluded. A subsequent examination of feature distributions uncovered the presence of noisy distributions resembling null values within certain attributes. Notably, 'Fwd_Byts/b_Avg', 'Fwd_Pkts/b_Avg', 'Fwd_Blk_Rate_Avg', 'Bwd_Byts/b_Avg', 'Bwd_Pkts/b_Avg', 'Bwd_Blk_Rate_Avg', 'Fwd_PSH_Flags', 'Fwd_URG_Flags', 'Init_Fwd_Win_Byts', 'Fwd_Seg_Size_Min', 'Flow_Byts/s' and 'Flow_Pkts/s' exhibited such patterns.

The initial dataset, comprising 86 features and 3 target attributes, underwent a comprehensive refinement during this preprocessing stage, resulting in a streamlined feature set of 67 attributes. This meticulous curation contributes to a more focused and robust foundation for subsequent analytical endeavors. Illustrated in Fig. 3 is an exemplary representation of feature distribution subsequent to the preprocessing phase. The graph demonstrates the non-noisy distributions, accentuating the pivotal role played by this preprocessing stage.

Feature Selection

Feature selection is a critical facet of data analysis and machine learning, as it empowers the identification and extraction of the most relevant attributes from a dataset. This process involves discerning the subset of features that hold the greatest discriminatory power or predictive capability, while discarding or excluding those that might introduce noise, redundancy, or insignificance to the model. The importance of feature selection lies in its capacity to enhance model performance, alleviate the curse of dimensionality, and streamline computation resources. By focusing on the most influential attributes, feature selection not only accelerates model training but also mitigates overfitting, where a model becomes excessively tailored to noise in the data. Moreover, it provides interpretability, enabling researchers and practitioners to understand and explain the underlying patterns driving model decisions. In the realm of model development, feature selection assumes a crucial role in the creation of models that are both efficient and accurate, while also allowing for easy interpretation. Feature selection strategies may be classified into three primary classes, embedded methods (Mahendran and P M 2022), wrapper (Maldonado, Riff, and Neveu 2022) and filter (Lyu et al. 2017) methods. In our proposal we used correlation coefficient, which is an example of filter methods, PSO and GWO which are examples of embedded Methods.

Filter Methods

Filter methods (Lyu et al. 2017) evaluate the relevance of features based on their statistical properties or information-theoretic measures. These strategies do not include the process of training a machine learning model. In contrast, the dataset is examined in isolation from any particular learning technique. One often used approach in feature selection is the correlation-based filter technique (Mohamad et al. 2021), which quantifies the degree of connection between characteristics and the target variable. Information Gain (Kurniabudi et al. 2020), Chi-Square (McHugh 2012), and Mutual Information (Bennasar, Hicks, and Setchi 2015) are other prominent filter methods. These methods are computationally efficient and can serve as a preprocessing step to reduce the dimensionality of the dataset.

Correlation Coefficient

The correlation coefficient, as described by reference (Akoglu 2018), is a statistical measure used to assess the magnitude and direction of the linear association between two variables. The scale of measurement spans from negative one to positive one, providing valuable perspectives on the characteristics of the correlation. A correlation value close to + 1 indicates a strong positive linear association, implying that if one variable grows, the other variable also tends to increase. On the other hand, a correlation value that approaches − 1 indicates a robust negative linear association, indicating that when one variable grows, the other variable tends to decrease. A correlation value close to zero suggests a limited or inconsequential linear association between the variables. The correlation coefficient can be computed using Eq. (1).

$$r=\frac{n\left(\sum XY-\sum X\sum Y\right)}{\sqrt{n\sum {X}^{2}-{\left(\sum X\right)}^{2}} \sqrt{n\sum {Y}^{2}-{\left(\sum Y\right)}^{2}}} \left(1\right)$$

where X and Y represent the two variables and n is the count of instances for the variables.

The application of the correlation coefficient for feature selection yielded valuable insights into the dataset. By identifying and retaining the top 35 features based on their correlation with the target variable, we focused on the most influential factors driving the predictive power of our model. This selection process highlighted the critical variables that exhibit strong associations with the target outcome. These chosen features are expected to play a pivotal role in the accuracy and performance of our model.

Embedded Methods

Embedded methods (Mahendran and P M 2022) seamlessly integrate feature selection within the model training process. These techniques assess feature importance during the training phase of a machine learning model. LASSO (Least Absolute Shrinkage and Selection Operator) (Kim et al. 2019) is a widely used embedded method. A penalty component is included into the linear regression equation, so promoting the model to prioritize a subset of significant characteristics. Ridge Regression (Dorugade 2014) is another example, which introduces L2 regularization. Additionally, techniques like PSO (Jain et al. 2022) and GWO (Negi et al. 2021) can be employed as embedded methods. These metaheuristic algorithms can optimize feature selection within the context of specific machine learning models.

Particle Swarm Optimization

PSO (Jain et al. 2022) is a computer optimization methodology that draws inspiration from the collective behavior seen in bird flocks or fish schools [34]. The method in question is a heuristic approach that emulates the movement of individual particles within a population as they navigate a search space with several dimensions, with the aim of identifying optimum solutions. Every individual particle inside the system symbolizes a possible solution that may be considered for the optimization challenge at hand, and the collective movement of particles is guided by their own experiences and the experiences of their neighbors.

At the core of PSO is the concept of fitness evaluation, where each particle's solution is assessed based on a predefined fitness function. The particles adjust their positions in the search space iteratively to find the best possible solution. During each repetition, particles modify their velocities by including two primary components: their cognitive component, which accounts for their historical best position, and their social component, influenced by the best position achieved by their neighbors. These components effectively balance exploration (diversification) and exploitation (intensification) of the search space. Figure 4 shows the framework of PSO.

Particles are drawn towards promising regions in the solution space as they iteratively update their positions. Over time, this collaborative behavior steers the particles towards optimal or near-optimal solutions. The utilization of PSO for feature selection has demonstrated itself to be a remarkably effective strategy in our analysis. Notably, the PSO algorithm demonstrated a consistent and balanced selection of features across all three target classes—34 features each for label, category, and sub-category. This uniformity suggests that PSO intelligently identified a cohesive set of attributes that collectively contribute significantly to the classification process. By doing so, PSO effectively reduced dimensionality while preserving the discriminative power of the selected features.

Grey Wolf Optimization

The GWO algorithm (Negi et al. 2021), is a nature-inspired optimization technique that derives its principles from the hierarchical social structure and hunting patterns seen in grey wolves in their natural habitat. The objective of this method is to replicate the collaborative hunting dynamics seen in wolf packs in order to address optimization difficulties. GWO operates on the principles of exploration, exploitation, and adaptation, aiming to iteratively refine solutions within a given search space.

In GWO, the optimization process involves a population of wolf "packs," each containing an alpha wolf (the leader), beta wolves (subordinates to the leader), and delta wolves (subordinates to both alpha and beta). Each wolf corresponds to a potential solution in the search space. The positions of these wolves represent potential solutions to the optimization problem, and their fitness is evaluated using the objective function. During each iteration, the wolves adjust their positions based on their hierarchical roles and a set of equations derived from the hunting behavior of real wolves. The alpha wolf's position is updated using a formula that emphasizes exploitation, attempting to improve the best solution found so far. The beta and delta wolves' positions are adjusted to explore promising areas of the search space. The movement of the wolves is influenced by various control parameters and the positions of the alpha, beta, and delta wolves. The framework of GWO is shown in Fig. 5.

Through successive iterations, the wolf pack collaboratively refines their positions in the search space, converging toward optimal or near-optimal solutions. GWO has demonstrated effectiveness in solving a wide range of optimization problems, including those with both continuous and discrete variables. Its inherent balance between exploration and exploitation, inspired by the cooperative nature of grey wolves, makes it a promising tool for solving complex optimization challenges across different domains. The integration of GWO for feature selection has yielded noteworthy results in our analysis. Impressively, GWO exhibited a discerning approach by selecting 63 features for label, 64 for category, and 63 for sub-category. The slightly varying feature counts across different target classes suggest that GWO efficiently adapts to the distinct characteristics of each class, emphasizing its adaptability.

Hyperparameters Optimization

The optimization of hyperparameters is an essential stage in the development and refinement of machine learning models. Hyperparameters refer to the configuration settings that dictate the behavior of a model and have an impact on its performance. In contrast to the parameters of a model, which are estimated from data during the training process, hyperparameters need pre-determined values provided by the user prior to training. The process of hyperparameter optimization is conducting a methodical exploration of various combinations of these parameters in order to identify the configuration that produces the most optimal results on a selected measure, such as accuracy or error rate.

The challenge lies in the fact that the impact of hyperparameters on the model's performance can be intricate and non-linear, making manual selection a time-consuming and often suboptimal process. In order to tackle this issue, researchers have devised a range of methodologies, including grid search, random search, as well as more sophisticated methods such as Bayesian optimization, genetic algorithms, and particle swarm optimization. These methods efficiently explore the hyperparameter space to identify combinations that maximize model performance.

Hyperparameter optimization significantly impacts a model's effectiveness. A well-tuned set of hyperparameters can enhance a model's generalization capability, prevent overfitting, and expedite convergence during training. It plays a pivotal role in achieving the best possible results from a machine learning model and ensures that the model is adaptable to the specific problem at hand. As the search for optimal hyperparameters is often time-consuming and resource-intensive, choosing an appropriate optimization method and striking a balance between exploration and exploitation is crucial for achieving efficient and effective model configurations. For this reason, we used CHIO (Al-Betar et al. 2021) for finding the best parameters for decision tree (DT) model to improve its accuracy.

Coronavirus Herd Immunity Optimizer

CHIO (Al-Betar et al. 2021) is an optimization algorithm inspired by the concept of herd immunity in epidemiology, particularly relevant in the context of managing and mitigating the spread of diseases like COVID-19. CHIO leverages the principles of natural immunity build-up within populations to guide its optimization process.

The CHIO system works via the simulation of herd immunity dynamics, wherein a certain segment of the population acquires immunity to a disease, resulting in a decrease in its transmission. Similarly, in the optimization context, CHIO divides the solution space into "immune" and "susceptible" regions. Solutions in the immune region are considered favorable, while susceptible solutions are subject to potential improvements. During each iteration, CHIO adjusts the positions of solutions based on their "immune" or "susceptible" status, mimicking the idea that immune solutions are less likely to change drastically, while susceptible solutions have more room for exploration.

This approach combines exploration and exploitation, analogous to how herd immunity balances the risk of infection and immunity within a population. By incorporating this concept into optimization, CHIO aims to enhance convergence speed, balance exploration-exploitation trade-offs, and find optimal or near-optimal solutions. The algorithm's unique foundation in epidemiology sets it apart, potentially making it a valuable tool for tackling complex optimization challenges. The CHIO approach is shown in Fig. 6.

CHIO's adaptive nature and innovative approach in selecting the best hyperparameters have resulted in a notable improvement in accuracy. CHIO fine-tuned the model's parameters, enhancing its ability to discern intricate patterns within the data. This not only bolstered the model's predictive power but also bolstered its robustness across different scenarios.

Classification

In the categorization stage, the decision tree (Kotsiantis 2013) machine learning model was used. The decision tree method is a frequently used and straightforward machine learning technique that is capable of performing classification and regression tasks. The structure of the system has resemblance to that of an inverted tree, whereby each core node signifies a choice made on the basis of a distinct characteristic, and each leaf node corresponds to either a class label or a forecast value. The decision-making process starts at the root node and proceeds down the tree, with each decision node branching into subsets of data based on feature values. This process continues until a leaf node is reached, providing the final prediction or classification.

The decision tree method operates by iteratively dividing the dataset into subsets, using the characteristics that provide the most significant information. The choice of feature and the corresponding splitting criteria are determined using various metrics like Gini impurity or information gain. These metrics evaluate the effectiveness of a certain characteristic in dividing the data into discrete and distinguishable groups or values. The method proceeds with the process of dividing nodes until it reaches a predetermined stopping condition, which may include reaching a maximum depth or a minimum number of samples per leaf. This recursive nature of decision tree construction enables it to capture complex decision boundaries and relationships within the data.

The selection of the Decision Tree algorithm for classification stems from a meticulous comparative analysis of various classifiers including SVM (Chauhan, Dahiya, and Sharma 2019), kNN (Zhang 2021), and Extreme Learning Machine (ELM) (Wibawa, Malik, and Bahtiar 2018). Our findings unequivocally favored the Decision Tree as the optimal choice for this specific intrusion detection system. The algorithm's performance surpassed its counterparts in terms of accuracy, precision, and computational efficiency. This can be attributed to the Decision Tree's innate ability to create interpretable, hierarchical structures that effectively capture the underlying relationships in the data. This characteristic proved invaluable in discerning complex intrusion patterns. The interpretability of the resulting model also lends itself to meaningful insights, allowing for a deeper understanding of the features driving the classification process.

Experimental Results

In the context of intrusion detection systems within the IoT environment, our proposed methodology exhibits several notable strengths. Our approach leverages the IoTID20 dataset, a comprehensive and diverse collection of real-world IoT network traffic data. This foundational choice ensures that our system is grounded in empirical observations, enhancing its relevance and applicability to actual operational environments.

The data preprocessing step resulted in removal of 16 features. Four features are identification features, ten features are features exhibiting a noisy distribution and 2 features contain null values. The statistical distribution of the eight removed features with noisy distribution is shown in Table 5.

Table 5

Noisy Features Statstical Analysis
	count	mean	min	max
Fwd_PSH_Flags	625783	0	0	0
Fwd_URG_Flags	625783	0	0	0
Fwd_Byts/b_Avg	625783	0	0	0
Fwd_Pkts/b_Avg	625783	0	0	0
Fwd_Blk_Rate_Avg	625783	0	0	0
Bwd_Byts/b_Avg	625783	0	0	0
Bwd_Pkts/b_Avg	625783	0	0	0
Bwd_Blk_Rate_Avg	625783	0	0	0
Init_Fwd_Win_Byts	625783	-1	-1	-1
Fwd_Seg_Size_Min	625783	0	0	0

The decision to exclude these features from the dataset was driven by a thorough analysis of their statistical properties. Upon examination, it became evident that these specific features exhibited a consistently low variance, with a standard deviation of zero. This indicates that these features maintained a constant value across the entire dataset, rendering them devoid of any discriminatory power. Additionally, the mean, minimum, and maximum values for each of these features also remained constant, further affirming their lack of variability. Given this lack of variability and informativeness, it was a judicious decision to remove these features from the dataset. This curation process aims to streamline the dataset, focusing on features that contribute significantly to the characterization of the underlying patterns and behaviors in the data, ultimately enhancing the effectiveness of subsequent analyses and modeling efforts.

The features after preprocessing are crucial for accurate classification. Figures 7, 8, and 9 present heatmaps that visualize the relationships between the top 10 features and the three corresponding target classes: label, category, and sub-category. These visualizations provide valuable insights into the correlations between features and target classes. The heatmap patterns indicate potential strong associations, which further emphasizes the importance of these features in distinguishing between different classes.

The dataset known as IoTID20 is partitioned into two subsets: an 80% training set and a 20% testing set. The training set is used for the purpose of training the classifier, whilst the testing set is applied to assess its efficacy. Using the full 67 features for classification, Table 6 shows the results of classification.

Table 6

Results using full 67 features
	SVM	kNN	DT	ELM
Label	96.68	99.76	99.94	98.25
Cat	73.66	97.97	99.55	78.85
Sub_Cat	47.08	74.31	74.65	65.12

The reduced features after data preprocessing which 67 features are used as input for three feature selection techniques correlation coefficient, PSO and GWO. The intersection between the 35 highest absolute value of correlation coefficient and the result of PSO for each target is computed and the results are shown at Table 7. Using the selected features for classification, Table 8 shows the results of classification.

Table 7

Feature Selection Results
Target	Length	Features
Label	17	'Dst_Port', 'SYN_Flag_Cnt', 'Down/Up_Ratio', 'Bwd_Pkt_Len_Mean', 'Init_Bwd_Win_Byts', 'Fwd_Pkt_Len_Mean', 'Flow_IAT_Mean', 'Fwd_Pkt_Len_Std', 'Fwd_Header_Len', 'Pkt_Len_Var', 'Pkt_Len_Max', 'Flow_IAT_Min', 'Bwd_PSH_Flags', 'Bwd_Seg_Size_Avg', 'Fwd_Pkt_Len_Max', 'Src_Port', 'Protocol'
Category	16	'Idle_Max', 'Bwd_Pkt_Len_Max', 'Flow_Duration', 'Pkt_Len_Var', 'SYN_Flag_Cnt', 'Src_Port', 'Fwd_Pkt_Len_Max', 'Bwd_Pkt_Len_Mean', 'Active_Max', 'Dst_Port', 'Init_Bwd_Win_Byts', 'Bwd_Pkt_Len_Std', 'Idle_Mean', 'Bwd_Seg_Size_Avg', 'ACK_Flag_Cnt', 'Pkt_Len_Min'
Sub -Category	22	'Flow_IAT_Max', 'Subflow_Bwd_Pkts', 'Subflow_Fwd_Pkts', 'Flow_IAT_Std', 'Src_Port', 'Bwd_IAT_Max', 'ACK_Flag_Cnt', 'Fwd_Header_Len', 'Protocol', 'Tot_Fwd_Pkts', 'Bwd_Seg_Size_Avg', 'Bwd_Pkt_Len_Std', 'Bwd_IAT_Mean', 'Pkt_Len_Var', 'Idle_Mean', 'Dst_Port', 'Idle_Max', 'Active_Min', 'Idle_Min', 'Flow_IAT_Min', 'Pkt_Len_Max', 'Flow_Duration'

Table 8

Results using full selected features
	SVM	kNN	DT	ELM
Label	93.42	99.81	99.94	97.59
Cat	71.24	98.68	99.61	88.08
Sub_Cat	34.78	75.4	74.56	56.05

The meticulous data preprocessing step plays a crucial role in purging noise and augmenting the dataset's integrity. This pre-eminent effort ensures that the subsequent analyses and decision-making processes are built upon a solid and reliable foundation. By addressing noise at its source, our system demonstrates robustness in handling complex and dynamic IoT network environments. The feature selection phase represents a pivotal advancement in our methodology. Through the judicious integration of correlation coefficient assessment, PSO, and GWO techniques, we have engineered a synergistic approach that distills the feature set to its most informative components. This not only reduces computational overhead but also ensures that the selected features are optimally primed for encapsulating relevant information.

The intersection between the three sets for targets are exactly four features which are 'Bwd_Seg_Size_Avg', 'Pkt_Len_Var', 'Src_Port', 'Dst_Port'. The four features are selected and are input for the hyperparameters tuning of decision tree model. The optimization process involves determining the optimal values for two hyperparameters, namely the criteria and the max_depth. The criterion is a mathematical function used to assess the quality of a split in a decision tree. There are two alternatives, namely the Gini impurity and the entropy Shannon information gain. The parameter max_depth determines the upper limit on the depth of the tree. The hyperparameters of decision tree after optimization using CHIO are presented in Table 9. The hyperparameters are then used for training decision tree model on the training data. Then the trained model is used to predict the label, category and subcategory of the testing data and the results are used to evaluate the model and obtain the results. The proposed system achieved accuracy of 99.96%, 99.56% and 77.6% for label, category and subcategory respectively.

Table 9

Decision tree hyperparameters values after optimization
Target	Criterion	Max_depth
Label	entropy	17
Category	entropy	5
Subcategory	entropy	429

Our classification stage, centered around the decision tree algorithm, is a strategically chosen approach for deciphering underlying patterns in IoT network traffic. Decision trees are known for their interpretability and ability to handle non-linear relationships, which is crucial in detecting anomalies and potential intrusions within complex network behaviors. The commitment to refinement through hyperparameter optimization is another hallmark of our methodology. By introducing the innovative CHIO, we bring a cutting-edge optimization technique to bear. This demonstrates our willingness to explore and integrate state-of-the-art methodologies to fine-tune the system's performance.

Our proposed intrusion detection system for IoT environments is fortified by a series of carefully crafted steps. From data acquisition to feature selection, classification, and hyperparameter optimization, each phase is strategically designed to capitalize on the unique strengths of the chosen techniques. The use of this comprehensive strategy not only guarantees the resilience of the system but also establishes it as a powerful instrument for protecting IoT networks from possible security vulnerabilities. After the system successfully identifies and categorizes potential intrusions, it's imperative to establish an efficient and effective follow-up protocol. When an intrusion is detected, it would be prevented, and network administrator will receive prompt notifications detailing the nature of the threat along with recommended actions for mitigation. Additionally, comprehensive logs and reports will be generated to document the event, aiding in post-incident analysis and compliance with regulatory requirements.

This work introduces an innovative intrusion detection system that is particularly developed for IoT settings. The system utilizes the IoTID20 dataset, which consists of 83 characteristics and three class labels, to enhance its comprehensiveness. The system adeptly distinguishes normal network traffic from potential anomalies and further refines its categorization, dissecting anomaly traffic into distinct classifications, including Mirai, DoS, Scan, and MITM attacks. This level of granularity is further enriched by the third-class label, which discerns specific types within Mirai and Scan attacks. A systematic methodology guides the entire process, encompassing crucial stages such as data preprocessing, feature selection, hyperparameter optimization, and classification.

Notably, the pivotal role of data preprocessing cannot be overstated, enhancing dataset integrity through the astute removal of identifier features, careful handling of null values, and the adept resolution of noisy feature distributions. This meticulous process culminated in a streamlined feature set of 67, laying the foundation for subsequent feature selection techniques. The integration of correlation coefficient, PSO, and GWO methods, executed with thoughtful precision, yielded refined feature subsets of 17, 16, and 22 features for label, category, and subcategory classification, respectively. A strategic commonality approach further distilled this set to four key features - 'Bwd_Seg_Size_Avg', 'Pkt_Len_Var', 'Src_Port', and 'Dst_Port'.

The system's effectiveness was further enhanced by employing CHIO to fine-tune the decision tree model, yielding impressively high accuracy rates of 99.96%, 99.56%, and 77.6% for label, category, and subcategory classification, respectively. This not only bolsters network security but also sets the stage for ongoing progress in upholding the integrity of IoT environments on a global scale.

Looking ahead, there are several promising avenues for further exploration and enhancement of this proposed intrusion detection system tailored for IoT environments. Firstly, an intriguing avenue lies in the integration of real-time monitoring and response capabilities. Implementing dynamic, adaptive mechanisms that can respond swiftly to emerging threats in the ever-evolving IoT landscape holds considerable potential. Additionally, the inclusion of anomaly detection algorithms, such as unsupervised learning techniques, could further bolster the system's ability to identify previously unseen attack patterns. Furthermore, extending the dataset to encompass a broader range of IoT device types, communication protocols, and network configurations could lend invaluable insights into the system's adaptability and generalizability across diverse IoT environments. Collaboration with industry stakeholders and cybersecurity experts can provide critical feedback for refining the system's practical applicability and addressing specific deployment challenges. Lastly, considering the rapid evolution of IoT technologies, regular updates and re-evaluations of the system's performance in response to emerging threats and advancements in IoT device capabilities will be crucial in maintaining its effectiveness in safeguarding IoT networks.

Author Contribution

Sharaf wrote the main manuscript text and perform the needed V&VAbdullahi supervised the research progress and the writing of the paperZahraa contributed as the co-researcher.

A Survey on IPS Methods and Techniques (2016) Int J Comput Sci Issues.
Akoglu H (2018) User’s Guide to Correlation Coefficients. Turkish J Emerg Med.
Al-Betar M, Azmi ZAA, Alyasseri MA, Awadallah (2021) and Iyad Abu Doush. Coronavirus Herd Immunity Optimizer (CHIO). Neural Computing and Applications
Alghuried A (2017) A Model for Anomalies Detection in Internet of Things (IoT) Using Inverse Weight Clustering and Decision Tree. Masters’s Thesis, Dublin Institute of Technology, Dublin, Ireland: 64
Alkahtani H, Theyazn HH, Aldhyani (2021) Intrusion Detection System to Advance Internet of Things Infrastructure-Based Deep Learning Algorithms. Complexity
Alsulami AA, Qasem Abu Al-Haija A, Tayeb, and Ali Alqahtani (2022) An Intrusion Detection and Classification System for IoT Traffic with Improved Data Engineering. Appl Sci 12(23):12336
Basak H, Kundu R, Chakraborty S, and Nibaran Das (2021) Cervical Cytology Classification Using PCA and GWO Enhanced Deep Features Selection. SN Computer Science
Bennasar M, Hicks Y, Setchi R (2015) Feature Selection Using Joint Mutual Information Maximisation. Expert Syst Appl.
Buczak AL, and Erhan Guven (2016) A Survey of Data Mining and Machine Learning Methods for Cyber Security Intrusion Detection. IEEE Commun Surv Tutorials.
Chauhan V, Kumar K, Dahiya, and Anuj Sharma (2019) Problem Formulations and Solvers in Linear SVM: A Review. Artif Intell Rev.
Cloudflare (2022) What Is a Denial-of-Service (DoS) Attack? | Cloudflare. Cloudflare
Dorugade AV (2014) New Ridge Parameters for Ridge Regression. Journal of the Association of Arab Universities for Basic and Applied Sciences
Fatani A et al (2022) Advanced Feature Extraction and Selection Approach Using Deep Learning and Aquila Optimizer for Iot Intrusion Detection System. Sensors.
Gao J, Chai S, Zhang B (2019) and Yuanqing Xia. Research on Network Intrusion Detection Based on Incremental Extreme Learning Machine and Adaptive Principal Component Analysis. Energies
Graham L (2017) Number of Connected IoT Devices Will Surge to 125 Billion by 2030, IHS Markit Says. IHS Markit Ltd
Jain M, Saihjpal V, Singh N (2022) and Satya Bir Singh. An Overview of Variants and Advancements of PSO Algorithm. Applied Sciences (Switzerland)
Kara İlker (2019) Detection, Technical Analysis of Brute Force Attack. Sakarya Univ J Comput Inform Sci.
Keserwani P, Kumar MC, Govil ES, Pilli, Govil P (2021) A Smart Anomaly-Based Intrusion Detection System for the Internet of Things (IoT) Network Using GWO–PSO–RF Model. J Reliable Intell Environ.
Kim Y et al (2019) Hi-LASSO: High-Dimensional LASSO. IEEE Access.
Kotsiantis SB (2013) Decision Trees: A Recent Overview. Artif Intell Rev.
Krishnan S, Neyaz A, Liu Q (2021) IoT Network Attack Detection Using Supervised Machine Learning.
Kurniabudi et al (2020) CICIDS-2017 Dataset Feature Analysis with Information Gain for Anomaly Detection. IEEE Access.
Lahasan B, and Hussein Samma (2022) Optimized Deep Autoencoder Model for Internet of Things Intruder Detection. IEEE Access.
Lashkari A, Habibi GD, Gil (2017) Mohammad Saiful Islam Mamun, and Ali A. Ghorbani. Characterization of Tor Traffic Using Time Based Features. In ICISSP 2017 - Proceedings of the 3rd International Conference on Information Systems Security and Privacy
Lima Filho FS, De et al (2019) Smart Detection: An Online Approach for DoS/DDoS Attack Detection Using Machine Learning. Security and Communication Networks
Lyu H et al (2017) A Filter Feature Selection Method Based on the Maximal Information Coefficient and Gram-Schmidt Orthogonalization for Biomedical Data Mining. Computers in Biology and Medicine
Mahendran N, Durai Raj Vincent PM (2022) A Deep Learning Framework with an Embedded-Based Feature Selection Approach for the Early Detection of the Alzheimer’s Disease. Computers in Biology and Medicine
Makhadmeh SN et al (2022) A Modified Coronavirus Herd Immunity Optimizer for the Power Scheduling Problem. Mathematics.
Maldonado J, Riff MaríaC, Neveu B (2022) A Review of Recent Approaches on Wrapper Feature Selection for Intrusion Detection. Expert Syst Appl.
McHugh ML (2012) The Chi-Square Test of Independence. Biochemia Med.
Mohamad M et al (2021) Enhancing Big Data Feature Selection Using a Hybrid Correlation-Based Feature Selection. Electronics (Switzerland)
Mohamad Noor Mbinti, and Wan Haslina Hassan (2019) Current Research on Internet of Things (IoT) Security: A Survey. Comput Netw.
Negi G, Kumar A, Pant S, Ram M (2021) GWO: A Review and Applications. Int J Syst Assur Eng Manage.
Otoum Y (2022) AI-Based Intrusion Detection Systems to Secure Internet of Things (IoT). Université. d’Ottawa/University of Ottawa
Qaddoura R, Al-Zoubi Ala’M, Almomani I, Faris H (2021) A Multi-Stage Classification Approach for Iot Intrusion Detection Based on Clustering with Oversampling. Appl Sci (Switzerland).
Reddy DK, Kumar et al (2021) Exact Greedy Algorithm Based Split Finding Approach for Intrusion Detection in Fog-Enabled IoT Environment. J Inform Secur Appl.
Ben Seghier ME, Amine et al (2020) Novel Hybridized Adaptive Neuro-Fuzzy Inference System Models Based Particle Swarm Optimization and Genetic Algorithms for Accurate Prediction of Stress Intensity Factor. Fatigue and Fracture of Engineering Materials and Structures
Song Y, Hyun S, Yun GC (2021) Analysis of Autoencoders for Network Intrusion Detection†. Sensors.
Steinberg J (2015) Official (ISC)2 Guide to the CISSP-ISSMP CBK Official (ISC)2 Guide to the CISSP-ISSMP CBK
Ullah I, Mahmoud QH (2020) A Scheme for Generating a Dataset for Anomalous Activity Detection in IoT Networks. In Lecture Notes in Computer Science (Including Subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Ullah S et al (2022) A New Intrusion Detection System for the Internet of Things via Deep Convolutional Neural Network and Feature Engineering. Sensors 22(10):3607
Wibawa H, Arif I, Malik (2018) and Nurdin Bahtiar. Evaluation of Kernel-Based Extreme Learning Machine Performance for Prediction of Chronic Kidney Disease. In 2018 2nd International Conference on Informatics and Computational Sciences, ICICoS 2018
Zhang S (2021) Challenges in KNN Classification. IEEE Trans Knowl Data Eng.

No competing interests reported.

Download PDF

Version 1

posted

You are reading this latest preprint version

Fine tuned multi-attack recognizer system of IoT computing environments

Status:

Version 1

Abstract

Figures

Introduction

Materials and Methods

Correlation Coefficient

Particle Swarm Optimization

Grey Wolf Optimization

Conclusion

Declarations

Author Contribution

References

Additional Declarations

Status:

Version 1