Robust Attack Detection Approach for IIoT Using Ensemble Classifier

TL;DR

This paper presents a novel two-phase ensemble machine learning model combining SVM, Naive Bayes, Random Forest, and ANN to detect anomalies in IIoT networks, achieving up to 99% accuracy and outperforming traditional methods.

Contribution

The paper introduces a new ensemble-based anomaly detection framework for IIoT networks that integrates multiple classifiers and uses a two-phase approach for improved accuracy.

Findings

Achieved up to 99% detection accuracy.

Outperformed traditional anomaly detection techniques.

Validated on multiple standard IoT attack datasets.

Abstract

Generally, the risks associated with malicious threats are increasing for the IIoT and its related applications due to dependency on the Internet and the minimal resource availability of IoT devices. Thus, anomaly-based intrusion detection models for IoT networks are vital. Distinct detection methodologies need to be developed for the IIoT network as threat detection is a significant expectation of stakeholders. Machine learning approaches are considered to be evolving techniques that learn with experience, and such approaches have resulted in superior performance in various applications, such as pattern recognition, outlier analysis, and speech recognition. Traditional techniques and tools are not adequate to secure IIoT networks due to the use of various protocols in industrial systems and restricted possibilities of upgradation. In this paper, the objective is to develop a two-phase anomaly detection model to enhance the reliability of an IIoT network. In the first phase, SVM and Naive Bayes are integrated using an ensemble blending technique. K-fold cross-validation is performed while training the data with different training and testing ratios to obtain optimized training and test sets. Ensemble blending uses a random forest technique to predict class labels. An Artificial Neural Network (ANN) classifier that uses the Adam optimizer to achieve better accuracy is also used for prediction. In the second phase, both the ANN and random forest results are fed to the model's classification unit, and the highest accuracy value is considered the final result. The proposed model is tested on standard IoT attack datasets, such as WUSTL_IIOT-2018, N_BaIoT, and Bot_IoT. The highest accuracy obtained is 99%. The results also demonstrate that the proposed model outperforms traditional techniques and thus improves the reliability of an IIoT network.