IIDS: Design of Intelligent Intrusion Detection System for Internet-of-Things Applications

TL;DR

This paper proposes a machine learning framework using Random Forest to improve intrusion detection in IoT applications, especially addressing imbalanced datasets and enhancing F1 scores for better security in critical sectors.

Contribution

The study introduces a novel ML-based intrusion detection framework that significantly improves detection metrics on the CICIoT2023 dataset, focusing on imbalanced data challenges.

Findings

Improved F1 score by up to 4.69% over existing methods

Significant F1 score enhancement for underperforming classes by 7.9%

Demonstrated effectiveness of RF algorithm in IoT intrusion detection

Abstract

With rapid technological growth, security attacks are drastically increasing. In many crucial Internet-of-Things (IoT) applications such as healthcare and defense, the early detection of security attacks plays a significant role in protecting huge resources. An intrusion detection system is used to address this problem. The signature-based approaches fail to detect zero-day attacks. So anomaly-based detection particularly AI tools, are becoming popular. In addition, the imbalanced dataset leads to biased results. In Machine Learning (ML) models, F1 score is an important metric to measure the accuracy of class-level correct predictions. The model may fail to detect the target samples if the F1 is considerably low. It will lead to unrecoverable consequences in sensitive applications such as healthcare and defense. So, any improvement in the F1 score has significant impact on the resource protection. In this paper, we present a framework for ML-based intrusion detection system for an imbalanced dataset. In this study, the most recent dataset, namely CICIoT2023 is considered. The random forest (RF) algorithm is used in the proposed framework. The proposed approach improves 3.72%, 3.75% and 4.69% in precision, recall and F1 score, respectively, with the existing method. Additionally, for unsaturated classes (i.e., classes with F1 score < 0.99), F1 score improved significantly by 7.9%. As a result, the proposed approach is more suitable for IoT security applications for efficient detection of intrusion and is useful in further studies.