An Aggregated Mutual Information Based Feature Selection with Machine Learning Methods for Enhancing IoT Botnet Attack Detection

Abstract

Due to the wide availability and usage of connected devices in Internet of Things (IoT) networks, the number of attacks on these networks is continually increasing. A particularly serious and dangerous type of attack in the IoT environment is the botnet attack, where the attackers can control the IoT systems to generate enormous networks of “bot” devices for generating malicious activities. To detect this type of attack, several Intrusion Detection Systems (IDSs) have been proposed for IoT networks based on machine learning and deep learning methods. As the main characteristics of IoT systems include their limited battery power and processor capacity, maximizing the efficiency of intrusion detection systems for IoT networks is still a research challenge. It is important to provide efficient and effective methods that use lower computational time and have high detection rates. This paper proposes an aggregated mutual information-based feature selection approach with machine learning methods to enhance detection of IoT botnet attacks. In this study, the N-BaIoT benchmark dataset was used to detect botnet attack types using real traffic data gathered from nine commercial IoT devices. The dataset includes binary and multi-class classifications. The feature selection method incorporates Mutual Information (MI) technique, Principal Component Analysis (PCA) and ANOVA f-test at finely-granulated detection level to select the relevant features for improving the performance of IoT Botnet classifiers. In the classification step, several ensemble and individual classifiers were used, including Random Forest (RF), XGBoost (XGB), Gaussian Naïve Bayes (GNB), k-Nearest Neighbor (k-NN), Logistic Regression (LR) and Support Vector Machine (SVM). The experimental results showed the efficiency and effectiveness of the proposed approach, which outperformed other techniques using various evaluation metrics.

Enhancing the Security of Botnet Attacks Detection Using Parallel Gradient Descent Optimized Four Layered Network (PGDOFLN)

“…The suggested approach demonstrated efficient sequential analysis in improving IoT security. The research [19] suggested a novel method for improving botnet attack detection in IoT networks. They used an aggregated mutual information-based feature selection method combined with ML techniques.…”

An Improved Mutual Information Feature Selection Technique for Intrusion Detection Systems in the Internet of Medical Things

“…While augmentation-based solutions, such as oversampling or synthetic data generation, can help to increase the amount of available data and improve the performance of information theory-based feature selection methods, there are also potential drawbacks to consider. One potential issue with augmentation-based solutions is the risk of introducing bias or noise into the data [ 44 ]. Oversampling, for example, can lead to the overrepresentation of certain classes or instances in the data, which can bias the machine learning algorithm towards these classes or instances.…”

“…Recent studies have shown that feature selection is crucial for improving the performance of intrusion detection systems (IDS) in various IoT environments [ 42 , 43 , 44 ]. One of the most commonly used feature selection techniques is the filter approach, which selects features based on their statistical properties and relevance to the problem [ 45 ].…”

“…One of the most commonly used feature selection techniques is the filter approach, which selects features based on their statistical properties and relevance to the problem [ 45 ]. Filter methods for feature selection in intrusion detection systems (IDS) in IoT environments are based on the statistical properties and relevance of features to the problem [ 44 ]. Some commonly used filter methods include the chi-square test, information gain, and mutual information [ 46 ].…”

“…Mutual information feature selection is a commonly used filter method for improving the performance of intrusion detection systems (IDS) in various IoT environments [ 46 , 48 ]. This method measures the dependence between each feature and the class label and selects the features with the highest mutual information scores [ 44 ]. The main advantage of using mutual information is that it considers the nonlinear relationships between features and class labels, making it suitable for handling complex and nonlinear data patterns in IoT environments [ 48 , 49 ].…”