BoostedEnML: Efficient Technique for Detecting Cyberattacks in IoT Systems Using Boosted Ensemble Machine Learning

Abstract

Following the recent advances in wireless communication leading to increased Internet of Things (IoT) systems, many security threats are currently ravaging IoT systems, causing harm to information. Considering the vast application areas of IoT systems, ensuring that cyberattacks are holistically detected to avoid harm is paramount. Machine learning (ML) algorithms have demonstrated high capacity in helping to mitigate attacks on IoT devices and other edge systems with reasonable accuracy. However, the dynamics of operation of intruders in IoT networks require more improved IDS models capable of detecting multiple attacks with a higher detection rate and lower computational resource requirement, which is one of the challenges of IoT systems. Many ensemble methods have been used with different ML classifiers, including decision trees and random forests, to propose IDS models for IoT environments. The boosting method is one of the approaches used to design an ensemble classifier. This paper proposes an efficient method for detecting cyberattacks and network intrusions based on boosted ML classifiers. Our proposed model is named BoostedEnML. First, we train six different ML classifiers (DT, RF, ET, LGBM, AD, and XGB) and obtain an ensemble using the stacking method and another with a majority voting approach. Two different datasets containing high-profile attacks, including distributed denial of service (DDoS), denial of service (DoS), botnets, infiltration, web attacks, heartbleed, portscan, and botnets, were used to train, evaluate, and test the IDS model. To ensure that we obtained a holistic and efficient model, we performed data balancing with synthetic minority oversampling technique (SMOTE) and adaptive synthetic (ADASYN) techniques; after that, we used stratified K-fold to split the data into training, validation, and testing sets. Based on the best two models, we construct our proposed BoostedEnsML model using LightGBM and XGBoost, as the combination of the two classifiers gives a lightweight yet efficient model, which is part of the target of this research. Experimental results show that BoostedEnsML outperformed existing ensemble models in terms of accuracy, precision, recall, F-score, and area under the curve (AUC), reaching 100% in each case on the selected datasets for multiclass classification.

Transfer Learning Approach to IDS on Cloud IoT Devices Using Optimized CNN

“…Considering that we applied deep learning algorithms to develop our proposed model, we compared the result with more of similar existing deep learning models. Nevertheless, to show that the model is competitive with previous proposals and presents a state of the art functionality, we compared the performance of the proposed model with that of an RNN-based IDS using LSTM [20], [22] and tree-based machine learning algorithms [23]. According to [22], the LSTM-based IDS model with attention mechanism trained on the CSE-CICIDS2018 dataset showed an accuracy of 96.2%.…”

“…Hence, it has been applied to various areas, including networking and medical image processing [21] CNN has also worked efficiently on numeric tabular datasets used for modeling IDS. Classical machine learning tree-based algorithms including Decision Tree (DT), Random Forest (RF), Extra Tree (ET), eXtreme Gradient Boosting (XGBoost) etc have shown good performances in classification of network traffic that are not represented as image data [22], [23]. Other deep learning algorithms such as Recurrent Neural Network (RNN) [24] have been used for time series data analysis with good accuracy but this still suffers from the challenge of varnishing and exploding gradient which is overcome with the CNN architecture.…”

Intrusion detection model based on genetic algorithm optimization extreme learning machine of K-fold stratified cross-validation

“…Firstly, the classifier is trained by the training set, and then the model obtained by training is tested by the test set, which is used as the performance index to evaluate the classifier. K-fold cross-validation [10] is to divide the training data into K independent subsets, extract one subset as a test set without repetition, and combine the rest of K-1 subset data as a training set. Figure 1 shows the principle of 10-fold cross-validation.…”

A Machine Learning Approach for Walking Classification in Elderly People with Gait Disorders

“…Thus, the performance of ensemble learning models is generally higher than single classification algorithms [ 27 ]. There are various applications in which ensemble learning methods are utilized such as cyber security [ 28 , 29 , 30 , 31 , 32 , 33 ], energy [ 34 , 35 , 36 , 37 ], and health informatics [ 38 , 39 , 40 , 41 , 42 , 43 , 44 , 45 , 46 , 47 ].…”