Machine Learning-Based Dynamic Attribute Selection Technique for DDoS Attack Classification in IoT Networks

Abstract

The exponential growth of the Internet of Things (IoT) has led to the rapid expansion of interconnected systems, which has also increased the vulnerability of IoT devices to security threats such as distributed denial-of-service (DDoS) attacks. In this paper, we propose a machine learning pipeline that specifically addresses the issue of DDoS attack detection in IoT networks. Our approach comprises of (i) a processing module to prepare the data for further analysis, (ii) a dynamic attribute selection module that selects the most adaptive and productive features and reduces the training time, and (iii) a classification module to detect DDoS attacks. We evaluate the effectiveness of our approach using the CICI-IDS-2018 dataset and five powerful yet simple machine learning classifiers—Decision Tree (DT), Gaussian Naive Bayes, Logistic Regression (LR), K-Nearest Neighbor (KNN), and Random Forest (RF). Our results demonstrate that DT outperforms its counterparts and achieves up to 99.98% accuracy in just 0.18 s of CPU time. Our approach is simple, lightweight, and accurate for detecting DDoS attacks in IoT networks.

Optimizing Intrusion Detection Systems in Three Phases on the CSE-CIC-IDS-2018 Dataset

“…Our findings differ from those of S. Ullah. et al [14], particularly in terms of CPU runtime and accuracy. They applied the SMOTE balance strategy, which resulted in a smaller dataset that was only focused on CPU runtime during training in a binary class environment.…”

“…Compares various models to the CSE-CIC-IDS-2018 dataset, measuring their accuracy, training time, and other performance measures. S. Ullah et al [14] employed a decision tree (DT) with random feature selection (30 features) to achieve an astounding 0.9998 accuracy in a very low training period (0.18 s). M. A. Khan.…”

“…The data was obtained through a ten-day period, eighty columns, and there are fifteen sorts of attacks: FTP-Brute Force, SSH-Brute Force, DoS attacks-GoldenEye, DoS attacks-Slowloris, DoS attacks-Hulk, DoS attacks-SlowHTTPTest, DDoS attacks-LOIC-HTTP, DDOS attack-HOIC, DDOS attack-LOIC-UDP, Brute Force-Web, Brute Force-XSS, SQL injection, infiltration, label, and bot. The study focuses on DDoS intrusions, because of a tough form, difficult to mitigate [14]. From analyzing data over a 10-day period, DDoS intrusions were found on the second day, namely 02-20-2018.csv (84 features) and 02-21-2018.csv (80 features).…”

“…Ullah. et al[14] Compares machine learning algorithms (RF, Bayes, LR, KNN, DT) and feature selection by RF (30 features) using CSE-CIC-IDS-2018 dataset. DT yielded the best results.…”

Enhancing DDoS Attack Detection Using Snake Optimizer With Ensemble Learning on Internet of Things Environment

“…Ullah et al [11] introduced an ML technique that specifically addresses the issues of DDoS attack recognition in IoT networks. This technique encompasses (a) a processing model to make the dataset for detailed examination, (b) a dynamic FS model that chooses very productive and adaptive features and decreases the training time, and (c) a classification model to identify DDoS attacks.…”