Using Embedded Feature Selection and CNN for Classification on CCD-INID-V1—A New IoT Dataset

Abstract

As Internet of Things (IoT) networks expand globally with an annual increase of active devices, providing better safeguards to threats is becoming more prominent. An intrusion detection system (IDS) is the most viable solution that mitigates the threats of cyberattacks. Given the many constraints of the ever-changing network environment of IoT devices, an effective yet lightweight IDS is required to detect cyber anomalies and categorize various cyberattacks. Additionally, most publicly available datasets used for research do not reflect the recent network behaviors, nor are they made from IoT networks. To address these issues, in this paper, we have the following contributions: (1) we create a dataset from IoT networks, namely, the Center for Cyber Defense (CCD) IoT Network Intrusion Dataset V1 (CCD-INID-V1); (2) we propose a hybrid lightweight form of IDS—an embedded model (EM) for feature selection and a convolutional neural network (CNN) for attack detection and classification. The proposed method has two models: (a) RCNN: Random Forest (RF) is combined with CNN and (b) XCNN: eXtreme Gradient Boosting (XGBoost) is combined with CNN. RF and XGBoost are the embedded models to reduce less impactful features. (3) We attempt anomaly (binary) classifications and attack-based (multiclass) classifications on CCD-INID-V1 and two other IoT datasets, the detection_of_IoT_botnet_attacks_N_BaIoT dataset (Balot) and the CIRA-CIC-DoHBrw-2020 dataset (DoH20), to explore the effectiveness of these learning-based security models. Using RCNN, we achieved an Area under the Receiver Characteristic Operator (ROC) Curve (AUC) score of 0.956 with a runtime of 32.28 s on CCD-INID-V1, 0.999 with a runtime of 71.46 s on Balot, and 0.986 with a runtime of 35.45 s on DoH20. Using XCNN, we achieved an AUC score of 0.998 with a runtime of 51.38 s for CCD-INID-V1, 0.999 with a runtime of 72.12 s for Balot, and 0.999 with a runtime of 72.91 s for DoH20. Compared to KNN, XCNN required 86.98% less computational time, and RCNN required 91.74% less computational time to achieve equal or better accurate anomaly detections. We find XCNN and RCNN are consistently efficient and handle scalability well; in particular, 1000 times faster than KNN when dealing with a relatively larger dataset-Balot. Finally, we highlight RCNN and XCNN’s ability to accurately detect anomalies with a significant reduction in computational time. This advantage grants flexibility for the IDS placement strategy. Our IDS can be placed at a central server as well as resource-constrained edge devices. Our lightweight IDS requires low train time and hence decreases reaction time to zero-day attacks.

A Novel Method for Survival Prediction of Hepatocellular Carcinoma Using Feature-Selection Techniques

“…This section shows how well our feature-selection model works compared to the previous works in this field. Ksi ą żek, Gandor et al [47] used a genetic algorithm with logistic regression for feature selection and used logistic regression for classification. They used data for training and testing, achieving accuracy and F1-scores of 94.55% and 93.56%, respectively, with 22 features.…”

“…The result of a work [36] based on the usage of neural networks is 75.19% accurate. The use of genetic algorithms to optimize models [46,47] resulted in a substantial improvement in the results obtained; the best accuracy of such models is 94.55%. The authors of [38] introduced a novel hybrid model that combined neighborhood-components analysis, a genetic algorithm, and a support-vector machine classifier (NCA-GA-SVM).…”

“…Therefore, while analyzing various metrics, it is concluded that the proposed work shows better results than other works in the literature. We used the same data for training and testing and achieved accuracy and F1-score values of 96.66% and 95.66%, respectively, with minimal features.Many other related work can be found in [38,39,46,47].…”

Application of Machine Learning Algorithms for the Validation of a New CoAP-IoT Anomaly Detection Dataset

“…Furthermore, Abbasi [11] exploited the dataset for classification using logistic regression (LR) and artificial neural networks (ANN). • CCD-INID-V1: Liu et al [12] created a new dataset to identify traffic anomalies in IoT networks. In addition, they developed a hybrid intrusion detection method that incorporated an embedded model for feature selection and a convolutional neural network (CNN) for attack classification.…”

IoT Dataset Validation Using Machine Learning Techniques for Traffic Anomaly Detection

“…Liu et al [26] created a publicly available dataset using smart sensors in an IoT network. The data was collected in the smart lab and smart home environments using Rainbow HAT sensor boards installed on Raspberry Pis.…”