Intrusion detection in IoT networks using machine learning

The Internet of Things (IoT) has rapidly expanded, integrating countless devices into our physical world and extending the reach of the Internet beyond computers, tablets, and phones. This growth has made our lives more convenient and industries more efficient. However, it has also brought numerous security challenges and expanded the area of cyber-attacks, particularly in regard to DoS and DDoS attacks. Furthermore, since many IoT devices run custom or outdated operating systems and lack the resources to run typical intrusion detection systems; researchers have focused on developing new lightweight intrusion detection methods. In this study, we investigated the detection of various DoS attacks on the IoT network using machine learning techniques. The attacks we studied included TCP Syn-Flood Attack, UDP Flood Attack, HTTP Slowloris GET Attack, Apache Range Header DoS, and Port Scan attack. To create a real-world smart home environment, we proposed a new dataset named HEIoT21, generated by a collective of IoT devices and non-IoT devices connected to a wireless network. The proposed dataset included normal and anomaly data, and using the CiCflowmeter application, we extracted 82 network features. The dataset was labeled and categorized into binary-class and multi-class, and we used three feature selection techniques, namely Anova F-value Feature Selection, Random Forest importance feature selection, and Sequential Forward Feature Selection, to reduce the number of features. The feature selection techniques produced three sub-datasets that were evaluated using multiple machine learning algorithms such as Logistic Regression (LR), J48 Decision Tree (DT), Naïve Bayes, and Artificial Neural Network (ANN). A comparison study was conducted on the results obtained from applying the different machine learning algorithms to the derived sub-datasets. The study found that the most suitable feature selection technique for the proposed dataset was Anova F-value. The best-fit machine learning algorithm for the proposed dataset was The Decision Tree, which produced an accuracy result of 99.92% for binary classification and 99.94% for multi-class classification. After comparing our study with others in the field of IoT intrusion detection, we found that our results surpassed those of the majority of other studies. This makes our proposed dataset extremely valuable for anyone interested in analyzing and detecting current network security threats. Furthermore, this study could serve as a cornerstone for a complete lightweight intrusion detection system, as it provides a solid foundation for expanding the dataset to include other types of attacks, introducing new detection rules, and integrating an alert mechanism to create a comprehensive detection system.