Intrusion detection system for IoT application based on supervised learning

The Internet of Things (IoT) has evolved dramatically of recent years, and development of commercial and personal applications that can track a person's daily routine, attracting hackers to exploit the vulnerability to steal or modify collected data or disrupt system functions. To prevent hackers from compromising IoT devices, it is important to develop a method that captures and examines network traffic to identify and categorize malicious behavior that attackers may use. Therefore, this work uses a new IoT intrusion detection system designed to determine whether IoT network traffic is normal or potentially anomalous. The algorithm also determines the kind of anomaly if network traffic is deemed to be possibly abnormal. The performance of the proposed system was tested after selecting a dataset called IoTID20, which consists of 625,783 IoT network traffic packets, with 83 distinct features for each packet. The dataset is classified into three classes. The first class (Class I) classifies network traffic into normal or potential anomaly packets. The second class (Class II) classifies each anomalous network traffic into four main classes: 1. Mirai attacks. 2. Denial of service attacks (DoS), 3. Scanning. 4. Man-in-the-middle (MITM). The third class (Class III) classifies the anomalous network traffic into subclasses of the main classes. To identify the class of an IoT network packet, this system goes through four main stages: 1. Feature Preprocessing. 2.Feature selection. 3.Hyperparameter optimization. 4.Classification. In the feature preprocessing stage, the proposed system automatically removes the feature ID column and empty row values and handles useless feature distributions. Therefore, to find salient characteristics to represent each IoT network traffic, the feature extraction step uses correlation coefficient, particle swarm optimization (PSO), and grey wolf optimization (GWO). In this step, features 17, 16, and 22 are selected to represent network traffic for Category 1, Category 2, and Category 3, respectively. In addition, in this stege, four features are selected because they are the common features chosen from all the feature selection algorithms that make our system consume limited computing resources. In the penultimate stage, the Decision Tree (DT) hyperparameter is determined utilizing a Coronavirus Herd Immunity Optimizer (CHIO) to boost the effectiveness of the suggested system. Finally, IoT network traffic is classified using a decision tree algorithm through three phases. In the first phase, it is classified as normal or anomalous. In the case of an anomaly, the system identified the main and subcategories of the anomaly in the second and third phases. Many machine-learning techniques are used to train and test our proposed system; however, the decision tree outperforms other machine-learning algorithms, achieving 99.96%, 99.56%, and 77.6% accuracy for Phases 1, 2, and 3.