Design of a new intrusion detection system for IoT networks

The widespread adoption of Internet of Things (IoT) technology has brought significant security vulnerabilities to the forefront. These devices, which have low hardware power, operate with various protocols, and are generally inadequate in terms of security, have become targets for malicious software such as Mirai, paving the way for large-scale DDoS attacks. The data set used is CIC-IoT2023, which is known for its up-to-date and realistic structure. From this data set, which includes 105 different devices and 33 attack types, Mirai variants and DDoS categories were specifically selected to ensure that the system could be tested in scenarios closer to real-world conditions. The model was trained in a Google Colab environment based on TensorFlow, and data imbalance was addressed using strategies such as SMOTE and class-weight. Methods such as chi-square and LightGBM were used for feature selection. The version of the CIC-IoT2023 dataset used in this study is configured to include various types of DDoS and Mirai-based attacks as well as normal (benign) traffic. Multi-class studies were conducted using LSTM, BiLSTM, and CNN-BiLSTM+Attention models. Missing and meaningless data in the dataset were cleaned to minimise deviations in model training. In particular, removing columns that caused memorisation in the model significantly reduced the risk of overfitting. In this study, RobustScaler and MinMaxScaler were used together to normalise the value ranges of the features. Since high-dimensional data was used, the chi² test was applied with the SelectKBest method, and the best 15 features were selected. While the LSTM and BiLSTM models yielded very similar results with 98% accuracy, the CNN-BiLSTM + Attention architecture performed worse, especially in the Mirai-Greeths and Mirai-Greips classes. ROC (Receiver Operating Characteristic) and PR (Precision-Recall) curves were evaluated to perform a detailed class-based analysis of model performance. The ROC curve for the LSTM model shows that the model has a highly successful discrimination capacity in general. AUC values of 1.00 were obtained for classes such as Benign, DDoS-SYN, DDoS-TCPs, DDoS-UDP, and Mirai-udpplains, while AUC values of 0.99 were observed for subclasses with similar patterns such as Mirai-Greeths and Mirai-Greips. The BiLSTM model can understand deeper contexts, especially in time-dependent patterns, thanks to its bidirectional learning capability. In the ROC curves for the BiLSTM model, the model achieved an AUC of 1.00 for Benign and DDoS types. However, AUC values of 0.97 were observed for the Mirai-Greeths class and 0.98 for Greips. The Precision-Recall (PR) curves of the CNN-BiLSTM + Attention model are critical for measuring class-based accuracy, especially in imbalanced data structures. In this model, while the AP (Average Precision) value was measured as 1.00 for the Benign and DDoS classes, AP = 0.84 was obtained for the Mirai-Greeths class and AP = 0.87 for the Mirai-Greips class. When the confusion matrix results of the three models are evaluated together, it is understood that the models make high-accuracy predictions in basic classes such as Benign, DDoS-SYN, DDoS-TCPs, and DDoS-UDP. However, in the Mirai subclasses, it has been more challenging for the models due to similar behaviour patterns. This situation reveals that the separability of the class structure should be considered in the model architecture selection. When compared with the literature, the results obtained show that the preferred method architectures in the data set offer a balanced solution in terms of both performance and processing time. This thesis demonstrates the effectiveness of artificial intelligence-supported solutions for attack detection in IoT environments and presents a pioneering system for sectoral applications. The results of the LSTM model in the Benign + Mirai + DDoS training, particularly the precision, recall, and f1-score metrics hovering around 0.999 levels across all classes, clearly demonstrate the model's success on time series data. This indicates that the model can detect true positives at a high rate and, in general, offers balanced classification performance. The fact that the validation loss is close to the training loss indicates that the model has not overfitted and has high generalisability. The loss value of 0.0015 calculated on the test data also supports this. Both training and validation accuracies remained at high levels, exceeding 99.9% especially after the 10th epoch. The absence of fluctuations in accuracy values as the epoch count increases demonstrates that the model has a stable learning process. Consequently, the 0.9995 accuracy rate obtained on the test data confirms the model's high performance. ROC curves are an important metric used to evaluate the classification performance of LSTM models. The fact that the AUC (Area Under Curve) value is calculated as 1.00 for all classes indicates that the model's ability to distinguish between positive and negative classes is close to perfect. The classification performance of the BiLSTM model has been summarised. The precision, recall, and F1-score values being at 0.999 levels for all classes indicate that the model produces highly balanced and accurate results. Compared to LSTM, the BiLSTM model has the advantage of being able to evaluate past and future contexts simultaneously in time series data. Although the overall success is quite high, a certain degree of confusion is observed, particularly between the Mirai and DDoS classes. The fact that 101 examples belonging to Mirai were predicted as DDoS indicates that these two attack types may exhibit similar behaviour patterns in some time windows. This situation is noteworthy in that it shows that structural similarities in models with bidirectional data flow may be perceived as similar by the model. However, the low overall error distribution proves that the model has strong learning capacity. The achieved test accuracy of 0.9995 confirms that the model can perform inter-class discrimination with high precision. Despite this success, the slight fluctuations observed in the validation curve indicate that the model can maintain flexible decision boundaries when encountering complex structures. It presents the comparative results of the LSTM, Bi-LSTM, and CNN-BiLSTM + Attention models. While all three models achieved high success rates, the CNN-BiLSTM + Attention model stood out in all metrics. This model not only made more accurate predictions with an accuracy rate of 0.9996 and a test loss of 0.0011, but also achieved a more stable and low-loss learning process. The 0.9997–0.9996 levels achieved in critical performance metrics such as precision, recall, and f1-score demonstrate that this model is more reliable in sensitive areas such as attack detection. The fact that the ROC-AUC value is 1.00, as with other models, indicates that top-level performance is maintained in terms of discriminative power. Therefore, choosing the CNN-BiLSTM + Attention model is a reasonable and recommendable approach, both in terms of metric superiority and operational reliability. When applying the LSTM model for benign and Mirai binary classification, the K-fold cross-validation method was preferred. This method ensures that the model is evaluated more reliably by testing it on different data subsets rather than just a single training-test split. The dataset is divided into a specific number of equal parts and the model is tested on each part while being trained on the remaining parts. This ensures that the model's overall performance is reflected more fairly across the entire dataset. During the K-Fold application, the training and validation loss and accuracy values of the model in each fold were monitored separately. It was observed that the loss values decreased steadily across all folds and the accuracy rates rose rapidly. In the best fold the test accuracy was close to 100% and the test loss was measured at only 0.0006. All precision, recall, and f1-score values reached levels of 0.9999, demonstrating that the model was successful not only in terms of accuracy but also in maintaining balance between classes. In this context, it can be said that the K-Fold method helped the model produce a more generalised representation without overfitting. In particular, evaluating the data distribution across all layers, independent of random splits, has increased the model's adaptability to different scenarios. Training loss initially dropped rapidly and then stabilised at low levels. Similarly, validation loss also decreased steadily, demonstrating the model's strong generalisation performance. BiLSTM can operate with minimal loss within a specific data slice, and the model parameters contribute optimally to both the learning process and validation performance. It has been observed that training and validation accuracies start at 0.99998, rapidly exceed 0.99999, and maintain this value throughout the process. When applying the LSTM model for benign and DDoS binary classification, the K-fold cross-validation method was preferred. This method utilised the K-Fold cross-validation technique. This application ensures that the model is tested more consistently and evenly across the entire dataset, without being confined to a specific subset of data. The model consistently delivered high accuracy rates during both training and validation across different folds. The AUC value for both classes was observed to be 1.00 on the ROC curve. According to the confusion matrix, the LSTM model classified the Benign and DDoS classes with very high accuracy. Classification errors occurred in only nine examples, clearly demonstrating the model's high classification capability. When examining the ROC curves, the AUC (Area Under Curve) values of 1.00 for the Benign and DDoS classes indicate that the model distinguishes between the classes without error and possesses very high discriminative power. In the loss graph obtained from the test data, it is observed that the training and validation loss values decrease over time and stabilise. Model's test accuracy, it is seen that the accuracy rates rise rapidly as the epoch progresses and stabilise at a high level. Furthermore, thanks to the K-Fold cross-validation method, it is observed that the model adapts to wider variations by being tested on different data subsets and that its generalisability increases. This study demonstrates that different deep learning architectures can detect attacks occurring in IoT networks with high accuracy rates. Specifically, the BiLSTM architecture provided the most balanced result in terms of both processing time and accuracy rate. The BiLSTM model was able to distinguish between DDoS and Mirai-type attacks with up to 98% accuracy, keeping inter-class confusion to a minimum. The inclusion of the CNN component contributed to spatial pattern extraction, but this contribution increased the training time in some cases. Although the attention architecture theoretically has the potential to learn more advanced patterns thanks to its attention mechanism, the results of this study show that in practical applications, a high number of parameters can lead to errors. Complex models struggled to distinguish between classes, particularly when there were significant similarities between subclasses, such as Mirai-Greeths and Mirai-Greips. The studies conducted revealed that model performance is not solely dependent on architectural choices; data balance, feature selection, and hyperparameter tuning are equally decisive factors. In experiments using features selected specifically by the Chi² method, the model showed less tendency towards overfitting. ROC curves, accuracy-F1 balance, and confusion matrix analyses also corroborate these findings. It can be stated that the system proposed in this thesis is particularly applicable in edge-based IoT security solutions and offers satisfactory results in terms of speed and accuracy. When the results obtained are compared with the literature, it is observed that the proposed solution is competitive and demonstrates superior performance in some respects.