An investigation of machine learning techniques for an improved intrusion detection system for the internet of things.

Abstract

Internet of things (IoT) threats are difficult to detect because of the enormous variety of devices utilized in the internet of things environment. It is also challenging to design an effective security model for each type of device in the IoT. An intrusion detection system (IDS) is a tool for detecting network threats. Although IDSs have been well studied, it is challenging to realistically estimate their performance when deployed in real life due to the issues inherent to the datasets used to train them. This thesis examined machine learning (ML) techniques for an improved IDS for the IoT. During the investigation, a performance evaluation of some extensively used supervised ML methods was conducted using various benchmark imbalance datasets. Furthermore, a novel framework named random oversampling and tomek-links (RTL) was presented to minimize the effect of data imbalance in IDS datasets. Friedman and Dunn’s statistical tests were also conducted to examine the significant differences between classifiers with the primary goal of proposing an appropriate method for selecting diverse base classifiers for a stacking-type ensemble IDS. An intrusion detection model based on stacking ensemble named deep stacking of boosted machines (DSBM) was presented using extreme gradient boosting, light gradient boosting machine and gradient boosted machines as the base classifiers, and a deep neural network model as meta classifier. The proposed model was evaluated using records from all the nine devices in N-baIoT dataset. Several performance parameters such as accuracy, precision, recall, Fscore, the area under receiver operating characteristic curve, precision-recall curve, confusion matrix, matthew’s correlation coefficient, and kappa statistics were used to evaluate the proposed model. The transferability abilities of the proposed model were also studied by performing a cross-dataset evaluation using data samples from different devices in the N-BaIoT dataset as train and test sets to ensure that the proposed model can adjust to the inevitable changes in the network traffic generated by IoT. According to the results obtained, the proposed DSBM model is capable of outperforming other ML algorithms in terms of several metrics.