OMIC: A Bagging-Based Ensemble Learning Framework for Large-Scale IoT Intrusion Detection

The research focuses on developing an Optimized Multiclass Intrusion Classifier (OMIC), an advanced framework for large-scale network intrusion detection in IoT environments. Traditional intrusion detection systems face significant challenges with increasing network complexity, attack sophistication, and the exponential growth of IoT devices, particularly in handling class imbalance, computational efficiency, and real-time processing of massive data volumes. OMIC introduces a novel ensemble approach combining LightGBM and XGBoost classifiers with a memory-optimized processing pipeline to address these limitations. The framework implements sophisticated data handling techniques, including dynamic chunk-based processing, adaptive sampling methods, and cost-sensitive learning to manage class imbalance. Experimental evaluation using the comprehensive CICIoT2023 dataset, comprising over 1 million records and 33 distinct attack types, demonstrates OMIC's exceptional performance with an overall accuracy of 99.26%. The framework achieves perfect precision, recall, and F1-scores for most DDoS and DoS attack categories, significantly outperforming traditional machine learning and deep learning approaches. While excelling in most attack categories, OMIC shows limitations in detecting certain web-based attacks and reconnaissance activities, suggesting areas for future enhancement. The framework's superior performance in handling large-scale data while maintaining high detection accuracy positions it as a significant advancement in IoT network security, offering practical solutions for real-world deployments.