Enhancing IoT Cyber Attack Detection in the Presence of Highly Imbalanced Data

Due to the rapid growth in the number of Internet of Things (IoT) networks, the cyber risk has increased exponentially, and therefore, we have to develop effective IDS that can work well with highly imbalanced datasets. High rate of missed threats can be the result as traditional machine learning models tend to struggle in identifying attacks as normal data volume is so much higher than the volume of attacks. For example, the data set used in this study reveals a strong class imbalance with 94,659 instances of the majority class and only 28 instances of the minority class, in which determining rare attacks accurately is quite challenging. The challenges presented in this research are addressed by hybrid sampling techniques designed to drive data imbalance detection accuracy in IoT domains. After doing so, we then evaluate the performance of several machine learning models such as Random Forest, Soft Voting, Support Vector Classifier (SVC), K-Nearest Neighbors (KNN), Multi-Layer Perceptron (MLP) and Logistic Regression with respect to the classification of cyber-attacks accurately. The obtained results indicate that the Random Forest model achieved the best performance value of 0.9903 of Kappa score, 0.9961 of test accuracy and 0.9994 of AUC. It also shows strong performance in the Soft Voting model, with an accuracy of 0.9952 and AUC of 0.9997, while the latter is an indication of the benefits of combining models’ prediction. Overall, this work has shown the great benefit of hybrid sampling combined with robust model selection and feature selection to deliver a dramatic increase in of IoT security against cyber-attack, an important factor for implementing security in environments with strongly imbalanced data.