Classification Model for Bot-IoT Attack Detection Using Correlation and Analysis of Variance

Industry 4.0 requires secure networks as the advancements in IoT and AI exacerbate the challenges and vulnerabilities in data security. This research focuses on detecting Bot-IoT activity using the Bot-IoT UNSW Canberra 2018 dataset. The dataset initially showed a significant imbalance, with 2,934,447 entries of attack activity and only 370 entries of normal activity. To address this imbalance, an innovative data aggregation technique was applied, effectively reducing similar patterns and trends. This approach resulted in a balanced dataset consisting of 8 attack activity points and 80 normal activity points. Feature selection using the ANOVA method identified 10 key features from a total of 17: seq, stddev, N_IN_Conn_P_SrcIP, min, state_number, mean, N_IN_Conn_P_DstIP, drate, srate, and max. The classification process utilized Random Forest, k-NN, Naïve Bayes, and Decision Tree algorithms, with 100 iterations and an 80:20 training-testing split. Random Forest showed superior performance, achieving 97.5% accuracy, 97.4% precision, and 97.4% recall, with a total computation time of 11.54 seconds. Pearson correlation analysis revealed a strong positive correlation (+0.937) between N_IN_Conn_P_DstIP and seq, as well as a weak negative correlation (-0.224) between N_IN_Conn_P_SrcIP and state_number. The novelty of this research lies in the application of a data aggregation technique to address class imbalance, significantly improving machine learning model performance and optimizing training time. These findings contribute to the development of robust cybersecurity systems to effectively detect IoT-related threats.