Leveraging machine learning for profiling IoT devices to identify malicious activities

Protecting IoT devices is a relevant and important task in the context of a constantly increasing number of devices connected to the network and a growing threat of cyberattacks. One of the key solutions to this problem is profiling such devices to increase the security level of the systems in which they operate. The application of machine learning methods represents a promising approach to solving this problem. This study presents a method for profiling Internet of Things (IoT) devices aimed at detecting malicious activity. The proposed solution enables the identification of network events that may indicate the presence of cyberattacks. The essence of the method lies in the creation of individualized behavioral profiles for each IoT device using machine learning algorithms. Profiles are constructed based on the analysis of network traffic. The machine learning models are employed to perform classification and anomaly detection tasks. The study provides a detailed description of the main stages of the proposed approach, including data collection and preprocessing, model selection and training, testing, and evaluation of the effectiveness of the developed solution. In the course of the study, 26 device profiles were constructed using the CIC IoT 2022 dataset. An additional 21 new features were incorporated into the original dataset. The augmented dataset was balanced using oversampling and undersampling techniques. For each device comparative performance evaluations were conducted for Random Forest, XGBoost, and CatBoost models in the context of attack detection as well as for Isolation Forest, Elliptic Envelope, and One-Class Support Vector Machine for anomaly detection. It was demonstrated that the newly proposed features are among the most informative. A comparison of the obtained results with relevant studies confirmed the applicability of the proposed approach for ensuring the security of IoT devices and reducing the risks associated with their operation.