Securing the Digital Frontier: ML-Based Hierarchical Classification of Malicious Network Activities

With the rapid increase in internet-connected devices, cybersecurity threats have become more sophisticated and frequent. Traditional intrusion detection systems (IDS) that are based on signatures struggle to keep up with these evolving threats. This study investigates the effectiveness of machine learning (ML) models in detecting intrusions using the CIC IoT-IDAD 2024 dataset. Five ML algorithms—XGBoost, Random Forest, Naïve Bayes, AdaBoost, and Multi-Layer Perceptron (MLP)—are analyzed for their ability to identify malicious network activities. A two-stage classification approach is employed: in Stage 1, network traffic is categorized as benign, Denial-of-Service (DoS), Distributed Denial-of-Service (DDoS), or spoofing attacks, while Stage 2 refines the classification within these groups. Extensive data preprocessing, feature selection, and standardization are applied to optimize model performance. Model evaluation is conducted using accuracy, recall, and F1-score. The results indicate that ensemble-based models such as Random Forest and deep learning techniques like MLP achieve great classification accuracy, whereas Naïve Bayes offers computational efficiency. These findings highlight the potential of ML-driven IDS in strengthening IoT security against emerging cyber threats.