Enhanced intrusion detection system using feature selection and hybrid learning models for high performance and efficiency in an IOT environment

Attacks on automated systems are increasingly frequent, sophisticated, intelligent and distributed, posing serious threats to an Internet of Things (IoT) environment and necessitating costly interventions. Intrusion detection systems (IDSs) therefore play an essential role in protecting IoT environments against these types of attack. However, traditional IDS detection methods, which are mainly based on signatures and rules, face significant challenges such as an inability to detect unknown attacks, resulting in low detection rates, high false positive rates and long response times. To overcome these limitations, this paper proposes a novel deep learning approach for binary classification of network traffic (normal vs. attack) in the context of anomaly detection, using convolutional neural networks (CNNs) and feature selection techniques for an IDS. A CNN is leveraged for its ability to detect spatial patterns in network characteristics, a crucial capability in dynamic and distributed IoT environments where the modeling of normal behavior is challenging. To mitigate data imbalance, our model applies a two-stage strategy: first, the Synthetic Minority Oversampling Technique (SMOTE) is used for global balancing before dataset splitting, and second, a class weighting technique is applied after splitting, during training. The aim of this approach is to enhance detection accuracy and reduce the execution time, to provide a more effective IDS for IoT networks. We conduct experiments on CICIDS2017, a widely used benchmark dataset, to evaluate and compare the performance of Random Forest (RF), LightGBM and XGBoost classifiers, both with and without feature selection. The results show remarkable improvements in regard to accuracy (99.95%), precision (99.99%), and recall (99.91%), especially with the XGBoost model with 40 selected features, while maintaining a very competitive runtime that is significantly lower than comparable methods in existing studies. Furthermore, our model outperforms other existing schemes in terms of performance, efficiency and scalability.