Abstract:Internet of Things (IoT) devices are leading to advancements in innovation, efficiency, and sustainability across various industries. However, as the number of connected IoT devices increases, the risk of intrusion becomes a major concern in IoT security. To prevent intrusions, it is crucial to implement intrusion detection systems (IDSs) that can detect and prevent such attacks. IDSs are a critical component of cybersecurity infrastructure. They are designed to detect and respond to malicious activities within a network or system. Traditional IDS methods rely on predefined signatures or rules to identify known threats, but these techniques may struggle to detect novel or sophisticated attacks. The implementation of IDSs with machine learning (ML) and deep learning (DL) techniques has been proposed to improve IDSs' ability to detect attacks. This will enhance overall cybersecurity posture and resilience. However, ML and DL techniques face several issues that may impact the models' performance and effectiveness, such as overfitting and the effects of unimportant features on finding meaningful patterns. To ensure better performance and reliability of machine learning models in IDSs when dealing with new and unseen threats, the models need to be optimized. This can be done by addressing overfitting and implementing feature selection. In this paper, we propose a scheme to optimize IoT intrusion detection by using class balancing and feature selection for preprocessing. We evaluated the experiment on the UNSW-NB15 dataset and the NSL-KD dataset by implementing two different ensemble models: one using a support vector machine (SVM) with bagging and another using long short-term memory (LSTM) with stacking. The results of the performance and the confusion matrix show that the LSTM stacking with analysis of variance (ANOVA) feature selection model is a superior model for classifying network attacks. It has remarkable accuracies of 96.92% and 99.77% and overfitting values of 0.33% and 0.04% on the two datasets, respectively. The model's ROC is also shaped with a sharp bend, with AUC values of 0.9665 and 0.9971 for the UNSW-NB15 dataset and the NSL-KD dataset, respectively.

Performance optimization for Intrusion Detection by Long Short Term Memory (LSTM)

Intrusion detection systems using long short-term memory (LSTM)

An Enhanced Hybrid Intrusion Detection Using Mapreduce-Optimized Black Widow Convolutional LSTM Neural Networks

An Enhanced Deep Neural Network Enabled with Cuckoo Search Algorithm for Intrusion Detection in Wide Area Networks

A Scalable Network Intrusion Detection System using Bi-LSTM and CNN

Using a Long Short-Term Memory Recurrent Neural Network (LSTM-RNN) to Classify Network Attacks

Efficient Deep CNN-BiLSTM Model for Network Intrusion Detection

A Novel Two-Stage Deep Learning Model for Network Intrusion Detection: LSTM-AE

Deep learning method for efficient cloud IDS utilizing combined behavior and flow-based features

Optimizing IoT Intrusion Detection Using Balanced Class Distribution, Feature Selection, and Ensemble Machine Learning Techniques

Robust Network Intrusion Detection Scheme Using Long-Short Term Memory Based Convolutional Neural Networks

An optimized Bi-LSTM with random synthetic over-sampling strategy for network intrusion detection

A Hybrid Modified Deep Learning Architecture for Intrusion Detection System with Optimal Feature Selection

Performance evaluation of Machine learning algorithms for Intrusion Detection System

An Artificial Intelligence-based, Big Data-aware, Long-lasting Security Solution for the Internet of Things

An LSTM‐based novel near‐real‐time multiclass network intrusion detection system for complex cloud environments

OOA-modified Bi-LSTM network: An effective intrusion detection framework for IoT systems

Intrusion detection system using classification algorithms with feature selection mechanism over real-time data traffic

Intrusion Detection System with Machine Learning and Multiple Datasets

Time‐based DDoS attack detection through hybrid LSTM‐CNN model architectures: An investigation of many‐to‐one and many‐to‐many approaches