Enhancing IoT Cyber Attack Detection in the Presence of Highly Imbalanced Data

2025-03-07

International Conference on Communication Systems and Network Technologies

AI Summary

To address the high false-negative rate of conventional intrusion detection systems (IDS) in IoT networks—caused by extreme class imbalance (94,659:28 benign-to-attack ratio)—this paper proposes a hybrid framework integrating resampling, feature selection, and ensemble learning for IoT security. The method innovatively combines SMOTE-Tomek Links (a hybrid oversampling–undersampling technique) with Recursive Feature Elimination (RFE) for rigorous feature subset optimization, followed by Soft Voting ensemble of Random Forest, Support Vector Classifier (SVC), k-Nearest Neighbors (KNN), Multilayer Perceptron (MLP), and Logistic Regression. Experimental results on real-world imbalanced IoT traffic data show that the standalone Random Forest achieves a Cohen’s Kappa of 0.9903 and AUC of 0.9994; the Soft Voting ensemble further attains an AUC of 0.9997. The framework significantly improves detection of rare attacks while demonstrating strong robustness and generalizability under severe class imbalance.

Technology Category

• Machine Learning: Ensemble Methods
• Data Mining & Knowledge Management: Anomaly/Outlier Detection
• Application Domains: Internet of Things, Sensor Networks & Smart Cities

Application Category

• Systems and Infrastructure for Web, Mobile and WoT: Applied ML and AI for Web-based mobile applications
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Security and Privacy: Large-scale security measurements

Abstract

Due to the rapid growth in the number of Internet of Things (IoT) networks, the cyber risk has increased exponentially, and therefore, we have to develop effective IDS that can work well with highly imbalanced datasets. High rate of missed threats can be the result as traditional machine learning models tend to struggle in identifying attacks as normal data volume is so much higher than the volume of attacks. For example, the data set used in this study reveals a strong class imbalance with 94,659 instances of the majority class and only 28 instances of the minority class, in which determining rare attacks accurately is quite challenging. The challenges presented in this research are addressed by hybrid sampling techniques designed to drive data imbalance detection accuracy in IoT domains. After doing so, we then evaluate the performance of several machine learning models such as Random Forest, Soft Voting, Support Vector Classifier (SVC), K-Nearest Neighbors (KNN), Multi-Layer Perceptron (MLP) and Logistic Regression with respect to the classification of cyber-attacks accurately. The obtained results indicate that the Random Forest model achieved the best performance value of 0.9903 of Kappa score, 0.9961 of test accuracy and 0.9994 of AUC. It also shows strong performance in the Soft Voting model, with an accuracy of 0.9952 and AUC of 0.9997, while the latter is an indication of the benefits of combining models’ prediction. Overall, this work has shown the great benefit of hybrid sampling combined with robust model selection and feature selection to deliver a dramatic increase in of IoT security against cyber-attack, an important factor for implementing security in environments with strongly imbalanced data.

Problem

• Detecting cyber attacks in IoT with imbalanced data
• Improving IDS accuracy for rare attack identification
• Evaluating ML models for IoT security enhancement

Innovation

• Hybrid sampling techniques for data imbalance
• Random Forest model achieves best performance
• Soft Voting combines models for accuracy