Using Embedded Feature Selection and CNN for Classification on CCD-INID-V1-A New IoT Dataset

Area of Science:

• Cybersecurity
• Network Intrusion Detection
• Machine Learning for IoT Security

Background:

• The expanding global Internet of Things (IoT) networks necessitate enhanced safeguards against cyber threats.
• Existing intrusion detection systems (IDS) often face limitations due to the dynamic nature and resource constraints of IoT environments.
• Publicly available datasets frequently lack relevance to current IoT network behaviors and attack vectors.

Purpose of the Study:

• To address the need for effective and lightweight IDS tailored for IoT networks.
• To introduce a novel hybrid IDS combining embedded models for feature selection and CNNs for detection and classification.
• To evaluate the performance of the proposed models on a new IoT-specific dataset and existing benchmarks.

Main Methods:

• Development of the Center for Cyber Defense (CCD) IoT Network Intrusion Dataset V1 (CCD-INID-V1).
• Proposal of a hybrid lightweight IDS featuring embedded models (Random Forest - RF, eXtreme Gradient Boosting - XGBoost) for feature selection and Convolutional Neural Networks (CNNs) for classification.
• Two models were evaluated: RCNN (RF + CNN) and XCNN (XGBoost + CNN) for both anomaly (binary) and attack-based (multiclass) classifications on CCD-INID-V1, Balot, and DoH20 datasets.

Main Results:

• Both RCNN and XCNN demonstrated high performance, achieving Area Under the ROC Curve (AUC) scores above 0.956 across all tested datasets.
• XCNN achieved an AUC of 0.998 on CCD-INID-V1, while RCNN achieved 0.956, with comparable high scores on Balot and DoH20.
• The proposed models significantly reduced computational time compared to KNN, with RCNN and XCNN requiring 91.74% and 86.98% less time, respectively, while maintaining or improving accuracy.

Conclusions:

• The RCNN and XCNN models offer a computationally efficient and scalable solution for IoT intrusion detection.
• The lightweight nature and reduced training time of these models enable flexible deployment on resource-constrained edge devices and central servers.
• The proposed IDS effectively detects anomalies and categorizes cyberattacks, offering a promising advancement in IoT network security and reducing reaction time to emerging threats.