HOMLC-Hyperparameter Optimization for Multi-Label Classification of Intrusion Detection Data for Internet of Things...

Area of Science:

• Cybersecurity
• Machine Learning
• Network Security

Background:

• Intrusion detection systems (IDS) are crucial for network security.
• Multi-label classification of cyber-attacks presents a significant challenge.
• Low-rank-based learning models offer a promising approach for complex data analysis.

Purpose of the Study:

• To compare the performance of low-rank-based machine learning and deep learning models for multi-label attack categorization in intrusion detection.
• To investigate the impact of hyperparameter optimization on model performance.
• To evaluate models on hybrid datasets combining public intrusion detection data.

Main Methods:

• Investigated Low Rank Representation (LRR) and Non-negative Low Rank Representation (NLR) based models: LR-SVM, LR-CNN, and LR-CNN-MLP.
• Utilized Gaussian Bayes Optimization for hyperparameter tuning.
• Evaluated models on a hybrid dataset merging BoT-IoT and UNSW-NB15.
• Assessed performance using precision, recall, F1 score, and accuracy.

Main Results:

• All three low-rank models demonstrated improved performance after hyperparameter tuning.
• Low rank CNN-MLP achieved notable results in multi-label attack classification.
• The UDP label was accurately classified among analysis, DoS, and shellcode with 98.54% accuracy.

Conclusions:

• Hyperparameter tuning is vital for enhancing the effectiveness of low-rank models in intrusion detection.
• Low-rank-based deep learning models, particularly LR-CNN-MLP, are effective for multi-label attack classification.
• The study highlights the significance of hybrid datasets and optimized models for robust network security.