Intrusion Detection Framework for Internet of Things with Rule Induction for Model Explanation

Area of Science:

• Cybersecurity
• Machine Learning
• Internet of Things (IoT)

Background:

• The rapid expansion of Internet of Things (IoT) devices introduces significant security and privacy challenges due to their resource constraints and diverse nature.
• Vulnerabilities in IoT systems can be exploited by attackers through various threats like spoofing and denial-of-service attacks.
• Intrusion Detection Systems (IDS) are crucial for monitoring network traffic and detecting security breaches in IoT environments.

Purpose of the Study:

• To develop and evaluate an IDS framework integrating ensemble learning with rule induction for enhanced IoT security.
• To assess the performance of five ensemble learning algorithms for effective intrusion detection in IoT networks.
• To provide a transparent and explainable IDS solution for better decision-making by stakeholders.

Main Methods:

• Implemented an IDS framework utilizing ensemble learning algorithms: Random Forest, AdaBoost, XGBoost, LightGBM, and CatBoost.
• Evaluated the performance of these algorithms on two public datasets: CIC-IDS2017 and CICIoT2023.
• Integrated a rule induction method to enhance the explainability of the developed IDS models.

Main Results:

• XGBoost significantly outperformed other ensemble algorithms in intrusion detection accuracy and AUC-ROC.
• On the CIC-IDS2017 dataset, XGBoost achieved 99.91% accuracy and 99.88% AUC-ROC.
• On the CICIoT2023 dataset, XGBoost achieved 98.54% accuracy and 93.06% AUC-ROC, demonstrating robust performance.

Conclusions:

• The proposed IDS framework effectively enhances IoT security through superior intrusion detection capabilities.
• The integration of rule induction provides a lightweight, transparent, and trustworthy IDS.
• The system supports security analysts and stakeholders in making informed decisions regarding intrusion events.