Enhancing internet of things intrusion detection through high-performance boosting ensemble learning

Area of Science:

• Cybersecurity
• Machine Learning
• Internet of Things (IoT)

Background:

• The proliferation of Internet of Things (IoT) devices presents significant security challenges.
• Traditional signature-based intrusion detection systems (IDS) are inadequate against rapidly evolving cyber threats.
• Resource-constrained IoT environments require efficient and accurate security solutions.

Purpose of the Study:

• To propose a lightweight intrusion detection system (IDS) for real-time malware detection in IoT environments.
• To evaluate the effectiveness of boosting ensemble learning techniques for identifying malicious network traffic.
• To address the limitations of traditional methods in terms of accuracy and computational efficiency.

Main Methods:

• Utilized the large-scale Aposemat IoT-23 dataset (over 25 million records).
• Performed extensive data preprocessing and exploratory data analysis to handle class imbalance and ensure statistical stability.
• Evaluated multiple machine learning models including logistic regression, Naïve Bayes, Random Forest, AdaBoost, XGBoost, and LightGBM using five-fold cross-validation.

Main Results:

• LightGBM demonstrated superior performance, achieving 99.9% accuracy, F1 Score, and ROC AUC.
• LightGBM exhibited significantly lower training time (612 seconds) compared to other models.
• Ensemble methods, particularly LightGBM, effectively minimized false negatives and false positives, as confirmed by confusion matrix analysis.

Conclusions:

• Boosting ensemble techniques, especially LightGBM, offer a scalable and high-performance solution for real-time malware detection in IoT.
• The proposed IDS effectively bridges the gap between detection accuracy and computational efficiency in resource-constrained environments.
• Enhanced ensemble methods represent a promising approach for securing the expanding Internet of Things ecosystem.