[论文解读] Smart IoT Security: Lightweight Machine Learning Techniques for Multi-Class Attack Detection in IoT Networks

Shahran Rahman Alve, Muhammad Zawad Mahmud+3 more|ArXiv.org|Feb 6, 2025

Network Security and Intrusion Detection被引用 3

一句话总结

该论文提出基于轻量级集成学习方法的多类物联网攻击检测，使用 CICIoT 2023 数据，发现 Decision Tree 为最佳，准确率 99.56%，F1 值 99.62%。

ABSTRACT

The Internet of Things (IoT) is expanding at an accelerated pace, making it critical to have secure networks to mitigate a variety of cyber threats. This study addresses the limitation of multi-class attack detection of IoT devices and presents new machine learning-based lightweight ensemble methods that exploit its strong machine learning framework. We used a dataset entitled CICIoT 2023, which has a total of 34 different attack types categorized into 10 categories, and methodically assessed the performance of a substantial array of current machine learning techniques in our goal to identify the best-performing algorithmic choice for IoT application protection. In this work, we focus on ML classifier-based methods to address the biocharges presented by the difficult and heterogeneous properties of the attack vectors in IoT ecosystems. The best-performing method was the Decision Tree, achieving 99.56% accuracy and 99.62% F1, indicating this model is capable of detecting threats accurately and reliably. The Random Forest model also performed nearly as well, with an accuracy of 98.22% and an F1 score of 98.24%, indicating that ML methods excel in a scenario of high-dimensional data. These findings emphasize the promise of integrating ML classifiers into the protective defenses of IoT devices and provide motivations for pursuing subsequent studies towards scalable, keystroke-based attack detection frameworks. We think that our approach offers a new avenue for constructing complex machine learning algorithms for low-resource IoT devices that strike a balance between accuracy requirements and time efficiency. In summary, these contributions expand and enhance the knowledge of the current IoT security literature, establishing a solid baseline and framework for smart, adaptive security to be used in IoT environments.

研究动机与目标

• 在多样化的网络威胁与资源约束下，推动安全的物联网网络。
• 研究用于多类物联网入侵检测的轻量级 ML 集成方法。
• 在超参数调优下识别最佳性能的分类器。
• 使用包含 34 种攻击类型、10 类的数据集 CICIoT 2023 进行模型评估。

提出的方法

• 使用包含 34 种攻击类型、10 类的 CICIoT 2023 数据集。
• 对数据进行预处理，包括处理缺失值和编码；将数据按 80/20 拆分用于训练/测试。
• 评估五种算法：Random Forest、Decision Tree、K-Nearest Neighbor、Gradient Boosting、AdaBoost。
• 应用 GridSearchCV 进行超参数调优，采用五折交叉验证。
• 计算精准率、召回率、F1 分数和准确率；分析 ROC/AUC 与混淆矩阵。

Figure 1: Workflow diagram of the system

实验结果

研究问题

• RQ1 在 CICIoT 2023 上，哪一种轻量级 ML 分类器在多类物联网攻击检测中的准确率和 F1 值最高？
• RQ2 经典 ML 模型在 34 种攻击类型下在精度、召回率、F1、ROC 指标方面的对比如何？
• RQ3 超参数调优对物联网安全任务的模型性能有何影响？
• RQ4 低资源物联网设备能否用简单模型实现高准确率的入侵检测？

主要发现

Model	Precision	Recall	F1 Score	Accuracy (%)
Random Forest	0.981	0.982	0.982	98.22
Decision Tree	0.997	0.995	0.996	99.56
Gradient Boosting	0.981	0.971	0.982	98.19
AdaBoost	0.972	0.945	0.966	96.26
K-Nearest Neighbor	0.963	0.955	0.962	96.11

• Decision Tree 达到最高的准确率（99.56%）和 F1（99.62%）。
• Random Forest 也表现出色，准确率 98.22%，F1 98.24%。
• Gradient Boosting 的准确率为 98.19%，F1 为 0.982，AdaBoost 96.26% 的准确率，KNN 96.11% 的准确率。
• Decision Tree 的 ROC AUC 为 1.00，Random Forest 为 0.99，显示出强烈的判别能力。
• 与前期研究的比较表明，所提 DT 模型在 CICIoT 2023 数据集上为测试方法中的最佳选择。

Figure 2: ROC curve of Decision Tree Classifier