Exploring Evolutionary Algorithms for Optimal Features Selection to Detect Anomaly Based Intrusion In IoT

Abstract

In light of the fast-evolving scenario of the IoT, network security constantly bears immense challenges due to the increasing number of cyber threats and vulnerabilities. Traditional intrusion detection systems use predefined signatures and rule-based approaches to detect malicious activities within a network. In contrast to the traditional signature-based intrusion detection system, which utilizes previously established attack patterns, an anomaly-based intrusion detection system typically utilizes machine learning, statistical models, and artificial intelligence to assess network traffic, system log entries, and user behavior. . This research proposes the anomaly-based intrusion detection system using Particle Swarm Optimization (PSO)-based feature selection and ensemble learning in enhancing detection accuracy for IoT networks. Performance of stacking, hard voting, soft voting, and autoencoder-based models is evaluated over the benchmark datasets NSL-KDD and KDDCup 99 in analyzing their effectiveness in detecting anomalous behaviors in IoT environments. From the results, it is clear that PSO-based feature selection is highly significant in anomaly detection. Anomaly detection gets better performance by reducing feature redundancy along with improving classification accuracy. Of all the models tested, Stacking performed the best, with an accuracy of 98.87% on NSL-KDD and 99.76% on KDDCup 99, proving to be the most effective method. Soft Voting and Hard Voting also did well on NSL-KDD, recording 98.38% and 98.13% accuracy respectively, which highlighted the strength of ensemble methods in identifying anomalies based on IoT. The Autoencoder model demonstrated unsupervised anomaly detection, with a slightly less accurate of 96.63% on NSL-KDD and 98.23% on KDDCup 99, due to its greater false positive rates. This suggests that models based on deep learning could make a significant performance improvement on anomaly classification by leveraging their explicit feature selection capabilities. Stacking is an ensemble learning algorithm that increases predictive performance by aggregating multiple base models in a superior way. It can be used optimally when there exists some labeled data in supervised learning cases. Auto-Encoders correspondingly are neural networks deployed mainly in unsupervised learning, and they serve very well in detecting anomalies without labeled data.