An Aggregated Mutual Information Based Feature Selection with Machine Learning Methods for Enhancing IoT Botnet Attack Detection
Al-Sarem, Mohammed and Saeed, Faisal and Alkhammash, Eman and Alghamdi, Norah Saleh (2021) An Aggregated Mutual Information Based Feature Selection with Machine Learning Methods for Enhancing IoT Botnet Attack Detection. Sensors, 22 (1). p. 185. ISSN 1424-8220
|
Text
Accepted Paper - Sensors.pdf - Accepted Version Available under License Creative Commons Attribution. Download (4MB) |
Abstract
Due to the wide availability and usage of connected devices in Internet of Things (IoT) networks, the number of attacks on these networks is continually increasing. A particularly serious and dangerous type of attack in the IoT environment is the botnet attack, where the attackers can control the IoT systems to generate enormous networks of “bot” devices for generating malicious activities. To detect this type of attack, several Intrusion Detection Systems (IDSs) have been proposed for IoT networks based on machine learning and deep learning methods. As the main characteristics of IoT systems include their limited battery power and processor capacity, maximizing the efficiency of intrusion detection systems for IoT networks is still a research challenge. It is important to provide efficient and effective methods that use lower computational time and have high detection rates. This paper proposes an aggregated mutual information-based feature selection approach with machine learning methods to enhance detection of IoT botnet attacks. In this study, the N-BaIoT benchmark dataset was used to detect botnet attack types using real traffic data gathered from nine commercial IoT devices. The dataset includes binary and multi-class classifications. The feature selection method incorporates Mutual Information (MI) technique, Principal Component Analysis (PCA) and ANOVA f-test at finely-granulated detection level to select the relevant features for improving the performance of IoT Botnet classifiers. In the classification step, several ensemble and individual classifiers were used, including Random Forest (RF), XGBoost (XGB), Gaussian Naïve Bayes (GNB), k-Nearest Neighbor (k-NN), Logistic Regression (LR) and Support Vector Machine (SVM). The experimental results showed the efficiency and effectiveness of the proposed approach, which outperformed other techniques using various evaluation metrics.
| Item Type: | Article | ||||||
|---|---|---|---|---|---|---|---|
| Identification Number: | https://doi.org/10.3390/s22010185 | ||||||
| Dates: |
|
||||||
| Uncontrolled Keywords: | intrusion detection systems; Internet of Things; botnet attack detection; feature selection; machine learning; ensemble methods | ||||||
| Subjects: | CAH11 - computing > CAH11-01 - computing > CAH11-01-01 - computer science CAH11 - computing > CAH11-01 - computing > CAH11-01-05 - artificial intelligence |
||||||
| Divisions: | Faculty of Computing, Engineering and the Built Environment > School of Computing and Digital Technology | ||||||
| Depositing User: | Faisal Saeed | ||||||
| Date Deposited: | 05 Jan 2022 11:50 | ||||||
| Last Modified: | 05 Jan 2022 11:50 | ||||||
| URI: | https://www.open-access.bcu.ac.uk/id/eprint/12582 |
Actions (login required)
 |
View Item |
Tools
Tools