Analysis of Intrusion Detection Using Ensemble Stacking-Based Machine Learning Techniques in IoT Networks

Abstract

In the past few years, numerous machine learning techniques have been employed in IoT networks to develop Intrusion Detection Systems (IDS) that differentiate abnormal activities caused by malicious intruders from the typical network behavior. Due to the large volume of data produced by IoT devices, it is challenging to perform real-time classification of data to find any abnormal patterns. Single classifier-based approaches are considered to be simple and straightforward but may not be able to capture all the relevant information in the data, leading to suboptimal performance. To overcome the weaknesses of single classifiers, it is often beneficial to use an ensemble of classifiers, such as a random forest or a gradient-boosted trees model, which can capture a wider range of patterns in the data and lead to improved performance. However, ensemble models can be computationally expensive to train especially when using large numbers of base classifiers making it difficult to scale the models to large datasets, such as of IoT. This paper presents a detailed empirical analysis of the comparative performance of single classifier versus ensemble models for intrusion detection in IoT networks by utilizing two benchmark datasets in the Internet of Things: NSL-KDD and UNSW-NB15. It has been observed that under certain conditions, the performance of single classifier-based IDS surpasses the ensemble stacking approaches. Moreover, training/testing dataset selection has a major impact on overall validation and testing performance of the models. Based on the empirical observations, we use a novel method known as ensemble stacking approach that outperforms the baselines for the selected datasets. The research provides a detailed insight into the impact of various classifiers and dataset features on the performance of IDS in IoT environments.