HEADS: hybrid ensemble anomaly detection system for Internet-of-Things networks.

Ahmad, Zeeshan; Petrovski, Andrei; Arifeen, Murshedul; Khan, Adnan Shahid; Shah, Syed Aziz

Abstract

The rapid expansion of Internet-of-Things (IoT) devices has revolutionized connectivity, facilitating the exchange of extensive data within IoT networks via the traditional internet. However, this innovation has also increased security concerns due to the presence of sensitive nature of data exchanged within IoT networks. To address these concerns, network-based anomaly detection systems play a crucial role in ensuring the security of IoT networks through continuous network traffic monitoring. However, despite significant efforts from researchers, these detection systems still suffer from lower accuracy in detecting new anomalies and often generate high false alarms. To this end, this study proposes an efficient Hybrid Ensemble learning-based Anomaly Detection System (HEADS) to secure an IoT network from all types of anomalies. The proposed solution is based on a novel hybrid approach to improve the voting strategy for ensemble learning. The ensemble prediction is assisted by a Random Forest-based model obtained through the best F1 score for each label through dataset subset selection. The efficiency of HEADS is evaluated using the publicly available CICIoT2023 dataset. The evaluation results demonstrate an F1 score of 99.75% and a false alarm rate of 0.038%. These observations signify an average 4% improvement in the F1 score while a reduction of 0.7% in the false alarm rate comparing other anomaly detection-based strategies.

Citation

AHMAD, Z., PETROVSKI, A., ARIFEEN, M., KHAN, A.S. and SHAH, S.A. 2024. HEADS: hybrid ensemble anomaly detection system for Internet-of-Things networks. In Iliadis, L., Maglogiannis, I., Papaleonidas, A., Pimenidis, E. and Jayne, C. (eds.) Engineering applications on neural networks: proceedings of the 25th International Engineering applications on neural networks 2024 (EANN 2024), 27-30 June 2024, Corfu, Greece. Communications in computer and information science, 2141. Cham: Springer [online], pages 178-190. Available from: https://doi.org/10.1007/978-3-031-62495-7_14

• Presentation Conference Type: Conference Paper (published)
• Conference Name: 25th International engineering application of neural networks conference 2024 (EANN 2024)
• Start Date: Jun 27, 2024
• End Date: Jun 30, 2024
• Acceptance Date: Jun 22, 2024
• Online Publication Date: Jun 22, 2024
• Publication Date: Dec 31, 2024
• Deposit Date: Aug 1, 2024
• Publicly Available Date: Aug 1, 2024
• Publisher: Springer
• Peer Reviewed: Peer Reviewed
• Pages: 178-190
• Series Title: Communications in computer and information science
• Series Number: 2141
• Series ISSN: 1865-0929; 1865-0937
• Book Title: Engineering applications of neural networks: proceedings of the 25th International engineering application of neural networks conference 2024 (EANN 2024), 27-30 June 2024, Corfu, Greece
• ISBN: 9783031624940; 9783031624957
• DOI: https://doi.org/10.1007/978-3-031-62495-7_14
• Keywords: Anomaly detection system; Ensemble-based learning; Gradient boosting machine; Internet-of-Things; Machine learning
• Public URL: https://rgu-repository.worktribe.com/output/2383587