Dana F. Doghramachi

The rapid adoption of the Internet of Things (IoT) across industries has revolutionized daily life by providing essential services and leisure activities. However, the inadequate software protection in IoT devices exposes them to cyberattacks with severe consequences. Intrusion Detection Systems (IDS) are vital in mitigating these risks by detecting abnormal network behavior and monitoring safe network traffic. The security research community has shown particular interest in leveraging Machine Learning (ML) approaches to develop practical IDS applications for general cyber networks and IoT environments. However, most available datasets related to Industrial IoT suffer from imbalanced class distributions. This study proposes a methodology that involves dataset preprocessing, including data cleaning, encoding, and normalization. The class imbalance is addressed by employing the Synthetic Minority Oversampling Technique (SMOTE) and performing feature reduction using correlation analysis. Multiple ML classifiers, including Logistic Regression, multi-layer perceptron, Decision Trees, Random Forest, and XGBoost, are employed to model IoT attacks. The effectiveness and robustness of the proposed method evaluate using the IoTID20 dataset, which represents current imbalanced IoT scenarios. The results highlight that the XGBoost model, integrated with SMOTE, achieves outstanding attack detection accuracy of 0.99 in binary classification, 0.99 in multi-class classification, and 0.81 in multiple sub-classifications. These findings demonstrate our approach’s significant improvements to attack detection in imbalanced IoT datasets, establishing its superiority over existing IDS frameworks.