IoTGeM: Generalizable Models for Behaviour-Based IoT Attack Detection Article Swipe

MAKE IMPACT

Kahraman Kostas , Mike Just , Michael A. Lones · YOU? · · 2023 · Open Access · · DOI: https://doi.org/10.48550/arxiv.2401.01343

Previous research on behavior-based attack detection for networks of IoT devices has resulted in machine learning models whose ability to adapt to unseen data is limited and often not demonstrated. This paper presents IoTGeM, an approach for modeling IoT network attacks that focuses on generalizability, yet also leads to better detection and performance. We first introduce an improved rolling window approach for feature extraction. To reduce overfitting, we then apply a multi-step feature selection process where a Genetic Algorithm (GA) is uniquely guided by exogenous feedback from a separate, independent dataset. To prevent common data leaks that have limited previous models, we build and test our models using strictly isolated train and test datasets. The resulting models are rigorously evaluated using a diverse portfolio of machine learning algorithms and datasets. Our window-based models demonstrate superior generalization compared to traditional flow-based models, particularly when tested on unseen datasets. On these stringent, cross-dataset tests, IoTGeM achieves F1 scores of 99\% for ACK, HTTP, SYN, MHD, and PS attacks, as well as a 94\% F1 score for UDP attacks. Finally, we build confidence in the models by using the SHAP (SHapley Additive exPlanations) explainable AI technique, allowing us to identify the specific features that underlie the accurate detection of attacks.

Type

preprint

Language

en

Landing Page

http://arxiv.org/abs/2401.01343

PDF

https://arxiv.org/pdf/2401.01343

OA Status

green

Cited By

4

Related Works

10

OpenAlex ID

https://openalex.org/W4390602559

Raw OpenAlex JSON

OpenAlex ID

https://openalex.org/W4390602559

Canonical identifier for this work in OpenAlex

DOI

https://doi.org/10.48550/arxiv.2401.01343

Digital Object Identifier

Title

IoTGeM: Generalizable Models for Behaviour-Based IoT Attack Detection

Work title

Type

preprint

OpenAlex work type

Language

en

Primary language

Publication year

2023

Year of publication

Publication date

2023-10-17

Full publication date if available

Authors

Kahraman Kostas, Mike Just, Michael A. Lones

List of authors in order

Landing page

https://arxiv.org/abs/2401.01343

Publisher landing page

PDF URL

https://arxiv.org/pdf/2401.01343

Direct link to full text PDF

Open access

Yes

Whether a free full text is available

OA status

green

Open access status per OpenAlex

OA URL

https://arxiv.org/pdf/2401.01343

Direct OA link when available

Concepts

Overfitting, Generalizability theory, Computer science, Machine learning, Artificial intelligence, Process (computing), Feature selection, Feature (linguistics), Selection (genetic algorithm), Data mining, Portfolio, Artificial neural network, Financial economics, Linguistics, Mathematics, Philosophy, Economics, Operating system, Statistics

Top concepts (fields/topics) attached by OpenAlex

Cited by

4

Total citation count in OpenAlex

Citations by year (recent)

2025: 2, 2024: 2

Per-year citation counts (last 5 years)

Related works (count)

10

Other works algorithmically related by OpenAlex

Full payload