Malicious Traffic Detection in IoT and Local Networks Using Stacked Ensemble Classifier

Abstract

Malicious traffic detection over the internet is one of the challenging areas for researchers to protect network infrastructures from any malicious activity. Several shortcomings of a network system can be leveraged by an attacker to get unauthorized access through malicious traffic. Safeguard from such attacks requires an efficient automatic system that can detect malicious traffic timely and avoid system damage. Currently, many automated systems can detect malicious activity, however, the efficacy and accuracy need further improvement to detect malicious traffic from multi-domain systems. The present study focuses on the detection of malicious traffic with high accuracy using machine learning techniques. The proposed approach used two datasets UNSW-NB15 and IoTID20 which contain the data for IoT-based traffic and local network traffic, respectively. Both datasets were combined to increase the capability of the proposed approach in detecting malicious traffic from local and IoT networks, with high accuracy. Horizontally merging both datasets requires an equal number of features which was achieved by reducing feature count to 30 for each dataset by leveraging principal component analysis (PCA). The proposed model incorporates stacked ensemble model extra boosting forest (EBF) which is a combination of tree-based models such as extra tree classifier, gradient boosting classifier, and random forest using a stacked ensemble approach. Empirical results show that EBF performed significantly better and achieved the highest accuracy score of 0.985 and 0.984 on the multi-domain dataset for two and four classes, respectively.

Machine Learning and Causal Approaches to Predict Readmissions and Its Economic Consequences Among Canadian Patients With Heart Disease: Retrospective Study

“…Another crucial consideration is the computational cost associated with clinical and graphical data [ 41 ]. Although the analysis for this study only took 2 to 3 hours, it is essential to consider the computational requirements for more substantial studies, particularly those with larger data sets or more complex models [ 42 ]. The computational cost may impact the feasibility of the study, and efficient models may be necessary to ensure valid and reliable results [ 42 ].…”

“…Furthermore, the implementation of PCA in conjunction with stacked classifiers enabled a higher interpretability of the models [ 42 ]. Stacked models can be challenging to interpret in high-dimensional data, as the layers can contribute to a high level of complexity [ 43 ].…”

Enhancing Anomaly-Based Intrusion Detection Systems: A Hybrid Approach Integrating Feature Selection and Bayesian Hyperparameter Optimization

“…In the study of Indrasiri et al [18], an innovative model was introduced, integrating the Extra Boosting Forest (EBF) with a stacked ensemble approach, amalgamating tree-based models such as the Extra Tree Classifier, Gradient Boosting Classifier, and RF. The datasets employed, UNSW-NB15 and IoTID20, encompass IoT-based and local network traffic data respectively, and were amalgamated to augment the capability of the proposed model in accurately detecting malicious traffic within both local and IoT networks.…”

A Network Traffic Intrusion Detection Method for Industrial Control Systems Based on Deep Learning

“…Method Dataset Score Limitation [8] PCA, EBF UNSW-NB15, IoTID20 98.4% It mainly studies the importance of features, but does not pay attention to the correlation between features.…”

“…PCA is a common statistical algorithm, which is often used to reduce the feature dimension. It transforms the highly correlated attributes in the dataset into linearly uncorrelated attributes and then creates a feature subspace [8]. Similarly, Furqan Rustam et al used a feature selection method that combines PCA and singular value decomposition (SVD).…”