Unveiling anomalies: harnessing machine learning for detection and insights

Abstract

The rise of Internet of Things (IoT) devices has brought about an increase in security risks, emphasizing the need for effective anomaly detection systems. Previous research introduced a dynamic voting classifier to overcome overfitting or inaccurate accuracies caused by dataset imbalance. This article introduces a new method for IoT anomaly detection that employs a hybrid voting classifier, which combines several machine learning models. To solve the overfitting and class weight issues, an adaptive voting classifier is used that adjusts weights according to the highest preference for accuracy. The developing voting system increases the effectiveness of more accurate classifiers, enhancing the group's overall capability. A proposed combined classifier combines Logistic Regression, AdaBoost, Gradient Boosting, and Multi-Layer Perceptron models using a soft voting method. To develop and assess this method, the CIC-IoT-2023 dataset is utilized, which contains 33 types of IoT attacks across 7 categories. This process includes thorough data preprocessing and feature selection from a pool of 42 available attributes. The performance of this approach is measured against individual classifiers across binary, 8-class, and 34-class classification tasks. The results highlight the effectiveness of the hybrid model. It achieves 98.95% accuracy, 76.72% recall, and 72.01% F1-score in the 34-class problem, surpassing the performance of all individual models. For the 8-class task, the hybrid classifier attains 99.39% accuracy, 90.89% recall, and an 83.01% F1-score. This demonstrates the high potential of the hybrid approach for IoT anomaly detection.