ENHANCING INTRUSION DETECTION WITH IOT DATA: UNLOCKING THE POWER OF ENSEMBLE TECHNIQUES

Abstract

With the recent spread of the Internet of Things (IoT) devices, network infrastructures have grown to become more complex and vulnerable to attacks, and hence, the detection of intrusions is an important aspect of cybersecurity. This thesis explores the usefulness of ensemble learning methods to improve intrusion detection using the IoT. Six models are tested in the study including Support Vector Machine (SVM), K-Nearest Neighbors (KNN), Random Forest, Convolutional Neural Network (CNN), Long Short-Term Memory (LSTM), and an ensemble model proposed, which incorporates three of the tested models, SVM, KNN, and Random Forest. The experiment was carried out with a real-world intrusion detection dataset of IoT. The models have been evaluated regarding the accuracy of classification, behavior of the learning curve, analysis of the confusion matrix, as well as such standard measures as precision, recall, and F1 score. Random forest showed the highest accuracy among the standalone classifiers, getting 89.64 percent; KNN followed with 88.38 percent, obtained an accuracy of 69.4 percent, Multi Layered Net got 71.6 percent, Support Vector Machine got 63.7 percent, and Multi-Classifier Net obtained 89.64 percent. By contrast, the deep learning models were much worse, with LSTM getting 65% and CNN 63%, most likely because of the limitation of data and architectural inappropriateness. The ensemble learning model presented in this paper was superior to the majority of the individual classifier accuracy, with the accuracy being 89.32 percent, a precision, recall, and F1 being 0.89 each. It was also feasible that it was more consistent and stable in the classification of different types of attacks, and had fewer misclassification errors, individual models had issues with. The learning curve of the ensemble ensured that it generalizes rather well with a little overfitting. This study has come to the conclusion that ensemble learning offers a practical, precise, and scalable way of detecting intrusion within IoT networks. The thesis shows the model to be a great achiever, and it speaks of the feasibility of implementation. Avenues of future work are the integration of real-time learning, improving the interpretability of the models and testing the models on larger and more diverse datasets. These improvements are to be made in order to bolster the resiliency and resilience of IDS systems operating in dynamic and highly volatile IoT ecosystems.