Optimal Feature Extraction Model for Detecting Cyberattacks on IoT Devices

The IoTs is the new discipline that not only takes care of scientific, engineering and technical aspects but also integrates social sciences and analyzes big data derived from social media. Recently, detection systems have become the prime focus of researchers in IoT environments due to the ever-increasing threat of botnet attacks on such devices. It effectively addresses network intrusion detection systems (IDSs) for protection against malicious activities on networks. Most public detection systems operate based on attack signatures; they are called signature-based detection systems. These systems recognize all the known types of attacks by matching the pattern of incoming attacks with pre-recorded signatures. They require a robust infrastructure and sophisticated tools since many signature rules must be added to their databases. Various research works have proven that ML techniques can be of great assistance in attack detection tasks. It is already known that most attacks in the IoT environment are of a botnet nature, and several IoT devices still present vulnerabilities owing to limited memory and computational resources, which seem to be an obstruction to strong security mechanisms. Moreover, attackers can bypass many rule-based detection systems easily. Researchers have explored the development of an ML-based attack detection system featuring a sequential detection architecture. They employed an efficient feature selection approach to develop a lightweight, high-performance detection system that achieved improved overall detection results [5]. They also proposed a framework for specifying an effective algorithm to detect malicious activity in IoT using ML, where a Naïve Bayes (NB) model was observed to perform well in anomaly detection. A cyberattack detection system targeting sewage IoT devices was also proposed, which managed to achieve an accuracy of 92% in fixed scenarios and 72% in mobile environments [6]. In reference [7], results have been produced by testing and validating four binary classifiers: decision trees (DT), extra trees classifiers, Random Forest (RF), and support vector machines (SVMs). The RF classifier outperformed all other classifiers when it was trained on a specific device and used to test the anomalies that come from completely unrelated devices.

2.1 Feature extraction models

2.1.1 Butterfly optimization algorithm (BOA) model

BOA is a novel optimization technique inspired by how butterflies forage for and attract mates. In this algorithm, the behavior of females using their chemoreceptors, an external sensory organ present in many parts of the body, is modeled. These chemoreceptors help in perceiving flower or food odors, as well as in identifying the best possible mating partners. When the butterflies are in movement, they diffuse the odor in variated concentrations, and this scent directs the movement of the search agents (the butterflies) in the BOA algorithm. For instance, where a butterfly cannot scent others’ fragrances within a search area, it will tumble and reposition randomly. However, when a butterfly stabilizes and only detects the perfume from the most successful butterfly it knows, it will try to move toward that butterfly [8]. The BOA has shown promise in feature selection tasks across various studies. For instance, in reference [9], the monarch BOA algorithm is applied to feature selection, achieving high classification accuracy (93%) while significantly reducing feature set size. Moreover, binary variants of BOA demonstrate improved classification accuracy compared to other wrapper-based algorithms [10].

2.1.2 Spider monkey optimization (SMO) model

The SMO algorithm draws inspiration from the social and foraging behaviors of spider monkeys. It uses a fission-fusion social structure where the monkeys form and dissipate groups of different sizes. Some primary characteristics that define spider monkeys in the SMO algorithm include the following [11]:

(1) Each group contains 40 to 50 monkeys; these are called individuals within the framework of SMO.

(2) Among the troop of monkeys, there is a global leader (GL) who can divide them into subgroups of 3-8 when food is insufficient, where each subgroup will then forage independently.

(3) Each subgroup is usually led by a local leader (LL), who usually guides foraging.

(4) Members of the group use particular sounds to communicate with one another and promote social behavior.

For the SMO algorithms, a hybrid approach combining SMO with simulated annealing and ReliefF filtering demonstrated superior performance in identifying biomarker genes from cancer datasets, achieving up to 99.45% accuracy [12]. In fuzzy classifier construction, binary SMO was employed for feature selection, while continuous SMO optimized fuzzy rule antecedents, resulting in classifiers with minimal rules and reduced features while maintaining competitive accuracy [13]. These studies highlight the effectiveness of SMO-based approaches in feature selection across diverse applications. The SMO algorithm is presented in Figure 1.

1.png

The SMO algorithm has many applications for feature selection over different datasets concerning accuracy and classification performance. In 2019, a fuzzy classifier developed with binary SMO reached an accuracy of 99.45% for 38 datasets, showing the efficiency of SMO in optimizing fuzzy classifiers [13]. It obtained an accuracy of 82.25% with a dataset of soil images taken in 2021 by employing oscillating SMO fine-tuning for feature selection in an ensemble of classifiers comprised of SVMs, linear discriminant analysis, K-Nearest Neighbor (KNN), and RF [14]. The accuracy of intrusion detection reached 99% using the proposed CNN model combined with conditional random field and SMO on the NSL-KDD dataset that enhances IoT security [15]. The highest value recorded was 99.46% in 2022 when both ANN and CNN models adopted GM-SMO in recognizing remote sensing scenes [16]. The adaptability of SMO flowed to medical image analysis, with the accuracy of a deep belief network with self-optimizing SMO reaching 90.5% in COVID-19 prediction, while that of a CNN-LSTM framework that employed SMO reached an accuracy of 89.72% in dementia detection [17, 18]. Furthermore, in MRI datasets, differential SMO improved feature extraction such that classification accuracy for detecting a particular lumbar spine disease reached 96% by SVM in 2023 [19]. Lastly, in 2024, the Cuckoo Search algorithm combined with SMO was proposed for the detection of cancer and reported 90.6% accuracy on eight different cancer datasets [20]. These results themselves indicate that SMO has always been able to enhance the performance of ML in a continuous manner, from cybersecurity to healthcare. SMO-related works are presented in Table 1.

2.2 ML-based models

2.2.1 Naïve Bayes classifier

In statistics, NB classifiers are a family of simple "probabilistic classifiers" based on the application of Bayes' theorem with (Naïve) assumptions about independence between features. These are some of the simplest Bayesian network models but can be combined with kernel density estimation to achieve higher levels of accuracy. The NB classifier scales exceedingly well. There are only a few parameters to be estimated, which scales linearly with the number of variables (features/predictors) in the learning problem. Maximum likelihood training can be done very efficiently by evaluating a closed-form expression that takes linear time rather than an expensive iterative approximation, as used by many other classifiers. It is also referred to in the literature of statistics and computer science as NB models and independent Bayes [21]. Recent research has addressed the use of ML techniques, especially the NB model, for network attack detection. A Gaussian NB model was explored in classifying cyberattacks in streaming data, focusing on its adaptability [22]. The hybrid approach proposed in reference [23] combines the heuristics clustering algorithm and NB model to detect DDoS attacks, which showed improved accuracy and detection rates. In addition, three models, including NB, RF, and stochastic gradient boosting, have been compared for DDoS attack classification. Among them, stochastic gradient boosting proved to be the most accurate at 100% [24]. Recently, a probability-based supervised ML algorithm has been introduced NB model for intrusion detection on the UNSW-NB15 dataset [25]. All these studies indicate the potency of the NB model and other ML techniques in detecting various network attacks; hence, research is ongoing to further improve their accuracy and adaptability against evolving cyber threats.

2.2.2 Random Forest (RF) classifier

RF is flexible, easy to use, and gives the best results most of the time without hyperparameter tuning. Because of its simplicity and efficiency, it is among the most used algorithms since it can be applied to ranking and regression. RF is one of the algorithms for supervised learning. "Jungle" is an ensemble of DTs usually trained by the "bagging" method. The general intuition of this approach is that the ensemble of learning models boosts the final outcome. In other words, RFs construct a large set of DTs and combine their predictions to produce more accurate and robust estimates. Among many advantages, one of the most important benefits of RF is that it can be used for both classification and regression problems, which constitute the biggest part of all ML systems today [26]. Recent works have discussed the adoption of RF for detecting network attacks, as in reference [27]. RF is combined with principal component analysis to enhance attack detection for IoT devices, reaching as high as 99.2% accuracy [28]. In previous study [29], an RF-based model was developed for DDoS attack detection. The Gini Index and entropy criteria are used in the model to improve its accuracy. For instance, ET-RF [30] is proposed, attaining an accuracy of 99% in the CICDDoS2019 dataset. In previous study [31], RF is utilized on the NSL-KDD dataset for intrusion detection. As such, feature selection should be done with the Gini importance that improves the effectiveness of the model.

2.2.3 K-Nearest Neighbor (KNN) classifier

The KNN algorithm is the simplest form of ML based on the technique of supervised learning. KNN assumes that new cases or data points would be similar to the existing ones and assigns them to the most similar categories. In this algorithm, it retains all the incoming data and classifies any new data point by comparing its similarity with the stored examples. This will easily classify any incoming data into the right range of classes. Though KNN finds its applications in both regression and classification, the most common area of application is classification. KNN is a nonparametric algorithm that does not make any assumptions on the underlying distribution of data. It is often referred to as a lazy learning algorithm because it only stores the dataset in memory and does the classification when needed, rather than learning in advance from the training set. During the training phase, KNN only stores the dataset, and when new data shows up, it classifies based on similarity to existing data points [32]. Recently, several works investigated the performance of KNN for attack detection. KNN tends to have high accuracy and performance metrics while detecting different cyberattacks. Previous study [33] reported 99.996% in binary classification and 99.988% in multi-class classification with the NSL-KDD dataset. In this direction, it has been seen that KNN performs best in the CICIDS 2017 dataset, among other supervised learning algorithms, for the highest F1-score and accuracy [34]. In reference [35], an anomaly-based detection model developed using KNN achieved 92% accuracy, 100% precision, and 95.8% F1-score in detecting denial-of-service attacks. Although KNN performs well when it comes to the capability of detection, it may be inefficient when it comes to bits' time complexity. Overall, these studies support KNN as a feasible and efficient algorithm for intrusion detection in a network.

2.3 N-BaIoT cyberattacks dataset

The N-BaIoT dataset was utilized to validate the proposed IDSs. The ensemble averaging deep neural networks achieved the target of attack detection by botnets in heterogeneous IoT devices with an average accuracy of 97.21%, precision of 91.41%, recall of 87.31%, and an F1-score of 88.48% [36]. AdaBoost and eXtreme gradient boosting (XGBoost) models have been implemented to meet particular security challenges in IoT networks [37]. The N-BaIoT dataset, which was produced by the injection of the Bashlite and Mirai botnet attacks on various IoT devices, has widely been used in research on the detection of IoT botnets [38, 39]. This dataset addresses the scarcity of publicly available botnet-specific datasets in IoT domains [40]. Various research studies have designed and built effective detection models based on ML and DL methodologies, of which most reported that RF and gradient boosting reliably showed higher accuracy. Feature selection methods, such as the Fisher Score or PCA, were considered to optimize the effectiveness of the detection performance [40]. It was confirmed that the N-BaIoT dataset indeed outperformed the existing wired datasets, such as NSL-KDD, because it covers IoT-specific attacks and considers relevant network layers [41]. Research supports the idea that not all the features are necessary for effective detection, which could reduce the detection time for ML models.

In our research, BOA and SMO feature selection algorithms with ML-based models are integrated to detect cyberattacks targeting IoT devices. Moreover, the proposed model identifies the type of attacks by analyzing more than 800,000 contact data related to various IoT devices and attacks.