A Multiclass Classification Approach for IoT Intrusion Detection Based on Feature Selection and Oversampling

Security of IoT networks is extremely necessary nowadays especially due to the rise of intrusion attacks in IoT networks that are not easily detected and classified. Intrusion detection systems (IDS) focus on both supervised and unsupervised learning techniques to classify intrusion detection using IoT environmental data. Yet most of the time, the huge quantity of data is imbalanced and contains multiclasses. This chapter proposes an approach of multiclass classification using XGBoost and CatBoost to classify the category type of the intrusion attack with the application of the variance threshold feature selection to adopt valid predictions along with the support vector machine and synthetic minority oversampling technique (SVM-SMOTE) to solve imbalanced distribution of the dataset in addition to a way of specifying the highest influential feature variables using the SHAP technique to improve prediction power. The experiments were evaluated based on precision, recall, f1-score, and G-mean where they are then compared against other basic classifiers. The results show that the XGBoost classification method with a variance threshold of 0.8 as well as SVM-SMOTE give better results than other classification techniques. Also, SHAP indicates that the most important features for the prediction of the category labels are Src_Port and Flow_Duration.