HEADS: Hybrid Ensemble Anomaly Detection System for Internet-of-Things Networks

The rapid expansion of Internet-of-Things (IoT) devices has revolutionized connectivity, facilitating the exchange of extensive data within IoT networks via the traditional internet. However, this innovation has also increased security concerns due to the presence of sensitive nature of data exchanged within IoT networks. To address these concerns, network-based anomaly detection systems play a crucial role in ensuring the security of IoT networks through continuous network traffic monitoring. However, despite significant efforts from researchers, these detection systems still suffer from lower accuracy in detecting new anomalies and often generate high false alarms. To this end, this study proposes an efficient Hybrid Ensemble learning-based Anomaly Detection System (HEADS) to secure an IoT network from all types of anomalies. The proposed solution is based on a novel hybrid approach to improve the voting strategy for ensemble learning. The ensemble prediction is assisted by a Random Forest-based model obtained through the best F1 score for each label through dataset subset selection. The efficiency of HEADS is evaluated using the publicly available CICIoT2023 dataset. The evaluation results demonstrate an F1 score of 99.75% and a false alarm rate of 0.038%. These observations signify an average 4% improvement in the F1 score while a reduction of 0.7% in the false alarm rate comparing other anomaly detection-based strategies.