Explainable Machine Learning Based Intrusion Detection Systems for IoT
摘要
The Internet of Things (IoT) can be described as the entire network of interconnected devices as well as the technology that enables communication between the devices themselves and with the cloud. With IoT becoming very extensive over the last decade with huge improvements in network systems, technology, and the Internet, there has been a need for security alongside the rapid growth. In this research work, our goal is to address that issue and enhance the IoT security measures. This is done by analyzing the effectiveness of various machine-learning models and techniques. Oversampling and undersampling methods were used to address the imbalance issues in the two IoT network datasets, NF-ToN-IoT-V2 and NF-BoT-IoT, used. The models used for classification include White Box Models: Decision Tree, Logistic Regression, Naive Baye, and Black Box Models: Neural Networks, Support Vector Machines, Random Forest, and K-Nearest-Neighbors. While most machine learning models achieved high accuracies in both oversampling and undersampling scenarios, the Decision Tree and Random Forest models notably outperformed the others. We utilized the explainable AI technique, SHAP, to enhance interpretability by quantifying feature contributions to individual predictions. SHAP discovered the features that had the most impact on the model’s decision-making. The top feature for the NF-ToN-IoT-V2 dataset was the TCP_WIN_MAX_IN and TCP_FLAGS for the NF-BoT-IoT dataset with both techniques, oversampling and undersampling.