The generalizability of Machine Learning (ML) classifiers in threat detection and classification (TD-TC) is crucial, particularly in Software-Defined Network (SDN)-based Internet of Things (IoT) architectures, where dynamic network management and centralized control introduce unique security challenges. However, there is an ongoing debate regarding the role of Network Identifier Attributes (NIAs) in training and evaluating ML models using publicly available datasets comprising network behaviors. Therefore, this study investigates the influence of NIAs on model generalization by examining learning curves with cross-validation. The results show that Timestamp and Flow ID lead to memorization in classifier models when using the IoTID20 dataset. However, removing all NIAs still resulted in a relatively high classifier accuracy, with Decision Tree (DT) achieving 96.63% and Random Forest (RF) achieving 96.09%. Notably, no clear signs of memorization were observed with the remaining NIAs in the IoTID20 dataset or with all NIAs in the InSDN dataset, suggesting that these attributes may not contribute to memorization. These findings suggest that while some NIAs may be excluded without sacrificing model performance, further investigation is necessary to explore their impact on feature selection and generalization across different datasets.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Impact of Network Identifier Attribute on Machine Learning-Based Threat Detection and Classification in SDN-Based IoT Architecture

  • R. N. Teoh,
  • S. C. Tan

摘要

The generalizability of Machine Learning (ML) classifiers in threat detection and classification (TD-TC) is crucial, particularly in Software-Defined Network (SDN)-based Internet of Things (IoT) architectures, where dynamic network management and centralized control introduce unique security challenges. However, there is an ongoing debate regarding the role of Network Identifier Attributes (NIAs) in training and evaluating ML models using publicly available datasets comprising network behaviors. Therefore, this study investigates the influence of NIAs on model generalization by examining learning curves with cross-validation. The results show that Timestamp and Flow ID lead to memorization in classifier models when using the IoTID20 dataset. However, removing all NIAs still resulted in a relatively high classifier accuracy, with Decision Tree (DT) achieving 96.63% and Random Forest (RF) achieving 96.09%. Notably, no clear signs of memorization were observed with the remaining NIAs in the IoTID20 dataset or with all NIAs in the InSDN dataset, suggesting that these attributes may not contribute to memorization. These findings suggest that while some NIAs may be excluded without sacrificing model performance, further investigation is necessary to explore their impact on feature selection and generalization across different datasets.