The increased deployment of Internet of Things (IoT) devices has led to greater complexity and scale in network traffic, introducing challenges in effectively detecting cyber threats. This study compares two network flow feature extraction tools, NFStream and Tranalyzer, through their performance in detecting malicious network traffic using a Multilayer Perceptron (MLP) neural network. The evaluation was conducted using datasets generated from laboratory-based IoT setups involving edge devices, such as the Raspberry Pi 4 and Jetson Nano, as well as data from the publicly available ToN-IoT dataset. Each tool independently processes the same raw network captures, creating two distinct feature sets. Both datasets underwent identical preprocessing steps, including balanced undersampling, categorical encoding, and feature scaling, to ensure fair comparison. MLP neural networks, implemented using the Keras Functional API, were trained, validated, and tested on each dataset separately. The results, represented by global and network-specific confusion matrices, demonstrate the high accuracy of both tools, with subtle but measurable differences in performance. Both NFStream and Tranalyzer demonstrated strong and consistent performance under identical evaluation settings, confirming their capability to support machine learning-based detection of cyberattacks in IoT environments.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Comparative Evaluation of Flow-Based Feature Extraction Tools for IoT Cyberattack Detection

  • Branly Alberto Martínez González,
  • Malena Pérez Sevilla,
  • Jaime Andrés Rincón Arango,
  • Daniel Urda

摘要

The increased deployment of Internet of Things (IoT) devices has led to greater complexity and scale in network traffic, introducing challenges in effectively detecting cyber threats. This study compares two network flow feature extraction tools, NFStream and Tranalyzer, through their performance in detecting malicious network traffic using a Multilayer Perceptron (MLP) neural network. The evaluation was conducted using datasets generated from laboratory-based IoT setups involving edge devices, such as the Raspberry Pi 4 and Jetson Nano, as well as data from the publicly available ToN-IoT dataset. Each tool independently processes the same raw network captures, creating two distinct feature sets. Both datasets underwent identical preprocessing steps, including balanced undersampling, categorical encoding, and feature scaling, to ensure fair comparison. MLP neural networks, implemented using the Keras Functional API, were trained, validated, and tested on each dataset separately. The results, represented by global and network-specific confusion matrices, demonstrate the high accuracy of both tools, with subtle but measurable differences in performance. Both NFStream and Tranalyzer demonstrated strong and consistent performance under identical evaluation settings, confirming their capability to support machine learning-based detection of cyberattacks in IoT environments.