Cargando…

An Aggregated Mutual Information Based Feature Selection with Machine Learning Methods for Enhancing IoT Botnet Attack Detection

Due to the wide availability and usage of connected devices in Internet of Things (IoT) networks, the number of attacks on these networks is continually increasing. A particularly serious and dangerous type of attack in the IoT environment is the botnet attack, where the attackers can control the Io...

Descripción completa

Detalles Bibliográficos
Autores principales: Al-Sarem, Mohammed, Saeed, Faisal, Alkhammash, Eman H., Alghamdi, Norah Saleh
Formato: Online Artículo Texto
Lenguaje:English
Publicado: MDPI 2021
Materias:
Acceso en línea:https://www.ncbi.nlm.nih.gov/pmc/articles/PMC8749651/
https://www.ncbi.nlm.nih.gov/pubmed/35009725
http://dx.doi.org/10.3390/s22010185
_version_ 1784631281366073344
author Al-Sarem, Mohammed
Saeed, Faisal
Alkhammash, Eman H.
Alghamdi, Norah Saleh
author_facet Al-Sarem, Mohammed
Saeed, Faisal
Alkhammash, Eman H.
Alghamdi, Norah Saleh
author_sort Al-Sarem, Mohammed
collection PubMed
description Due to the wide availability and usage of connected devices in Internet of Things (IoT) networks, the number of attacks on these networks is continually increasing. A particularly serious and dangerous type of attack in the IoT environment is the botnet attack, where the attackers can control the IoT systems to generate enormous networks of “bot” devices for generating malicious activities. To detect this type of attack, several Intrusion Detection Systems (IDSs) have been proposed for IoT networks based on machine learning and deep learning methods. As the main characteristics of IoT systems include their limited battery power and processor capacity, maximizing the efficiency of intrusion detection systems for IoT networks is still a research challenge. It is important to provide efficient and effective methods that use lower computational time and have high detection rates. This paper proposes an aggregated mutual information-based feature selection approach with machine learning methods to enhance detection of IoT botnet attacks. In this study, the N-BaIoT benchmark dataset was used to detect botnet attack types using real traffic data gathered from nine commercial IoT devices. The dataset includes binary and multi-class classifications. The feature selection method incorporates Mutual Information (MI) technique, Principal Component Analysis (PCA) and ANOVA f-test at finely-granulated detection level to select the relevant features for improving the performance of IoT Botnet classifiers. In the classification step, several ensemble and individual classifiers were used, including Random Forest (RF), XGBoost (XGB), Gaussian Naïve Bayes (GNB), k-Nearest Neighbor (k-NN), Logistic Regression (LR) and Support Vector Machine (SVM). The experimental results showed the efficiency and effectiveness of the proposed approach, which outperformed other techniques using various evaluation metrics.
format Online
Article
Text
id pubmed-8749651
institution National Center for Biotechnology Information
language English
publishDate 2021
publisher MDPI
record_format MEDLINE/PubMed
spelling pubmed-87496512022-01-12 An Aggregated Mutual Information Based Feature Selection with Machine Learning Methods for Enhancing IoT Botnet Attack Detection Al-Sarem, Mohammed Saeed, Faisal Alkhammash, Eman H. Alghamdi, Norah Saleh Sensors (Basel) Article Due to the wide availability and usage of connected devices in Internet of Things (IoT) networks, the number of attacks on these networks is continually increasing. A particularly serious and dangerous type of attack in the IoT environment is the botnet attack, where the attackers can control the IoT systems to generate enormous networks of “bot” devices for generating malicious activities. To detect this type of attack, several Intrusion Detection Systems (IDSs) have been proposed for IoT networks based on machine learning and deep learning methods. As the main characteristics of IoT systems include their limited battery power and processor capacity, maximizing the efficiency of intrusion detection systems for IoT networks is still a research challenge. It is important to provide efficient and effective methods that use lower computational time and have high detection rates. This paper proposes an aggregated mutual information-based feature selection approach with machine learning methods to enhance detection of IoT botnet attacks. In this study, the N-BaIoT benchmark dataset was used to detect botnet attack types using real traffic data gathered from nine commercial IoT devices. The dataset includes binary and multi-class classifications. The feature selection method incorporates Mutual Information (MI) technique, Principal Component Analysis (PCA) and ANOVA f-test at finely-granulated detection level to select the relevant features for improving the performance of IoT Botnet classifiers. In the classification step, several ensemble and individual classifiers were used, including Random Forest (RF), XGBoost (XGB), Gaussian Naïve Bayes (GNB), k-Nearest Neighbor (k-NN), Logistic Regression (LR) and Support Vector Machine (SVM). The experimental results showed the efficiency and effectiveness of the proposed approach, which outperformed other techniques using various evaluation metrics. MDPI 2021-12-28 /pmc/articles/PMC8749651/ /pubmed/35009725 http://dx.doi.org/10.3390/s22010185 Text en © 2021 by the authors. https://creativecommons.org/licenses/by/4.0/Licensee MDPI, Basel, Switzerland. This article is an open access article distributed under the terms and conditions of the Creative Commons Attribution (CC BY) license (https://creativecommons.org/licenses/by/4.0/).
spellingShingle Article
Al-Sarem, Mohammed
Saeed, Faisal
Alkhammash, Eman H.
Alghamdi, Norah Saleh
An Aggregated Mutual Information Based Feature Selection with Machine Learning Methods for Enhancing IoT Botnet Attack Detection
title An Aggregated Mutual Information Based Feature Selection with Machine Learning Methods for Enhancing IoT Botnet Attack Detection
title_full An Aggregated Mutual Information Based Feature Selection with Machine Learning Methods for Enhancing IoT Botnet Attack Detection
title_fullStr An Aggregated Mutual Information Based Feature Selection with Machine Learning Methods for Enhancing IoT Botnet Attack Detection
title_full_unstemmed An Aggregated Mutual Information Based Feature Selection with Machine Learning Methods for Enhancing IoT Botnet Attack Detection
title_short An Aggregated Mutual Information Based Feature Selection with Machine Learning Methods for Enhancing IoT Botnet Attack Detection
title_sort aggregated mutual information based feature selection with machine learning methods for enhancing iot botnet attack detection
topic Article
url https://www.ncbi.nlm.nih.gov/pmc/articles/PMC8749651/
https://www.ncbi.nlm.nih.gov/pubmed/35009725
http://dx.doi.org/10.3390/s22010185
work_keys_str_mv AT alsaremmohammed anaggregatedmutualinformationbasedfeatureselectionwithmachinelearningmethodsforenhancingiotbotnetattackdetection
AT saeedfaisal anaggregatedmutualinformationbasedfeatureselectionwithmachinelearningmethodsforenhancingiotbotnetattackdetection
AT alkhammashemanh anaggregatedmutualinformationbasedfeatureselectionwithmachinelearningmethodsforenhancingiotbotnetattackdetection
AT alghamdinorahsaleh anaggregatedmutualinformationbasedfeatureselectionwithmachinelearningmethodsforenhancingiotbotnetattackdetection
AT alsaremmohammed aggregatedmutualinformationbasedfeatureselectionwithmachinelearningmethodsforenhancingiotbotnetattackdetection
AT saeedfaisal aggregatedmutualinformationbasedfeatureselectionwithmachinelearningmethodsforenhancingiotbotnetattackdetection
AT alkhammashemanh aggregatedmutualinformationbasedfeatureselectionwithmachinelearningmethodsforenhancingiotbotnetattackdetection
AT alghamdinorahsaleh aggregatedmutualinformationbasedfeatureselectionwithmachinelearningmethodsforenhancingiotbotnetattackdetection