Optimizing IoT and IIoT Intrusion Detection: A Comparative Analysis of Ensemble and Deep Learning Techniques

Abstract

The use of Internet of Things (IoT) and Industrial Internet of Things (IIoT) has greatly enlarged the attack surface of the cyberspace, exposing the key systems to risks. This is a threat environment that requires smart intrusion detection systems (IDS) that overcome the shortcomings of traditional and signature security programmes. Despite the potential of machine learning (ML) to be the best option of IDS, the comparison of the modern algorithms to the problem of IoT specifics is not yet conclusive. Neither a resource-limited hardware nor a high-accuracy ideal model has been uncovered to provide both high-accuracy and operational efficiency. The proposed research is aimed at identifying the best ML model to use in the detection of IoT/IIoT intrusions. It aims to: i) evaluate seven different algorithms including tree-based ensemble and deep learning networks; iii) preprocess the Edge-IIoTset dataset with SMOTE to address the problem of class imbalance; iii) benchmark the performance involving standard metrics; and iii) discover the most important features in detection of threats. The research is conducted in a systematic experimental manner with the use of the Edge-IIoTset dataset. Using SMOTE to preprocess, seven models are trained and assessed based on accuracy, precision, and F1-score: Logistic Regression, Random Forest, XGBoost, CatBoost, LightGBM, ANN and CNN. An analysis of the most performing features is then carried out. Gradient boosting models were the best models to use, with XGBoost having the highest accuracy (95.07%), precision (95.46%), and F1-score (95.14%). The TCP flags and application-layer data were found to be the major intrusion indicators analysed. XGBoost and LightGBM offered the most desirable compromise between the strength and power of detection and computational efficiency. The research establishes the use of gradient boosting algorithms namely XGBoost and LightGBM are very effective in addressing IDS in IoT/IIoT setting, best combining high-performance, efficiency and interpretability. The findings provide practitioners with a clear evidence-based guideline on how to choose IDS models to provide them with effective cybersecurity without having to overstretch their limited processing resources. The next work should confirm these models in test-beds in real-time and investigate the construction of lightweight hybrid systems in new areas such as 5G and vehicular networks.