{"corpus_id":252657816,"paper_sha":"a5bda3fe7fee823861d33b1a931a258bff13c4b3","doi":"10.3390/s22197409","arxiv_id":null,"pmid":36236506,"pmcid":"9572777","mag_id":null,"dblp_id":"journals/sensors/OkeyMARSMR22","acl_id":null,"title":"BoostedEnML: Efficient Technique for Detecting Cyberattacks in IoT Systems Using Boosted Ensemble Machine Learning","year":2022,"publication_date":"2022-09-29","venue":"Italian National Conference on Sensors","journal":{"name":"Sensors (Basel, Switzerland)","pages":null,"volume":"22"},"journal_issn":null,"journal_title":null,"publication_types":["JournalArticle"],"pubmed_pub_types":["Journal Article"],"s2_fields_of_study":["Medicine","Computer Science","Engineering"],"reference_count":84,"citation_count":56,"influential_citation_count":3,"is_open_access":true,"arxiv_categories":null,"arxiv_license":null,"arxiv_journal_ref":null,"mesh_headings":[{"d":"Algorithms","mj":false,"ui":"D000465"},{"d":"Area Under Curve","mj":false,"ui":"D019540"},{"d":"Internet of Things","mj":true,"ui":"D000080487"},{"d":"Machine Learning","mj":false,"ui":"D000069550"}],"chemicals":null,"comments_corrections":null,"source_flags":5,"s2_open_access_pdf_url":"https://www.mdpi.com/1424-8220/22/19/7409/pdf?version=1664447896","s2_open_access_landing_url":"https://www.semanticscholar.org/paper/a5bda3fe7fee823861d33b1a931a258bff13c4b3","s2_open_access_license":"CCBY","s2_open_access_status":"GOLD","pmc_open_access_pdf_url":null,"pmc_open_access_landing_url":null,"pmc_open_access_license":null,"pmc_open_access_status":null,"unpaywall_open_access_pdf_url":null,"unpaywall_open_access_landing_url":null,"unpaywall_open_access_license":null,"unpaywall_open_access_status":null,"abstract":"Following the recent advances in wireless communication leading to increased Internet of Things (IoT) systems, many security threats are currently ravaging IoT systems, causing harm to information. Considering the vast application areas of IoT systems, ensuring that cyberattacks are holistically detected to avoid harm is paramount. Machine learning (ML) algorithms have demonstrated high capacity in helping to mitigate attacks on IoT devices and other edge systems with reasonable accuracy. However, the dynamics of operation of intruders in IoT networks require more improved IDS models capable of detecting multiple attacks with a higher detection rate and lower computational resource requirement, which is one of the challenges of IoT systems. Many ensemble methods have been used with different ML classifiers, including decision trees and random forests, to propose IDS models for IoT environments. The boosting method is one of the approaches used to design an ensemble classifier. This paper proposes an efficient method for detecting cyberattacks and network intrusions based on boosted ML classifiers. Our proposed model is named BoostedEnML. First, we train six different ML classifiers (DT, RF, ET, LGBM, AD, and XGB) and obtain an ensemble using the stacking method and another with a majority voting approach. Two different datasets containing high-profile attacks, including distributed denial of service (DDoS), denial of service (DoS), botnets, infiltration, web attacks, heartbleed, portscan, and botnets, were used to train, evaluate, and test the IDS model. To ensure that we obtained a holistic and efficient model, we performed data balancing with synthetic minority oversampling technique (SMOTE) and adaptive synthetic (ADASYN) techniques; after that, we used stratified K-fold to split the data into training, validation, and testing sets. Based on the best two models, we construct our proposed BoostedEnsML model using LightGBM and XGBoost, as the combination of the two classifiers gives a lightweight yet efficient model, which is part of the target of this research. Experimental results show that BoostedEnsML outperformed existing ensemble models in terms of accuracy, precision, recall, F-score, and area under the curve (AUC), reaching 100% in each case on the selected datasets for multiclass classification.","claims":[{"public_id":"cl_1237b00e35879479b236af1e8673b246","status":"active","text":"BoostedEnML is an efficient boosted ensemble machine-learning method for detecting cyberattacks and network intrusions in IoT systems.","confidence":0.98,"contributors":[{"id":1,"public_id":"12632b8b5f","public_label":"Anonymous (12632b8b5f)","roles":["extraction"],"url":"https://sah.borca.ai/u/12632b8b5f"}],"url":"https://sah.borca.ai/claims/cl_1237b00e35879479b236af1e8673b246"},{"public_id":"cl_222f885cca99949cc17c69db2f7750ea","status":"active","text":"BoostedEnsML outperforms existing ensemble models on the selected datasets, reaching 100% accuracy, precision, recall, F-score, and AUC for multiclass classification.","confidence":0.99,"contributors":[{"id":1,"public_id":"12632b8b5f","public_label":"Anonymous (12632b8b5f)","roles":["extraction"],"url":"https://sah.borca.ai/u/12632b8b5f"}],"url":"https://sah.borca.ai/claims/cl_222f885cca99949cc17c69db2f7750ea"},{"public_id":"cl_0ce713f7f55b7d87481db2bae0a0682e","status":"active","text":"Combining LightGBM and XGBoost yields a lightweight yet efficient intrusion-detection model in the proposed ensemble.","confidence":0.92,"contributors":[{"id":1,"public_id":"12632b8b5f","public_label":"Anonymous (12632b8b5f)","roles":["extraction"],"url":"https://sah.borca.ai/u/12632b8b5f"}],"url":"https://sah.borca.ai/claims/cl_0ce713f7f55b7d87481db2bae0a0682e"},{"public_id":"cl_9aa93180e5ff460c72765f725e85f60f","status":"active","text":"SMOTE and ADASYN are used to balance the training data before stratified K-fold splitting into training, validation, and testing sets.","confidence":0.93,"contributors":[{"id":1,"public_id":"12632b8b5f","public_label":"Anonymous (12632b8b5f)","roles":["extraction"],"url":"https://sah.borca.ai/u/12632b8b5f"}],"url":"https://sah.borca.ai/claims/cl_9aa93180e5ff460c72765f725e85f60f"}],"concepts":[{"public_id":"co_0a5427ec5aad206cd115b97934820c6d","status":"active","name":"LightGBM","description":"A gradient-boosting decision tree implementation used as one of the base classifiers.","types":["classifier","machine-learning model"],"aliases":[],"contributors":[{"id":1,"public_id":"12632b8b5f","public_label":"Anonymous (12632b8b5f)","roles":["extraction"],"url":"https://sah.borca.ai/u/12632b8b5f"}],"url":"https://sah.borca.ai/concepts/co_0a5427ec5aad206cd115b97934820c6d"},{"public_id":"co_4d5a3ecbbce5f2464a4761fd6893b6ea","status":"active","name":"selected datasets","description":"Two datasets with labeled cyberattacks used for training, evaluation, and testing.","types":["dataset"],"aliases":["two datasets"],"contributors":[{"id":1,"public_id":"12632b8b5f","public_label":"Anonymous (12632b8b5f)","roles":["extraction"],"url":"https://sah.borca.ai/u/12632b8b5f"}],"url":"https://sah.borca.ai/concepts/co_4d5a3ecbbce5f2464a4761fd6893b6ea"},{"public_id":"co_517968473336ac8e75ebee8618be07cf","status":"active","name":"BoostedEnsML model","description":"The final intrusion-detection ensemble formed from the selected boosted classifiers.","types":["ensemble model","intrusion detection system"],"aliases":["BoostedEnML model"],"contributors":[{"id":1,"public_id":"12632b8b5f","public_label":"Anonymous (12632b8b5f)","roles":["extraction"],"url":"https://sah.borca.ai/u/12632b8b5f"}],"url":"https://sah.borca.ai/concepts/co_517968473336ac8e75ebee8618be07cf"},{"public_id":"co_5500c44e27f5180d963298197871dad8","status":"active","name":"IoT systems","description":"Internet of Things environments in which devices and networks are monitored for security threats.","types":["system"],"aliases":["Internet of Things systems","IoT environments"],"contributors":[{"id":1,"public_id":"12632b8b5f","public_label":"Anonymous (12632b8b5f)","roles":["extraction"],"url":"https://sah.borca.ai/u/12632b8b5f"}],"url":"https://sah.borca.ai/concepts/co_5500c44e27f5180d963298197871dad8"},{"public_id":"co_99cace344555e79df032ceef31308179","status":"active","name":"existing ensemble models","description":"Previously proposed ensemble-based intrusion-detection models used for comparison.","types":["baseline","ensemble model"],"aliases":["existing models"],"contributors":[{"id":1,"public_id":"12632b8b5f","public_label":"Anonymous (12632b8b5f)","roles":["extraction"],"url":"https://sah.borca.ai/u/12632b8b5f"}],"url":"https://sah.borca.ai/concepts/co_99cace344555e79df032ceef31308179"},{"public_id":"co_aa3570a42f9c3b00dee269fb6faa1c9d","status":"active","name":"boosted ML classifiers","description":"Machine-learning classifiers combined through boosting-style ensemble learning.","types":["method"],"aliases":["boosted machine learning classifiers"],"contributors":[{"id":1,"public_id":"12632b8b5f","public_label":"Anonymous (12632b8b5f)","roles":["extraction"],"url":"https://sah.borca.ai/u/12632b8b5f"}],"url":"https://sah.borca.ai/concepts/co_aa3570a42f9c3b00dee269fb6faa1c9d"},{"public_id":"co_acda7948c0f8b8e342eed70ac2626d20","status":"active","name":"BoostedEnML","description":"The proposed boosted ensemble machine-learning approach for detecting cyberattacks in IoT systems.","types":["method"],"aliases":["BoostedEnsML","BoostedEnsML model"],"contributors":[{"id":1,"public_id":"12632b8b5f","public_label":"Anonymous (12632b8b5f)","roles":["extraction"],"url":"https://sah.borca.ai/u/12632b8b5f"}],"url":"https://sah.borca.ai/concepts/co_acda7948c0f8b8e342eed70ac2626d20"},{"public_id":"co_b74c1274003facf9ab543c16af79848d","status":"active","name":"ADASYN","description":"Adaptive synthetic oversampling technique used to balance imbalanced class distributions.","types":["data balancing technique"],"aliases":["adaptive synthetic"],"contributors":[{"id":1,"public_id":"12632b8b5f","public_label":"Anonymous (12632b8b5f)","roles":["extraction"],"url":"https://sah.borca.ai/u/12632b8b5f"}],"url":"https://sah.borca.ai/concepts/co_b74c1274003facf9ab543c16af79848d"},{"public_id":"co_c2947b5df93dc62801987ef75c21788a","status":"active","name":"XGBoost","description":"An optimized gradient-boosting classifier used as one of the base models.","types":["classifier","machine-learning model"],"aliases":[],"contributors":[{"id":1,"public_id":"12632b8b5f","public_label":"Anonymous (12632b8b5f)","roles":["extraction"],"url":"https://sah.borca.ai/u/12632b8b5f"}],"url":"https://sah.borca.ai/concepts/co_c2947b5df93dc62801987ef75c21788a"},{"public_id":"co_c72574278a0b43653f31a7ba0844596c","status":"active","name":"stratified K-fold","description":"A cross-validation splitting strategy that preserves class proportions across folds.","types":["validation method"],"aliases":["stratified K-fold split"],"contributors":[{"id":1,"public_id":"12632b8b5f","public_label":"Anonymous (12632b8b5f)","roles":["extraction"],"url":"https://sah.borca.ai/u/12632b8b5f"}],"url":"https://sah.borca.ai/concepts/co_c72574278a0b43653f31a7ba0844596c"},{"public_id":"co_e9229732a9742ed481c5655a24ba2af6","status":"active","name":"SMOTE","description":"Synthetic Minority Oversampling Technique used to balance imbalanced class distributions.","types":["data balancing technique"],"aliases":["synthetic minority oversampling technique"],"contributors":[{"id":1,"public_id":"12632b8b5f","public_label":"Anonymous (12632b8b5f)","roles":["extraction"],"url":"https://sah.borca.ai/u/12632b8b5f"}],"url":"https://sah.borca.ai/concepts/co_e9229732a9742ed481c5655a24ba2af6"}],"external_ids":{"DOI":"10.3390/s22197409","ArXiv":null,"PubMed":36236506,"PubMedCentral":"9572777","MAG":null,"DBLP":"journals/sensors/OkeyMARSMR22","ACL":null},"open_access":{"is_open_access":true,"pdf_url":"https://www.mdpi.com/1424-8220/22/19/7409/pdf?version=1664447896","landing_url":"https://www.semanticscholar.org/paper/a5bda3fe7fee823861d33b1a931a258bff13c4b3","source":"semantic_scholar","pdf_url_source":"semantic_scholar_open_access_pdf","license":"CCBY","status":"GOLD","reason":null},"reference_availability":{"status":"available","references_indexed":true,"full_text_available":false,"full_text_source":null,"count_basis":"semantic_scholar_metadata","extraction_status":"not_applicable","reason":null},"source":{"provider":"episteme2","base_corpus":"semantic_scholar_dump","freshness_mode":"unknown","basis":["semantic_scholar_metadata","postgres_metadata"],"limits":["paper metadata is based on indexed upstream scholarly datasets","claims and concepts are available only for extracted papers","absence of claims or concepts means no extracted graph data is available in this response"],"status":"available","degraded":false,"degraded_reasons":[],"diagnostics":{"status":"available","degraded":false,"degraded_reasons":[],"metadata_status":"available","graph_status":"available","abstract_status":"available"},"source_flags":5},"paper_id":634497,"paper_uid":"d1abcd28-5533-48ed-adf2-b7646e13603e","canonical_identity":{"paper_id":634497,"paper_uid":"d1abcd28-5533-48ed-adf2-b7646e13603e","identity_status":"available","lookup_basis":"semantic_scholar_external_id","compatibility_path":"corpus_id"},"url":"https://sah.borca.ai/papers/252657816"}