An extended evaluation on machine learning techniques for Denial-of-Service detection in Wireless Sensor Networks

Abstract

Despite the research efforts in the last years, Denial-of-Service (DoS) attacks detection still represent a challenge for the Internet of Things (IoT) scenarios composed of hard-constrained networks, as Wireless Sensor Networks (WSN). Machine Learning (ML) techniques have been presented as a promising alternative for detecting DoS attacks. Therefore, understanding the impact of the different ML techniques in a comprehensive way is quite important. In this work, we present an extended evaluation covering both supervised and unsupervised ML techniques considering three feature selection algorithms. Our experiments are based on Flooding, Grayhole, and Blackhole DoS attacks from a public WSN-based dataset. As an additional contribution, we investigate the adjustable parameter K to maximize the performance of unsupervised techniques. Experimental comparison is guided by the accuracy, recall, precision, F1-Score, and processing time metrics. Results reveal that, among the studied ML algorithms, the supervised techniques present better performance than the unsupervised ones: the highest F1-Score (95.69%) was obtained by the REPTree with the OneR feature selection algorithm for detecting blackhole attacks. In general, supervised techniques are faster than unsupervised. REPTree is the fastest, spending 0.931 μs on average to classify a sample.