Detecting Cyber-Attacks on Internet of Things Devices: An Effective Preprocessing Method

Abstract

Cyber-attacks targeting Internet of Things (IoT) devices are still attracting the interest of network security researchers as hackers always improve their cyber-attack methods to bypass intrusion detection systems. Machine learning plays an important role in IoT security from cyber-attacks. In other words, machine learning algorithms that are widely applied to detect anomalous network flows from IoT devices are still limited. This is because the actual data is often complex, noisy, and has many redundancies that are not readily available for machine learning classifiers. Meanwhile, IoT devices are diverse and heterogeneous, so the actual network flow data of IoT devices is more complex. Therefore, two feature sets common to network traffic data (Tshark and CICFlowMeter) have been evaluated through two real datasets, i.e., ToN-IoT and Agent-IoT. This research result contributes to providing a reference to the research community in choosing the suitable method to preprocess actual network traffic data from IoT devices when using machine learning to cyber-attack detection. Experimental results show that there are many differences between training and testing on the same dataset and different datasets. Also, experimental results obtained by our algorithms are promising and have achieved more than 99% F1-score with CICFlowMeter.