Utilising K-Means Clustering and Naive Bayes for IoT Anomaly Detection: A Hybrid Approach

Abstract

AbstractThe proliferation of Internet of Things (IoT) devices means that they have increasingly become a viable target for malicious users. This has created a need for greater flexibility in anomaly detection algorithms that can work across multiple devices. The suggested algorithm will further ensure that our data remains secure from malicious users and potentially avoiding related real-world issues. This chapter suggests a potential alternative anomaly detection algorithm to be implemented within IoT systems that can be applied across different types of devices. This algorithm comprises both unsupervised and supervised areas of machine learning, utilising the strongest facets of each methodology. These are the speed of unsupervised, as well as the accuracy of supervised machine learning. The algorithm involves the initial unsupervised k-means clustering of attacks. The k-means clustering algorithm groups the data as either DDOS, backdoor, ransomware, worm, trojan, password, and normal and assigns them to their clusters. Next, the clusters are then used by the AdaBoosted Naïve Bayes supervised learning algorithm to teach itself which piece of data should be clustered to which specific type of attack. This increases the accuracy of the proposed algorithm by adding clustered data before the final classification step, ensuring a more accurate algorithm that can effectively classify attacks. The correct identification percentage scores for this proposed algorithm range from anywhere from 90 to 100%, as well as rating the proposed algorithm’s accuracy, precision, and recall on different datasets. These high scores demonstrate an accurate, flexible, scalable and optimised algorithm that could potentially be utilised by different IoT devices, ensuring strong data integrity and privacy.KeywordsAnomaly detectionMachine learningIoTAdaBoostNaïve BayesK-means