Using Ensemble Learning for Identifying the Type in IoT Intrusion

Aim. The aim of this work is to improve the quality of multi‑class classification for Intrusion Detection Systems (IDS) in the Internet of Things (IoT) environment. The goal of the research is to determine the impact of preliminary binary traffic filtering and the application of ensemble models on prediction accuracy, especially for minority attack classes, taking into account the computational constraints of IoT environments. Methods. Three architectural approaches were studied: direct multi‑class classification, direct multi‑class classification (including the “normal” class), and a hierarchical architecture based on initial binary detection followed by classification by attack type. Eight machine learning algorithms, as well as three ensemble methods (Soft Voting Classifier (SVC), Hard Voting Classifier (HVC), and Stacking Classifier (SC)), were evaluated. Experiments were conducted on the UNSW‑NB15 dataset using metrics such as Precision, Recall, and F1‑score. Results. The results show that direct classification provides better overall attack coverage (average F1‑score up to 63% for Gradient Boosting Classifier(GBC)), but may require longer training times (over2000 seconds for GBC). Hierarchical binary filtering significantly reduces computation time but can decrease performance for some rare classes. The GBC, Random Forest (RF), and Extra Trees (ET) algorithms stand out for their performance. Among the ensemble methods, the Stacking Classifier (SC) demonstrates the best results (F1‑score of 73.87%), surpassing individual classifiers, although it also requires substantial training time. Conclusion. This research shows that implementing binary filtration is a relevant strategy for reducing computational costs, but a trade‑off must be found between performance, coverage, and efficiency. GBC remains the most effective meth‑ od for rare attacks but, due to its computational cost, is poorly suited for embedded systems. ET and RF represent an excellent compromise between accuracy and speed. SC, while the most effective, requires significant resources. The scientific novelty of the research lies in the systematic evaluation of hierarchical and ensemble approaches for IDS in IoT, paving the way for creating more robust architectures adapted to IoT cybersecurity tasks.