Ensemble Machine Learning Models for Real-Time Intrusion Detection in Heterogeneous IoT Environments

The high rate of IoT devices proliferation has considerably augmented the attack space of the current networks, making effective intrusion detection critical in supporting the security and reliability of the Internet of Things environment. Complex and diverse attack patterns in real time cannot easily be detected with the standard security measures, so clever detecting methods are required. A complete analysis of the network traffic using 80 extracted features was performed using the RT-IoT2022 dataset which contained both the normal and malicious network activity of devices such as ThingSpeak-LED, Wipro-Bulb and MQTT-Temp as well as the simulated attacks of Brute-force SSH, DDoS and Nmap scan. ML classifiers such as KNN, Gradient Boosting, XGBoost, SVM, RF, DT and Extremely randomized Trees were used to identify bad behavior. In accuracy, precision, recall, and F1-score, we found that RF and Extremely Randomized Trees worked better than the rest with a 99.9% score on all the scores. Such an approach demonstrates that the level of accuracy in determining intrusions in complex IoT networks can be extremely high and real-time. It is an important milestone towards a proactive mitigation of threats and intelligent implementation of network security