A stacking ensemble of deep learning models for IoT intrusion detection

The number of Internet of Things (IoT) devices has increased considerably in the past few years, which resulted in an exponential growth of cyber attacks on IoT infrastructure. As a consequence, the prompt detection of attacks in IoT environments through the use of Intrusion Detection Systems (IDS) has become essential. This article proposes a novel approach to intrusion detection in IoT based on a stacking ensemble of deep learning (DL) models. This approach is named Deep Integrated Stacking for the IoT (DIS-IoT) and it combines four different DL models into a fully connected DL layer, creating a standalone ensemble model. DIS-IoT is evaluated on three open-source datasets, namely ToNIoT, CICIDS2017 and SWaT, in binary and multi-class classification and compared results with other standard DL methods. Experiments demonstrate that DIS-IoT is capable of a high-level accuracy with a very low False Positive rate (FPR) in all datasets. Results were also compared against other state-of-the-art works available in the literature, which used similar methods on the same ToNIoT dataset. DIS-IoT achieves comparable performance with others in binary classification and outperforms them in multi-class classification.