Choosing the machine learning algorithm for detecting intrusions into IoT

Aim. The paper aims to improve the security of IoT devices by applying machine learning algorithms to detect attacks against IoT networks. The relevance of the goal is defined by the ever-growing number of such attacks around the world and the widespread use of IoT systems. The paper provides relevant statistical data. An analysis of the available papers showed that various methods were examined individually and were not compared to each other, so the aim of this paper that consists in identifying the most promising machine learning algorithm for detecting attacks against IoT networks is of relevance. Methods. The paper used the following machine learning methods to detect attacks against IoT networks: logistic regression, SVC, random forest, K-nearest neighbour method, k-means method, naive Bayes classifier, and variants of gradient boosting (XGBoost, AdaBoost, and CatBoost). The novelty consists in the comparison of the outputs of the supervised algorithms with the unsupervised K-means in the context of detection of attacks against IoT networks. The attack detection systems under development were trained using the UNSWNB15 dataset that contains data on nine types of attacks. The number of entries is more than 80 thousand. More than half of the entries deal with attacks. The methods were compared using a number of metrics. Results. An intrusion detection system was structurally defined and implemented. The stages of its operation include the analysis of input data and the output of final statistical data. The results show that the random forest algorithm is the best one out of those examined. The method also performs well in terms of learning speed. That means that the algorithm can be deployed and applied with the greatest success. Conclusions. This paper presents the results of comparing various machine learning algorithms in the context of IoT device intrusion detection. The accuracy and the ROC-AUC curve are used to evaluate the efficiency of the employed models. Having compared the models of the employed algorithms we found that the RandomForestClassifier model has the highest accuracy and a high AUC, which means that this algorithm is the most efficient in terms of IoT network intrusion detection. Further research will be dedicated to distinguishing between the types of attack.