An Intermediate Dataset Creation by Cascading Machine Learning Techniques for MSCA Dataset in IoT Intrusion Detection Systems

The proliferation of Internet of Things (IoT) devices has surged due to continuous advancements in interconnected computing and the emergence of novel network technologies. Safeguarding IoT networks necessitates the deployment of intrusion detection systems (IDSs). However, designing an IDS that achieves high accuracy with minimal false alerts is challenging due to the diversity of attacks and the issue of class imbalance. To address the problem of imbalanced samples in IoT environments, many researchers focus on parameter optimization of machine learning (ML) algorithms, feature selection (FS), and sampling techniques. However, these approaches often require significant time, computational resources, and may lead to data loss. This study proposes the cascading of ML techniques as a novel approach to overcome these limitations. A series of ML methodologies are employed to generate intermediate datasets, aiming to tackle the complexities posed by imbalanced data distributions. Experimental evaluation demonstrates that the proposed cascading method yields promising results when applied to the Multi-Step Cyber-Attack (MSCA) standard IDS dataset. The experimental results showed that the best Single-Level Cascading Architecture achieved 99.82% accuracy, while the Two-Level Cascading Architecture reached 99.99% accuracy. Notably, it effectively handles low-instance data associated with Web_Crawling and ICMP_Flood attacks, highlighting that many existing approaches do not comprehensively address class imbalance. The cascading-based proposed approach achieves a favourable balance between effectiveness and efficiency.