Mitigating Class Imbalance for IoT Network Intrusion Detection: A Survey

As the number of Internet of Things (IoT) devices continues to rapidly increase, the need to effectively manage the related security risks has become more obvious. For this reason, datasets such as Bot-IoT were created to train machine learning models on network-based intrusion detection. Bot-IoT is modern, publicly available, and covers a wide range of botnet attack traffic in IoT networks. Out of the roughly 73,000,000 instances contained in this dataset, only about 0.013% represents normal traffic, which indicates that the issue of class imbalance should not be ignored for Bot-IoT. Our contribution includes several important findings based on works that address the imbalance in this dataset. In general, we noted the excellent performance of a diverse range of trained models. This suggests Bot-IoT is a reliable dataset that is relatively easy to classify. We also observed that information on data cleaning was left out in a few papers, thus making it challenging for outside researchers to reproduce experiments from these works. Finally, we noted the popularity of both data-level and algorithm-level approaches for mitigating class imbalance in Bot-IoT.