Feature Engineering and Machine Learning Framework for DDoS Attack Detection in the Standardized Internet of Things

Over the past decade, there has been huge rise in the number of Internet of Things (IoT) devices and networks often characterized by resource constraints on energy, memory, communication, and computation power and, thus, integration of security mechanisms in these networks are often neglected. As the attacks increase, it becomes essential to secure the networks with machine learning (ML)-based intrusion detection system (IDS) for their higher accuracy and reduced false alarms. However, these systems highly rely on data and optimal features for extrapolation and attack detection. Existing benchmark data sets are obsolete and lack IoT compatible traffic data and, therefore, to address this issue, we explore a novel data set, cross layer intrusion detection data set for IoT (IoT-CIDDS) data set with 21 features and single labeling attribute. In this study, we propose a feature engineering and ML framework to detect Distributed Denial-of-Service (DDoS) attacks of IoT-CIDDS data set. The framework consists of two phases. In the first phase, we develop algorithms for data set enrichment and emphasize on advanced feature engineering for statistically analyzing the data set with probability distribution and correlation among features. In the second phase, we propose an ML model and perform complexity analysis of the feature engineered data set with five ML techniques by creating training, validation, and testing data sets from IoT-CIDDS. The ML models are evaluated in terms of accuracy, precision, recall, area under curve, false positive rate, and computational time for training the classifiers. The experimental results show that substantial feature reduction optimizes the performance of ML-based IDS for detecting DDoS attacks in standardized IoT networks employing 6LoWPAN stack.