Department of Computer Science/Cybersecurity, Princess Sumaya University for Technology, Amman 11941, Jordan.
Department of Homeland Security, Rabdan Academy (RA), Abu Dhabi 22401, United Arab Emirates.
Sensors (Basel). 2021 Dec 29;22(1):241. doi: 10.3390/s22010241.
Network Intrusion Detection Systems (NIDSs) are indispensable defensive tools against various cyberattacks. Lightweight, multipurpose, and anomaly-based detection NIDSs employ several methods to build profiles for normal and malicious behaviors. In this paper, we design, implement, and evaluate the performance of machine-learning-based NIDS in IoT networks. Specifically, we study six supervised learning methods that belong to three different classes: (1) ensemble methods, (2) neural network methods, and (3) kernel methods. To evaluate the developed NIDSs, we use the distilled-Kitsune-2018 and NSL-KDD datasets, both consisting of a contemporary real-world IoT network traffic subjected to different network attacks. Standard performance evaluation metrics from the machine-learning literature are used to evaluate the identification accuracy, error rates, and inference speed. Our empirical analysis indicates that ensemble methods provide better accuracy and lower error rates compared with neural network and kernel methods. On the other hand, neural network methods provide the highest inference speed which proves their suitability for high-bandwidth networks. We also provide a comparison with state-of-the-art solutions and show that our best results are better than any prior art by 1~20%.
网络入侵检测系统（NIDS）是防范各种网络攻击不可或缺的防御工具。轻量级、多用途和基于异常的检测 NIDS 采用多种方法为正常和恶意行为构建配置文件。在本文中，我们设计、实现并评估了基于机器学习的 NIDS 在物联网网络中的性能。具体来说，我们研究了属于三类的六种监督学习方法：（1）集成方法，（2）神经网络方法，和（3）核方法。为了评估所开发的 NIDS，我们使用了经过蒸馏的 Kitsune-2018 和 NSL-KDD 数据集，它们都包含一个当代真实的物联网网络流量，受到不同的网络攻击。我们使用机器学习文献中的标准性能评估指标来评估识别准确性、错误率和推理速度。我们的实证分析表明，与神经网络和核方法相比，集成方法提供了更高的准确性和更低的错误率。另一方面，神经网络方法提供了最高的推理速度，证明它们适用于高带宽网络。我们还与最先进的解决方案进行了比较，并表明我们的最佳结果比任何现有技术都要好 1%~20%。
