IoTGeM: Generalizable Models for Behaviour-Based IoT Attack Detection
Kahraman Kostas Mike Just Michael A. Lones
Previous research on behaviour-based attack detection on networks of IoT
devices has resulted in machine learning models whose ability to adapt to
unseen data is limited, and often not demonstrated. In this paper we present an
approach for modelling IoT network attacks that focuses on generalizability,
yet also leads to better detection and performance. First, we present an
improved rolling window approach for feature extraction, and introduce a
multi-step feature selection process that reduces overfitting. Second, we build
and test models using isolated train and test datasets, thereby avoiding common
data leaks that have limited the generalizability of previous models. Third, we
rigorously evaluate our methodology using a diverse portfolio of machine
learning models, evaluation metrics and datasets. Finally, we build confidence
in the models by using explainable AI techniques, allowing us to identify the
features that underlie accurate detection of attacks.