Machine learning based models for detecting attacks in IoT systems

IoT platforms based on microservices are susceptible to vulnerabilities that can enable attackers to disrupt a system’s normal operation. Recently, machine learning-based intrusion detection systems have garnered much interest from the scientific community. These techniques require reliable databases to carry out training. However, having balanced databases is not frequent, which could compromise the quality of the models.This article proposes the combination of two network traffic databases, Bot-Iot and UNSW-NB15, to construct a new balanced database that allows for model training. This new database has been used to build and evaluate four machine learning models for attack detection: decision trees, random forests, logistic regression, and support vector machines (SVM). The attacks are detected by classifying network traffic as either normal or anomalous. The following metrics were used to evaluate the models: accuracy, sensitivity, precision, and f1-score. The experimental results show that the models have a performance of over 99% for the different metrics.