RecoSelector: Cost-Sensitive Feature Selection for Network Intrusion Detection in Resource-Constrained Internet of Things

Detecting malware in Internet of Things (IoT) networks is crucial for ensuring IoT security. Machine learning based Network Intrusion Detection System (NIDS) has been proven to be effective, but it faces the challenge of achieving high computational efficiency. Previous feature selection methods improve the efficiency of NIDS by removing redundant features. However, these methods fail to consider the significant disparity in computational cost among different traffic features, so they are not fully applicable for resource-constrained environment. To address this issue, we propose a novel framework RecoSelector to select traffic features in a cost-sensitive manner for NIDS. RecoSelector aims to effectively select feature subsets with strong detection capability and low computational cost. Firstly, we quantify and analyze the feature construction cost among IoT short flows, IoT long flows and cross platform flows from 6 scenarios. Based on the flows, we generate computational-loss of 69 flow features through flow transmission frequency. Secondly, we propose Particle Initialization based on Orthogonal Sparse Vector (PIOSV) to optimize search direction and increase the possibility of finding a global optimal solution. Finally, we design an elaborate fitness function RecoFitness, aiming to carry out multi-objective optimization, for iterative selection. We obtain flow feature cost in a real resource-constrained environment. Experiments demonstrate that RecoSelector exhibits superior performance with spending only 3% to 60% of the computational time cost while achieving comparable F1 scores compared to existing methods.