A Lightweight Ensemble Approach for Classification of DDoS Attacks in IoE Environments

Revolutionizing industries through the Internet of Everything (IoE) can lead to severe cyber security issues, especially in the case of Distributed Denial of Service (DDoS) attacks where Internet of Things (IoT) devices are abused to interrupt services. These attacks are way too complex for traditional defenses. Thus it calls out for more sophisticated detection approaches to be implemented. In this research, we develop a lightweight ensemble machine learning framework for DDoS attack detection in IoT networks using the CIC IoT-2023 dataset. Our focus is on four ensemble models, namely: RUSBoost, AdaBoost (AB), Bagging-Decision Trees (DT), and Random Subspace K-Nearest Neighbors (kNN). We measure the results obtained in terms of accuracy, precision, recall, F1-Score, total time spent in training/prediction and the total size of the deployed model. The results revealed that Bagging-DT performed under sub-optimal conditions with an accuracy of 99.96%, indicating high defensive capabilities in real-time IoT settings. In contrast, the standalone DT achieved 100% accuracy at low resource usage, necessitating only 0.04MB of storage, but it raises doubts about its effectiveness in real life scenarios due to its inability to minimize variances. Random Subspace kNN even with its 99.65% accuracy came out as the most impractical choice due to the high utilization of about 3472.53MB of storage space. These findings highlight the trade-offs between accuracy and resource constraints in IoT security. The proposed Bagging-DT model provides a balance between efficiency and reliability making it an apt and scalable solution for DDoS detection.