Intrusion Detection System for Internet of Thing Environment using Feature Engineering and Balanced Random Forest Algorithm

Network intrusion detection is a crucial defensive mechanism against cyber threats, playing a vital role in preserving the integrity of organizational networks and safeguarding confidential data while averting financial and reputational damage. A prominent challenge in these systems is the significant imbalance between the voluminous normal samples and the relatively scarce malicious ones. To address this imbalance, this study introduces a hybrid sampling approach leveraging the Synthetic Minority Oversampling Technique (SMOTE) to generate additional minority samples, thereby achieving a balanced dataset for model training. We have also used the feature importance concept for feature selection. The performance of the Balanced Random Forest (BRF) classifier, among other classification models, is thoroughly evaluated in this context. Moreover, the efficacy of the proposed model is benchmarked against the traditional SMOTE sampling methodology. When applied to the renowned CICIoT dataset, the RF classifier-equipped model demonstrated superior performance, achieving an impressive 91% accuracy and a 92% F1-Score, surpassing the results obtained with a DNN classifier.