Hybrid Machine Learning Model for Real-Time Anomaly Detection in IOT Networks

Abstract

As the number of Internet of Things devices connected continues to rise rapidly, a negative consequence will be the emergence of new types of attack vectors. The growing number of connected devices generates an ever-increasing volume of traffic across the Internet, exposing these devices to the threat of malicious attacks. Traditional methods used to identify anomalous behaviours (for example, detecting unusual events) are unable to work effectively on the volume of data generated by IoT devices due to their sensitivity to noise, their tendency to have class imbalances, and their inability to model very complex data patterns. In this study, we propose the use of a hybrid machine-learning model based on Support Vector Machines (SVM) and Isolation Forest to enable us to identify anomalous behaviour in real time with a higher degree of accuracy compared to using either method independently. We implemented the hybrid approach using Python and tested it on 10,000 flow records created from actual network activity (80% for training, 20% for testing). Hybrid Algorithm Results were superior to results achieved by using each algorithm alone, with hybrid achieving Accuracy of 98.3%, Precision of 98.0%, Sensitivity of 98.5%, and F1 Score of 98.2%, and AUC for Hybrid was equal to 0.99, which is greater than SVM alone (94.2%, AUC = 0.96) or Isolation Forest Algorithm alone (91.5%, 93), Therefore, using complementary algorithms combined provide significantly improved detection rate with greatly reduced number of false alerts, thus providing higher level of confidence in deploying in healthcare, industrial automation and smart cities.