Imbalance-resistant multiclass attack classification in real-time IoT water networks using SMOTE-enhanced random forests
TL;DR
A multi-class attack classification model that is robust to class imbalance and operates in real time on the IoT water network is introduced, classifying samples using the Synthetic Minority Over-sampling Technique (SMOTE) combined with a Random Forest ensemble classifier.
Abstract
The implementation of smart water distribution systems that rely on the Internet of Things (IoT) has substantially increased the need for intrusion detection systems capable of distinguishing among various categories of attackers. Such granularity is essential for timely and appropriate incident response. The nature of telemetry streams in operational settings is imbalanced: normal traffic is prevalent, whereas the rare but important classes of attacks are represented by a small number of attacks. In such circumstances, the traditional type of classifier can achieve high overall accuracy but fails to identify minority threats of greatest operational interest. This paper introduces a multi-class attack classification model that is robust to class imbalance and operates in real time on the IoT water network, classifying samples using the Synthetic Minority Over-sampling Technique (SMOTE) combined with a Random Forest (RF) ensemble classifier. The data used in the study is a collection of 1,048,575 telemetry records that simulate smart water infrastructure behavior by combining network indicators such as AnomalyScore, DataRate, and Protocol with physical-process indicators such as WaterFlowRate (Lpm), thereby covering cyber-physical interactions. An RF model trained on the original imbalanced dataset is compared with one trained on SMOTE-balanced data and evaluated on an unseen imbalanced test set. Even though the baseline achieves 99.3% accuracy, its recall is 0% for the rare DoS and DDoS classes. However, in comparison, the SMOTE-enhanced model obtains 99.88% accuracy and a higher recall of 92.31% for DoS and 99.66% for DDoS, and the macro- averaged F1-score rises from 0.60 to 0.93. The most discriminative features are recognized as AnomalyScore, DataRate, and WaterFlowRate (Lpm), which support interpretability and informed decision-making in sustainability-sensitive smart water infrastructure.