Exploring Machine Learning Models : For IoT Network Intrusion Detection : A Literature Review and Comparative Analysis

Abstract

The Internet of Things (IoT) encompasses a variety of systems and devices that enable data exchange across networks. With this interleaved connectivity comes an inherent vulnerability to attacks. Traditional intrusion detection in IoT environments has been primarily human-reliant, but modern malicious methods surpass manual approaches. Machine Learning (ML)-based Intrusion Detection Systems (IDS) show promise but require refinement to match human-monitored IDS effectiveness. This study involved a literature review of research involving the NetFlow dataset NF-ToN-IoT-v2, created in 2022 to enable ML-based IDS development. With balancing, the dataset includes approximately 16 million net-flows, with 63.99% attack and 36.01% benign. The data’s imbalanced nature was addressed through methods like down sampling to reduce training bias. A hyper-parameter tuning pipeline was used to optimize algorithm testing and cross-validation, especially for different data balancing methods. The algorithms tested based on previous research found during literature review include Naïve Bayes, Random Forest, K-Nearest Neighbor (KNN), Support Vector Machines (SVM), and XGBoost. Comparative analysis using confusion matrices and bar plots enabled the evaluation of algorithm effectiveness. Overall, this research highlights the potential of ML approaches in IoT IDS development, through leveraging NF-ToN-IoT-v2 to enhance detection accuracy and bridge the gap between human-monitored and ML-driven solutions.