Journal Home > Volume 6 , Issue 3
Big Data Mining and Analytics 2023, 6(3): 273-287 https://doi.org/10.26599/BDMA.2022.9020032
Open Access | Issue | Published: 07 April 2023

An Ensemble Learning Based Intrusion Detection Model for Industrial IoT Security

Show Author's Information Mouaad Mohy-Eddine1,  Azidine Guezzaz1( ),  Said Benkirane1,  Mourade Azrour2,  Yousef Farhaoui2
Technology Higher School, Cadi Ayyad University, Essaouira 44000, Morocco.
IDMS Team, Faculty of Sciences and Techniques, Moulay Ismail University of Meknès, Errachidia 52000, Morocco.
Keywords:
random forest, isolation forest, Industrial Internet of Things (IIoT), Intrusion Detection Dystem (IDS), intrusion, Pearson’s Correlation Coefficient (PCC)
Cite this article:
Mohy-Eddine M, Guezzaz A, Benkirane S, et al. An Ensemble Learning Based Intrusion Detection Model for Industrial IoT Security. Big Data Mining and Analytics, 2023, 6(3): 273-287. https://doi.org/10.26599/BDMA.2022.9020032
Download citation
EndNote(RIS)
BibTeX

888

Views

173

Downloads

Citations

17

Crossref

11

WoS

19

Scopus

0

CSCD

Abstract Full text About this article

Industrial Internet of Things (IIoT) represents the expansion of the Internet of Things (IoT) in industrial sectors. It is designed to implicate embedded technologies in manufacturing fields to enhance their operations. However, IIoT involves some security vulnerabilities that are more damaging than those of IoT. Accordingly, Intrusion Detection Systems (IDSs) have been developed to forestall inevitable harmful intrusions. IDSs survey the environment to identify intrusions in real time. This study designs an intrusion detection model exploiting feature engineering and machine learning for IIoT security. We combine Isolation Forest (IF) with Pearson’s Correlation Coefficient (PCC) to reduce computational cost and prediction time. IF is exploited to detect and remove outliers from datasets. We apply PCC to choose the most appropriate features. PCC and IF are applied exchangeably (PCCIF and IFPCC). The Random Forest (RF) classifier is implemented to enhance IDS performances. For evaluation, we use the Bot-IoT and NF-UNSW-NB15-v2 datasets. RF-PCCIF and RF-IFPCC show noteworthy results with 99.98% and 99.99% Accuracy (ACC) and 6.18 s and 6.25 s prediction time on Bot-IoT, respectively. The two models also score 99.30% and 99.18% ACC and 6.71 s and 6.87 s prediction time on NF-UNSW-NB15-v2, respectively. Results prove that our designed model has several advantages and higher performance than related models.


menu
Abstract
Full text
Outline
About this article

An Ensemble Learning Based Intrusion Detection Model for Industrial IoT Security

Show Author's information Mouaad Mohy-Eddine1, Azidine Guezzaz1( ), Said Benkirane1, Mourade Azrour2, Yousef Farhaoui2
Technology Higher School, Cadi Ayyad University, Essaouira 44000, Morocco.
IDMS Team, Faculty of Sciences and Techniques, Moulay Ismail University of Meknès, Errachidia 52000, Morocco.

Abstract

Industrial Internet of Things (IIoT) represents the expansion of the Internet of Things (IoT) in industrial sectors. It is designed to implicate embedded technologies in manufacturing fields to enhance their operations. However, IIoT involves some security vulnerabilities that are more damaging than those of IoT. Accordingly, Intrusion Detection Systems (IDSs) have been developed to forestall inevitable harmful intrusions. IDSs survey the environment to identify intrusions in real time. This study designs an intrusion detection model exploiting feature engineering and machine learning for IIoT security. We combine Isolation Forest (IF) with Pearson’s Correlation Coefficient (PCC) to reduce computational cost and prediction time. IF is exploited to detect and remove outliers from datasets. We apply PCC to choose the most appropriate features. PCC and IF are applied exchangeably (PCCIF and IFPCC). The Random Forest (RF) classifier is implemented to enhance IDS performances. For evaluation, we use the Bot-IoT and NF-UNSW-NB15-v2 datasets. RF-PCCIF and RF-IFPCC show noteworthy results with 99.98% and 99.99% Accuracy (ACC) and 6.18 s and 6.25 s prediction time on Bot-IoT, respectively. The two models also score 99.30% and 99.18% ACC and 6.71 s and 6.87 s prediction time on NF-UNSW-NB15-v2, respectively. Results prove that our designed model has several advantages and higher performance than related models.

Keywords: random forest, isolation forest, Industrial Internet of Things (IIoT), Intrusion Detection Dystem (IDS), intrusion, Pearson’s Correlation Coefficient (PCC)

References(64)

[1]
P. M. Chanal and M. S. Kakkasageri, Security and privacy in IoT: A survey, Wireless Personal Communications, vol. 115, pp. 1667–1693, 2020.
DOI Google Scholar
[2]
P. Sethi and S. R. Sarangi, Internet of things: Architectures, protocols, and applications, Journal of Electrical and Computer Engineering, vol. 2017, p. 9324035, 2017.
DOI Google Scholar
[3]
F. A. Alaba, M. Othman, I. A. T. Hashem, and F. Alotaibi, Internet of things security: A survey, Journal of Network and Computer Applications, vol. 88, pp. 10–28, 2017.
DOI Google Scholar
[4]
M. Azrour, J. Mabrouki, Y. Farhaoui, and A. Guezzaz, Security analysis of Nikooghadam et al.’s authentication protocol for cloud-IoT, in Intelligent Systems in Big Data, Semantic Web and Machine Learning, N. Gherabi and J. Kacprzyk, eds. Cham, Switzerland: Springer, 2021, pp. 261–269.
DOI
[5]
M. Moutaib, T. Ahajjam, M. Fattah, Y. Farhaoui, B. Aghoutane, and M. E. Bekkali, Application of internet of things in the health sector: Toward minimizing energy consumption, Big Data Mining and Analytics, vol. 5, no. 4, pp. 302–308, 2022.
DOI Google Scholar
[6]
M. Azrour, J. Mabrouki, A. Guezzaz, and Y. Farhaoui, New enhanced authentication protocol for internet of things, Big Data Mining and Analytics, vol. 4, no. 1, pp. 1–9, 2021.
DOI Google Scholar
[7]
R. V. Solms and J. V. Niekerk, From information security to cyber security, Computers & Security, vol. 38, pp. 97–102, 2013.
DOI Google Scholar
[8]
M. Azrour, J. Mabrouki, A. Guezzaz, and A. Kanwal, Internet of things security: Challenges and key issues, Security and Communication Networks, vol. 2021, p. 5533843, 2021.
DOI Google Scholar
[9]
A. Guezzaz, S. Benkirane, and M. Azrour, A novel anomaly network intrusion detection system for internet of things security, in IoT and Smart Devices for Sustainable Environment, M. Azrour, A. Irshad, and R. Chaganti, eds. Cham, Switzerland: Springer, 2022, pp. 129–138.
DOI
[10]
M. B. M. Noor and W. H. Hassan, Current research on internet of things (IoT) security: A survey, Computer Networks, vol. 148, pp. 283–294, 2019.
DOI Google Scholar
[11]
M. A. Khan, M. A. K. Khattk, S. Latif, A. A. Shah, M. U. Rehman, W. Boulila, M. Driss, and J. Ahmad, Voting classifier-based intrusion detection for IoT networks, in Advances on Smart and Soft Computing, F. Saeed, T. Al-Hadhrami, E. Mohammed, and M. Al-Sarem, eds. Singapore: Springer, 2022, pp. 313–328.
DOI
[12]
X. Yu and H. Guo, A survey on IIoT security, in Proc. 2019 IEEE VTS Asia Pacific Wireless Communications Symposium (APWCS), Singapore, 2019, pp. 1–5.
DOI Google Scholar
[13]
K. Tange, M. D. Donno, X. Fafoutis, and N. Dragoni, A systematic survey of industrial internet of things security: Requirements and fog computing opportunities, IEEE Communications Surveys & Tutorials, vol. 22, no. 4, pp. 2489–2520, 2020.
DOI Google Scholar
[14]
A. C. Panchal, V. M. Khadse, and P. N. Mahalle, Security issues in IIoT: A comprehensive survey of attacks on IIoT and its countermeasures, in Proc. 2018 IEEE Global Conference on Wireless Computing and Networking (GCWCN), Lonavala, India, 2018, pp. 124–130.
DOI Google Scholar
[15]
J. Sengupta, S. Ruj, and S. D. Bit, A comprehensive survey on attacks, security issues and blockchain solutions for IoT and IIoT, Journal of Network and Computer Applications, vol. 149, p. 102481, 2020.
DOI Google Scholar
[16]
A. Esfahani, G. Mantas, R. Matischek, F. B. Saghezchi, J. Rodriguez, A. Bicaku, S. Maksuti, M. G. Tauber, C. Schmittner, and J. Bastos, A lightweight authentication mechanism for M2M communications in industrial IoT environment, IEEE Internet of Things Journal, vol. 6, no. 1, pp. 288–296, 2019.
DOI Google Scholar
[17]
Q. Yan, W. Huang, X. Luo, Q. Gong, and F. R. Yu, A multi-level DDoS mitigation framework for the industrial internet of things, IEEE Communications Magazine, vol. 56, no. 2, pp. 30–36, 2018.
DOI Google Scholar
[18]
A. L. Buczak and E. Guven, A survey of data mining and machine learning methods for cyber security intrusion detection, IEEE Communications Surveys & Tutorials, vol. 18, no. 2, pp. 1153–1176, 2016.
DOI Google Scholar
[19]
S. M. Kasongo, An advanced intrusion detection system for IIoT based on GA and tree based algorithms, IEEE Access, vol. 9, pp. 113199–113212, 2021.
DOI Google Scholar
[20]
A. Aldweesh, A. Derhab, and A. Z. Emam, Deep learning approaches for anomaly-based intrusion detection systems: A survey, taxonomy, and open issues, Knowledge-Based Systems, vol. 189, p. 105124, 2020.
DOI Google Scholar
[21]
A. Guezzaz, A. Asimi, Y. Asimi, Z. Tbatou, and Y. Sadqi, A global intrusion detection system using PcapSockS sniffer and multilayer perceptron classifier, Int. J. Netw. Secur., vol. 21, no. 3, pp. 438–450, 2019.
Google Scholar
[22]
A. Khraisat, I. Gondal, P. Vamplew, and J. Kamruzzaman, Survey of intrusion detection system: Techniques, datasets and challenges, Cybersecurity, vol. 2, p. 20, 2019.
DOI Google Scholar
[23]
A. Guezzaz, Y. Asimi, M. Azrour, and A. Asimi, Mathematical validation of proposed machine learning classifier for heterogeneous traffic and anomaly detection, Big Data Mining and Analytics, vol. 4, no. 1, pp. 18–24, 2021.
DOI Google Scholar
[24]
F. T. Liu, K. M. Ting, and Z. -H. Zhou, Isolation forest, in Proc. 2008 Eighth IEEE International Conference on Data Mining, Pisa, Italy, 2008, pp. 413–422.
DOI Google Scholar
[25]
T. K. Ho, Random decision forests, in Proc. 3rd International Conference on Document Analysis and Recognition, Montreal, Canada, 1995, pp. 278–282.
Google Scholar
[26]
T. Ainsworth, J. Brake, P. Gonzalez, D. Toma, and A. F. Browne, A comprehensive survey of industry 4.0, IIOT and areas of implementation, in Proc. SoutheastCon 2021, Atlanta, GA, USA, 2021, pp. 1–6.
DOI Google Scholar
[27]
P. K. Malik, R. Sharma, R. Singh, A. Gehlot, S. C. Satapathy, W. S. Alnumay, D. Pelusi, U. Ghosh, and J. Nayak, Industrial internet of things and its applications in industry 4.0: State of the art, Computer Communications, vol. 166, pp. 125–139, 2021.
DOI Google Scholar
[28]
L. Hylving and U. Schultze, Evolving the modular layered architecture in digital innovation: The case of the car’s instrument cluster, presented at 34th International Conference on Information Systems, Milan, Italy, 2013.
Google Scholar
[29]
M. A. Ferrag, L. Maglaras, S. Moschoyiannis, and H. Janicke, Deep learning for cyber security intrusion detection: Approaches, datasets, and comparative study, Journal of Information Security and Applications, vol. 50, p. 102419, 2020.
DOI Google Scholar
[30]
J. Gu and S. Lu, An effective intrusion detection approach using SVM with Naïve Bayes feature embedding, Computers & Security, vol. 103, p. 102158, 2020.
DOI Google Scholar
[31]
H. -J. Liao, C. -H. R. Lin, Y. -C. Lin, and K. -Y. Tung, Intrusion detection system: A comprehensive review, Journal of Network and Computer Applications, vol. 36, no. 1, pp. 16–24, 2013.
DOI Google Scholar
[32]
M. Azrour, J. Mabrouki, G. Fattah, A. Guezzaz, and F. Aziz, Machine learning algorithms for efficient water quality prediction, Modeling Earth Systems and Environment, vol. 8, no. 2, pp. 2793–2801, 2022.
DOI Google Scholar
[33]
A. K. Sandhu, Big data with cloud computing: Discussions and challenges, Big Data Mining and Analytics, vol. 5, no. 1, pp. 32–40, 2021.
DOI Google Scholar
[34]
K. Peng, V. C. M. Leung, L. Zheng, S. Wang, C. Huang, and T. Lin, Intrusion detection system based on decision tree over big data in fog environment, Wireless Communications and Mobile Computing, vol. 2018, p. 4680867, 2018.
DOI Google Scholar
[35]
R. Wazirali, An improved intrusion detection system based on KNN hyperparameter tuning and cross-validation, Arabian Journal for Science and Engineering, vol. 45, no. 12, pp. 10859–10873, 2020.
DOI Google Scholar
[36]
A. A. Sallam, M. N. Kabir, Y. M. Alginahi, A. Jamal, and T. K. Esmeel, IDS for improving DDoS attack recognition based on attack profiles and network traffic features, in Proc. 2020 16th IEEE International Colloquium on Signal Processing & Its Applications (CSPA), Langkawi, Malaysia, 2020, pp. 255–260.
DOI Google Scholar
[37]
J. Gu, L. Wang, H. Wang, and S. Wang, A novel approach to intrusion detection using SVM ensemble with feature augmentation, Computers & Security, vol. 86, pp. 53–62, 2019.
DOI Google Scholar
[38]
S. Waskle, L. Parashar, and U. Singh, Intrusion detection system using PCA with random forest approach, in Proc. 2020 International Conference on Electronics and Sustainable Communication Systems (ICESC), Coimbatore, India, 2020, pp. 803–808.
DOI Google Scholar
[39]
J. O. Mebawondu, O. D. Alowolodu, J. O. Mebawondu, and A. O. Adetunmbi, Network intrusion detection system using supervised learning paradigm, Scientific African, vol. 9, p. e00497, 2020.
DOI Google Scholar
[40]
J. Doe, The dictionary of substances and their effects, http://www.rsc.org/dose/title, 1999.
[41]
J. Chen, X. Qi, L. Chen, F. Chen, and G. Cheng, Quantum-inspired ant lion optimized hybrid k-means for cluster analysis and intrusion detection, Knowledge-Based Systems, vol. 203, p. 106167, 2020.
DOI Google Scholar
[42]
L. Wang, J. Yang, M. Workman, and P. Wan, Effective algorithms to detect stepping-stone intrusion by removing outliers of packet RTTs, Tsinghua Science and Technology, vol. 27, no. 2, pp. 432–442, 2021.
DOI Google Scholar
[43]
A. Saxena, K. Saxena, and J. Goyal, Hybrid technique based on DBSCAN for selection of improved features for intrusion detection system, in Emerging Trends in Expert Applications and Security, V. S. Rathore, M. Worring, D. K. Mishra, A. Joshi, S. Maheshwari, eds. Singapore: Springer, 2019, pp. 365–377.
DOI
[44]
M. Ester, H. P. Kriegel, J. Sander, and X. Xu, A density-based algorithm for discovering clusters in large spatial databases with noise, in Proc. Second International Conference on Knowledge Discovery and Data Mining, Portland, OR, USA, 1996, pp. 226–231.
Google Scholar
[45]
K. Sadaf and J. Sultana, Intrusion detection based on autoencoder and isolation forest in fog computing, IEEE Access, vol. 8, pp. 167059–167068, 2020.
DOI Google Scholar
[46]
A. Sarica, A. Cerasa, and A. Quattrone, Random forest algorithm for the classification of neuroimaging data in Alzheimer’s disease: A systematic review, Frontiers in Aging Neuroscience, vol. 9, p. 329, 2017.
DOI Google Scholar
[47]
L. Zhang, S. Jiang, X. Shen, B. B. Gupta, and Z. Tian, PWG-IDS: An intrusion detection model for solving class imbalance in IIoT networks using generative adversarial networks, arXiv preprint arXiv: 2110.03445, 2021.
Google Scholar
[48]
A. Raghuvanshi, U. K. Singh, G. S. Sajja, H. Pallathadka, E. Asenso, M. Kamal, A. Singh, and K. Phasinam, Intrusion detection using machine learning for risk mitigation in IoT-enabled smart irrigation in smart farming, Journal of Food Quality, vol. 2022, p. 3955514, 2022.
DOI Google Scholar
[49]
A. Guezzaz, S. Benkirane, M. Azrour, and S. Khurram, A reliable network intrusion detection approach using decision tree with enhanced data quality, Security and Communication Networks, vol. 2021, p. 1230593, 2021.
DOI Google Scholar
[50]
A. Alhowaide, I. Alsmadi, and J. Tang, Ensemble detection model for IoT IDS, Internet of Things, vol. 16, p. 100435, 2021.
DOI Google Scholar
[51]
D. Javeed, T. Gao, M. T. Khan, and D. Shoukat, A hybrid intelligent framework to combat sophisticated threats in secure industries, Sensors, vol. 22, no. 4, p. 1582, 2022.
DOI Google Scholar
[52]
M. Ge, N. F. Syed, X. Fu, Z. Baig, and A. Robles-Kelly, Towards a deep learning-driven intrusion detection approach for internet of things, Computer Networks, vol. 186, p. 107784, 2021.
DOI Google Scholar
[53]
R. Malik, Y. Singh, Z. A. Sheikh, P. Anand, P. K. Singh, and T. C. Workneh, An improved deep belief network IDS on IoT-based network for traffic systems, Journal of Advanced Transportation, vol. 2022, p. 7892130, 2022.
DOI Google Scholar
[54]
M. Alanazi and A. Aljuhani, Anomaly detection for internet of things cyberattacks, Computers, Materials & Continua, vol. 72, no. 1, pp. 261–279, 2022.
DOI Google Scholar
[55]
J. D. Lee, H. S. Cha, S. Rathore, and J. H. Park, M-IDM: A multi-classification based intrusion detection model in healthcare IoT, Computers, Materials & Continua, vol. 67, no. 2, pp. 1537–1553, 2021.
DOI Google Scholar
[56]
Z. K. Maseer, R. Yusof, S. A. Mostafa, N. Bahaman, O. Musa, and B. A. S. Al-rimy, DeepIoT.IDS: Hybrid deep learning for enhancing IoT network intrusion detection, Computers, Materials & Continua, vol. 69, no. 3, pp. 3945–3966, 2021.
DOI Google Scholar
[57]
H. Yao, P. Gao, P. Zhang, J. Wang, C. Jiang, and L. Lu, Hybrid intrusion detection system for edge-based IIoT relying on machine-learning-aided detection, IEEE Network, vol. 33, no. 5, pp. 75–81, 2019.
DOI Google Scholar
[58]
T. Kuang, Z. Hu, and M. Xu, A genetic optimization algorithm based on adaptive dimensionality reduction, Mathematical Problems in Engineering, vol. 2020, p. 8598543, 2020.
DOI Google Scholar
[59]
N. Koroniotis, N. Moustafa, E. Sitnikova, and B. Turnbull, Towards the development of realistic botnet dataset in the internet of things for network forensic analytics: Bot-IoT dataset, Future Generation Computer Systems, vol. 100, pp. 779–796, 2019.
DOI Google Scholar
[60]
Q. Yang, J. Singh, and J. Lee, Isolation-based feature selection for unsupervised outlier detection, presented at Annu. Conf. Progn. Health Manag. Soc., Scottsdale, AZ, USA, 2019.
DOI Google Scholar
[61]
M. Sarhan, S. Layeghy, and M. Portmann, Towards a standard feature set for network intrusion detection system datasets, Mobile Networks and Applications, vol. 27, no. 1, pp. 357–370, 2022.
DOI Google Scholar
[62]
P. Nimbalkar and D. Kshirsagar, Feature selection for intrusion detection system in internet-of-things (IoT), ICT Express, vol. 7, no. 2, pp. 177–181, 2021.
DOI Google Scholar
[63]
M. Abushwereb, M. Alkasassbeh, M. Almseidin, and M. Mustafa, An accurate IoT intrusion detection framework using apache spark, arXiv preprint arXiv: 2203.04347, 2022.
Google Scholar
[64]
T. Saba, A. Rehman, T. Sadad, H. Kolivand, and S. A. Bahaj, Anomaly-based intrusion detection system for IoT networks through deep learning model, Computers & Electrical Engineering, vol. 99, p. 107810, 2022.
DOI Google Scholar
Publication history
Copyright
Rights and permissions

Publication history

Received: 25 June 2022
Revised: 18 August 2022
Accepted: 01 September 2022
Published: 07 April 2023
Issue date: September 2023

Copyright

© The author(s) 2023.

Rights and permissions

The articles published in this open access journal are distributed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/).

Return