A Cost-Sensitive Machine Learning Model With Multitask Learning for Intrusion Detection in IoT

Akbar Telikani; Nima Esmi Rudbardeh; Shiva Soleymanpour; Asadollah Shahbahrami; Jun Shen; Georgi Gaydadjiev; Reza Hassanpour

doi:10.1109/TII.2023.3314208

A Cost-Sensitive Machine Learning Model With Multitask Learning for Intrusion Detection in IoT

Akbar Telikani, Nima Esmi Rudbardeh, Shiva Soleymanpour, Asadollah Shahbahrami, Jun Shen, Georgi Gaydadjiev, Reza Hassanpour

Research output: Contribution to journal › Article › Scientific › peer-review

15 Downloads (Pure)

Abstract

A problem with machine learning (ML) techniques for detecting intrusions in the Internet of Things (IoT) is that they are ineffective in the detection of low-frequency intrusions. In addition, as ML models are trained using specific attack categories, they cannot recognize unknown attacks. This article integrates strategies of cost-sensitive learning and multitask learning into a hybrid ML model to address these two challenges. The hybrid model consists of an autoencoder for feature extraction and a support vector machine (SVM) for detecting intrusions. In the cost-sensitive learning phase for the class imbalance problem, the hinge loss layer is enhanced to make a classifier strong against low-distributed intrusions. Moreover, to detect unknown attacks, we formulate the SVM as a multitask problem. Experiments on the UNSW-NB15 and BoT-IoT datasets demonstrate the superiority of our model in terms of recall, precision, and F1-score averagely 92.2%, 96.2%, and 94.3%, respectively, over other approaches.

Original language	English
Pages (from-to)	3880-3890
Number of pages	11
Journal	IEEE Transactions on Industrial Informatics
Volume	20
Issue number	3
DOIs	https://doi.org/10.1109/TII.2023.3314208
Publication status	Published - 2023
Externally published	Yes

Bibliographical note

Green Open Access added to TU Delft Institutional Repository ‘You share, we take care!’ – Taverne project https://www.openaccess.nl/en/you-share-we-take-care
Otherwise as indicated in the copyright section: the publisher is the copyright holder of this work and the author uses the Dutch legislation to make this work public.

Keywords

Costs
Deep learning (DL)
Internet of Things
Internet of things (IoT)
intrusion detection
Intrusion detection
Mathematical models
multitask learning
support vector machine (SVM)
Support vector machines
Task analysis
Training

Access to Document

10.1109/TII.2023.3314208

A_Cost-Sensitive_Machine_Learning_Model_With_Multitask_Learning_for_Intrusion_Detection_in_IoTFinal published version, 1.7 MB

Cite this

@article{6d6ff82b962e4323978543097a2d86f7,

title = "A Cost-Sensitive Machine Learning Model With Multitask Learning for Intrusion Detection in IoT",

abstract = "A problem with machine learning (ML) techniques for detecting intrusions in the Internet of Things (IoT) is that they are ineffective in the detection of low-frequency intrusions. In addition, as ML models are trained using specific attack categories, they cannot recognize unknown attacks. This article integrates strategies of cost-sensitive learning and multitask learning into a hybrid ML model to address these two challenges. The hybrid model consists of an autoencoder for feature extraction and a support vector machine (SVM) for detecting intrusions. In the cost-sensitive learning phase for the class imbalance problem, the hinge loss layer is enhanced to make a classifier strong against low-distributed intrusions. Moreover, to detect unknown attacks, we formulate the SVM as a multitask problem. Experiments on the UNSW-NB15 and BoT-IoT datasets demonstrate the superiority of our model in terms of recall, precision, and F1-score averagely 92.2%, 96.2%, and 94.3%, respectively, over other approaches.",

keywords = "Costs, Deep learning (DL), Internet of Things, Internet of things (IoT), intrusion detection, Intrusion detection, Mathematical models, multitask learning, support vector machine (SVM), Support vector machines, Task analysis, Training",

author = "Akbar Telikani and Rudbardeh, {Nima Esmi} and Shiva Soleymanpour and Asadollah Shahbahrami and Jun Shen and Georgi Gaydadjiev and Reza Hassanpour",

note = "Green Open Access added to TU Delft Institutional Repository {\textquoteleft}You share, we take care!{\textquoteright} – Taverne project https://www.openaccess.nl/en/you-share-we-take-care Otherwise as indicated in the copyright section: the publisher is the copyright holder of this work and the author uses the Dutch legislation to make this work public. ",

year = "2023",

doi = "10.1109/TII.2023.3314208",

language = "English",

volume = "20",

pages = "3880--3890",

journal = "IEEE Transactions on Industrial Informatics",

issn = "1551-3203",

publisher = "IEEE",

number = "3",

}

TY - JOUR

T1 - A Cost-Sensitive Machine Learning Model With Multitask Learning for Intrusion Detection in IoT

AU - Telikani, Akbar

AU - Rudbardeh, Nima Esmi

AU - Soleymanpour, Shiva

AU - Shahbahrami, Asadollah

AU - Shen, Jun

AU - Gaydadjiev, Georgi

AU - Hassanpour, Reza

N1 - Green Open Access added to TU Delft Institutional Repository ‘You share, we take care!’ – Taverne project https://www.openaccess.nl/en/you-share-we-take-care Otherwise as indicated in the copyright section: the publisher is the copyright holder of this work and the author uses the Dutch legislation to make this work public.

PY - 2023

Y1 - 2023

N2 - A problem with machine learning (ML) techniques for detecting intrusions in the Internet of Things (IoT) is that they are ineffective in the detection of low-frequency intrusions. In addition, as ML models are trained using specific attack categories, they cannot recognize unknown attacks. This article integrates strategies of cost-sensitive learning and multitask learning into a hybrid ML model to address these two challenges. The hybrid model consists of an autoencoder for feature extraction and a support vector machine (SVM) for detecting intrusions. In the cost-sensitive learning phase for the class imbalance problem, the hinge loss layer is enhanced to make a classifier strong against low-distributed intrusions. Moreover, to detect unknown attacks, we formulate the SVM as a multitask problem. Experiments on the UNSW-NB15 and BoT-IoT datasets demonstrate the superiority of our model in terms of recall, precision, and F1-score averagely 92.2%, 96.2%, and 94.3%, respectively, over other approaches.

AB - A problem with machine learning (ML) techniques for detecting intrusions in the Internet of Things (IoT) is that they are ineffective in the detection of low-frequency intrusions. In addition, as ML models are trained using specific attack categories, they cannot recognize unknown attacks. This article integrates strategies of cost-sensitive learning and multitask learning into a hybrid ML model to address these two challenges. The hybrid model consists of an autoencoder for feature extraction and a support vector machine (SVM) for detecting intrusions. In the cost-sensitive learning phase for the class imbalance problem, the hinge loss layer is enhanced to make a classifier strong against low-distributed intrusions. Moreover, to detect unknown attacks, we formulate the SVM as a multitask problem. Experiments on the UNSW-NB15 and BoT-IoT datasets demonstrate the superiority of our model in terms of recall, precision, and F1-score averagely 92.2%, 96.2%, and 94.3%, respectively, over other approaches.

KW - Costs

KW - Deep learning (DL)

KW - Internet of Things

KW - Internet of things (IoT)

KW - intrusion detection

KW - Intrusion detection

KW - Mathematical models

KW - multitask learning

KW - support vector machine (SVM)

KW - Support vector machines

KW - Task analysis

KW - Training

UR - http://www.scopus.com/inward/record.url?scp=85174825183&partnerID=8YFLogxK

U2 - 10.1109/TII.2023.3314208

DO - 10.1109/TII.2023.3314208

M3 - Article

AN - SCOPUS:85174825183

SN - 1551-3203

VL - 20

SP - 3880

EP - 3890

JO - IEEE Transactions on Industrial Informatics

JF - IEEE Transactions on Industrial Informatics

IS - 3

ER -

A Cost-Sensitive Machine Learning Model With Multitask Learning for Intrusion Detection in IoT

Abstract

Bibliographical note

Keywords

Access to Document

Other files and links

Fingerprint

Cite this