Intrusion Detection in Industrial IoT Networks using NetFlow and Machine Learning Techniques on the NF-ToN-IoT-v2 Dataset

Abstract

The massive expansion of industrial IoT networks introduces new and significant security challenges. the class of bad hack attacks that requires real-time detection and only traditional intrusion detection systems cannot perform this task due to their inadequacy in handling very large amounts of data, primarily for complete and useful analysis. In addition, there is a very serious class-imbalance problem: there are so many normal traffic outnumbering anomaly traffic (even if enough attack samples exist, it is hard to train). In this paper, we propose an improved NetFlow based intrusion detection framework where class imbalance is one individual heterogeneous in the NetFlow data of common traffic is normal. Suppose that a machine learning evaluation would result in low, moderate or high ambiguity results between negative and positive samples. If we could develop better preprocessing tools followed by more extensive machine learning evaluation something like this may be possible. We show that this framework generalizes all BDPs for (at least) the readers who are not interested in more technical details. This approach uses a state of the art NetFlow-based data set (NF-ToN-IoT-v2) for training instances that are deliberately designed to encompass a broad range of IIoT attack types. The main steps of the proposed work are: (1) Hard Preprocessing Log1p transformation for normalization and StandardScaler feature scaling; (2) SMOTE over-Sampling due to high-class imbalance only ~1% original dataset samples are attacks; (3) Random Forest, K-Nearest Neighbors (KNN), Multi-Layer Perceptron evaluation. All pretreatment steps were then applied after splitting the data types. This was to avoid data leakage and therefore obtain a better estimate of performance. All models performed better with SMOTE preprocessing. It can be noted from the tests that compared to the imbalanced baseline used as a test case attack led to an AUC-ROC relative increase of ~13–28% and an attack recall by approximately 300%. Random Forest performed best for all classifiers. AUC-ROC (0.950) and Matthews Correlation Coefficient (MCC) (0.778) offer a balance between detection speed and accuracy. Additionally, MLP (AUC-ROC = 0.949 and MCC = 784) was competitive for being both speedy and powerful, while KNN still has its nature of not being very speedy, as while 99.7% of the summation traffic was in good taste but only 76.5% was for the attacks. Among the features chosen for relevance to our models, we observed that those which had a long-time relationship (dur) and included various types (proto) of protocols that were used by packets and their mean size did provide over 83%