See discussions, stats, and author profiles for this publication at: https://www.researchgate.

net/publication/381827116

Using Machine Learning Algorithms in Intrusion Detection Systems: A Review

Article in Tikrit Journal of Pure Science · June 2024

DOI: 10.25130/tjps.v29i3.1553

CITATIONS READS

0 428

2 authors, including:

Hasanien Ali Talib

University of Mosul
9 PUBLICATIONS 15 CITATIONS

SEE PROFILE

All content following this page was uploaded by Hasanien Ali Talib on 11 October 2024.

The user has requested enhancement of the downloaded file.

Tikrit Journal of Pure Science Vol. 29 (3) 2024

https://doi.org/10.25130/tjps.v29i3.1553

Tikrit Journal of Pure Science

ISSN: 1813 – 1662 (Print) --- E-ISSN: 2415 – 1726 (Online)

Journal Homepage: http://tjps.tu.edu.iq/index.php/j

Using Machine Learning Algorithms in Intrusion Detection Systems:

A Review
Mazin S. Mohammed 1 , Hasanien Ali Talib 2
1
Department of Graduate Studies, University of Mosul, Mosul, Iraq
2
Mechatronics Engineering Department, College of Engineering, University of Mosul, Mosul, Iraq

A r t i c l e i n f o. ABSTRACT
Article history:
-Received: 21 / 9 / 2023 I ntrusion Detection Systems (IDS) are essential for
-Received in revised form: 13 / 12 / 20 23 identifying and mitigating security threats in Internet of
-Accepted: 18 / 12 / 20 23 Things (IoT) networks. This paper explores the unique
-Final Proofreading: 22 / 3 / 2024 challenges of IoT environments and presents machine
-Available online: 25 / 6 / 2024 learning (ML) algorithms as powerful solutions for IoT-IDS,
Keywords: Supervised learning, IoT intrusion encompassing supervised, unsupervised, and semi-supervised
detection systems, Machine learning learning. Notable algorithms, including decision trees,
algorithms, Feature selection, Future research random forests, support vector machines, and deep learning
directions. architectures, are discussed. Emphasis is placed on the critical
role of feature selection in developing efficient IDS,
Corresponding Author:
addressing challenges such as heterogeneity, limited
Name: Mazin S. Mohammed resources, real-time detection, privacy concerns, and
E-mail: [email protected] adversarial attacks. Future research directions include
Tel: advanced ML algorithms for IoT data, integration of anomaly
detection, exploration of federated learning, and combining
©2024 THIS IS AN OPEN ACCESS ARTICLE
ML with other cybersecurity techniques. The paper advocates
UNDER THE CC BY LICENSE
http://creativecommons.org/licenses/by/4.0/
for benchmark datasets and evaluation frameworks to
standardize the assessment of ML-based IoT-IDS approaches,
ultimately contributing to heightened security and integrity in
IoT systems..

‫ مراجعة‬:‫استخدام خهارزميات التعلم اآللي في أنظمة كشف التسلل‬

‫ حسنين علي طالب‬، 2‫مازن سالم دمحم‬
‫ العخاق‬، ‫ السهصل‬، ‫ جامعة السهصل‬، ‫ قدم الجراسات العميا‬1
‫ العخاق‬،‫ السهصل‬،‫ جامعة السهصل‬،‫ كمية اليشجسة‬،‫قدم السيكاتخونكذ‬ 2

‫الملخص‬
‫ تدتكذف ىحه الهرقة التحجيات‬.)IoT( ‫) ضخورية لتحجيج وتخفيف التيجيجات األمشية في شبكات إنتخنت األشياء‬IDS( ‫تعتبخ أنظسة كذف التدمل‬
‫ والتي تذسل التعمم الخاضع لإلشخاف وغيخ الخاضع‬،IoT-IDS ‫) كحمهل قهية لـ‬ML( ‫الفخيجة لبيئات إنتخنت األشياء وتقجم خهارزميات التعمم اآللي‬
‫ بسا في ذلك أشجار القخار والغابات العذهائية وآالت ناقل الجعم وهياكل التعمم‬،‫ تست مشاقذة الخهارزميات البارزة‬.‫لإلشخاف وشبو الخاضع لإلشخاف‬
‫ والكذف‬،‫ والسهارد السحجودة‬،‫ ومعالجة التحجيات مثل عجم التجانذ‬،‫ فعال‬IDS ‫ يتم التخكيد عمى الجور الحاسم الختيار السيدات في تطهيخ‬.‫العسيق‬
‫ تتزسن اتجاىات البحث السدتقبمية خهارزميات التعمم اآللي الستقجمة لبيانات إنتخنت‬.‫ واليجسات العجائية‬،‫ ومخاوف الخرهصية‬،‫في الهقت الحقيقي‬
‫ في الشياية تجعه‬.‫ والجسع بين التعمم اآللي وتقشيات األمن الديبخاني األخخى‬،‫ واستكذاف التعمم السهحج‬،‫ وتكامل الكذف عن الحاالت الذاذة‬،‫األشياء‬

63
Tikrit Journal of Pure Science Vol. 29 (3) 2024

https://doi.org/10.25130/tjps.v29i3.1553
‫ مسا يداىم في نياية السطاف‬،‫ القائسة عمى التعمم اآللي‬IoT-IDS ‫ىحه الهرقة إلى إنذاء مجسهعات بيانات مخجعية وأطخ تقييم لتهحيج تقييم مشاىج‬
.‫في زيادة األمن والشداىة في أنظسة إنتخنت األشياء‬
1. Introduction
1.1 Background highlights the critical problem statements associated
The Internet of Things (IoT) has revolutionized how with the application of ML in IoT-IDS between 2018
physical devices communicate and interact, forming and 2023.
interconnected systems that enable seamless 1. Limited labeled datasets: Developing accurate and
information exchange [1, 2]. With the increasing robust ML models for IoT-IDS requires large-scale,
prevalence of IoT devices in various domains such as labeled datasets that capture the diversity of IoT
healthcare, transportation, manufacturing, and network traffic and attack scenarios.
intelligent cities, robust security measures are 2. F.S. for IoT-IDS: IoT networks generate vast
paramount. These devices, from medical and amounts of data from various sources, including
healthcare devices to driverless vehicles, industrial sensors, actuators, and communication protocols.
robots, smart T.V.s, wearables, and smart city Selecting relevant features from this high-
infrastructures, often handle sensitive information, dimensional data is crucial to improve the efficiency
including personal data [2-4]. As IoT devices and effectiveness of ML models in IoT-IDS.
proliferate, the attack surface area expands, 3. Adaptability to dynamic IoT environments: IoT
increasing the likelihood of cyber-attacks. networks are highly dynamic, with devices joining
Safeguarding the communication and data exchange and leaving the network, changing their behaviors,
facilitated by IoT technologies necessitates the and encountering new attack patterns. ML algorithms
development of effective IoT intrusion de007Atection used in IoT-IDS must be able to adapt to these
systems (IDS) [5, 6]. Ensuring the security of IoT dynamic environments and continuously update their
applications has become a critical aspect of their models to detect emerging threats. Ensuring real-time
implementation. In recent years, advancements in adaptability and scalability while maintaining high
Artificial Intelligence (A.I.), particularly machine detection accuracy is a complex problem.
learning and deep learning techniques, have been 4. Scalability and computational constraints: IoT
leveraged to enhance IoT IDS. Various studies have environments consist of many interconnected devices
explored applying these techniques using diverse with limited computational capabilities. Deploying
datasets to validate the development of IoT IDS [7-9]. resource-intensive ML algorithms on resource-
However, there remains a lack of clarity regarding constrained IoT devices may result in performance
which datasets and A.I. techniques are most effective degradation and energy inefficiency. Developing
for building efficient IoT IDS. lightweight and energy-efficient ML models that can
Additionally, evaluating some IDS techniques often operate within the constraints of IoT devices is a
overlooks the time consumed in the building and critical challenge.
testing phases, despite its critical role in the 5. Interpretability and explainability: ML models used
effectiveness of "online" IDSs. This research paper in IoT-IDS often exhibit complex decision-making
aims to provide an up-to-date taxonomy and critical processes, making it challenging to interpret and
review of recent work in IoT IDS. It offers a explain the reasoning behind their predictions.
comprehensive overview of existing IoT IDSs, 1.3 Objectives
classifying them based on the proposed taxonomy. By This study survey's main goal is to present a thorough
examining the key aspects of IoT IDS, this paper review of the studies on the use of machine learning
facilitates a quick understanding of the field for in IoT-IDS (IDS) that were carried out between 2018
researchers. Furthermore, it critically reviews and 2023. The following are the specific goals of this
machine learning and deep learning techniques survey:
employed in building IoT IDS, exploring detection 1. To identify and examine the cutting-edge machine
methods, validation strategies, deployment learning methods used in IoT-IDS: The purpose of
approaches, and evaluation techniques. The paper this survey is to examine the various machine
delves into the complexity of different detection learning techniques and algorithms applied to IoT-
techniques, intrusion deployment strategies, and their IDS throughout the given time period. It will examine
evaluation, providing valuable insights and the benefits, drawbacks, and suitability of various
suggesting the best techniques based on the nature of methods in relation to Internet of Things networks.
the IoT IDS. Additionally, the challenges faced by 2. To investigate into F.S. approaches for IoT-IDS:
current IoT IDSs are discussed, shedding light on F.S. is important since it helps make ML models in
areas that require further attention and improvement. IoT-IDS more effective and efficient. This review
1.2 Problem Statement examines the F.S. techniques used in the literature
Integrating ML techniques into IoT-IDS (IDS) within the given time period and assesses how well
presents a promising approach to enhancing the they choose pertinent characteristics for IoT-IDS.
security and resilience of IoT networks. This section

64
Tikrit Journal of Pure Science Vol. 29 (3) 2024

https://doi.org/10.25130/tjps.v29i3.1553
3. To examine the assessment techniques applied to further exploration and propose innovative ideas to
ML-based IoT-IDS: In order to assess the address the challenges of applying ML in IoT-IDS.
effectiveness of ML models in IoT-IDS, the right 2. Intrusion Detection System in Internet of
metrics, datasets, and assessment techniques are Things
needed. This review attempts to examine the In the Internet of Things (IoT) context, IDS aims to
assessment techniques used in the literature detect and mitigate security threats and attacks within
throughout the designated period of time and IoT networks. Traditional IDS, designed for
determine whether or not they are appropriate for traditional computer networks, are not directly
evaluating the effectiveness of ML-based IoT-IDS. applicable to IoT environments' unique characteristics
4. To give a thorough rundown of the advantages and and challenges [10]. IoT-IDS require specialized
disadvantages of the current methods: This review approaches to handle the large-scale deployment,
attempts to determine the benefits and drawbacks of heterogeneity, resource constraints, and dynamic
the ML-based techniques applied in IoT-IDS by nature of IoT networks [11]. IoT-IDS typically
looking at the relevant research works in the field. It involve monitoring and analyzing network traffic,
will emphasize the main accomplishments, creative device behavior, and communication patterns to
concepts, and difficulties of each technique. identify potential security breaches [12]. They rely on
5. To identify potential future research directions: various techniques, including rule-based systems,
Based on the analysis of existing approaches, this anomaly detection, and ML, to detect and respond to
survey aims to identify the critical research gaps and security incidents [13]. See Fig 1.
suggest potential future directions for advancing ML
in IoT-IDS. It will outline the research areas requiring

IoT Environment

Signature- based IDS Anomaly- based IDS

Host-based IDS (HIDS) Network-based IDS Behavior-based IDS

(NIDS)

Sensors or Agents Distributed IDS Sensors or Agents

Fig 1: Classification of intrusion detection systems in the Internet of Things (IoT-IDS)

ML algorithms used in IoT-IDS can be categorized communication technologies, and network
into supervised, unsupervised, and semi-supervised architectures [16-18].
learning. Supervised learning algorithms leverage 2. Limited computational resources: IoT devices often
labeled data to learn normal and malicious behavior have limited computational power, memory, and
patterns, while unsupervised learning algorithms energy resources. Designing lightweight ML
identify anomalies based on data distribution. Semi- algorithms that can operate efficiently on resource-
supervised learning algorithms combine labeled and constrained IoT devices is crucial. These algorithms
unlabeled data to enhance detection capabilities [14]. should balance detection accuracy and computational
Deep learning techniques, such as deep neural overhead to ensure practical implementation in IoT
networks and recurrent neural networks, have also environments [17, 19].
shown promise in detecting complex and 3. Real-time detection and response: IoT networks
sophisticated attacks in IoT networks. Implementing operate in real time, and timely detection and
effective IDS in IoT networks has several challenges response to security incidents are critical. ML-based
[2, 15]. The following challenges are particularly IDS should be capable of processing and analyzing
relevant in the context of applying ML techniques in data in real-time to detect and respond to attacks on
IoT-IDS: time. Real-time detection requires efficient
1. Heterogeneity and scalability: IoT networks algorithms and optimized computational processes to
comprise various devices, communication protocols, handle IoT data streams' high volume and velocity
and data formats. Developing ML models that can [20].
handle the heterogeneity of IoT data and scale to 4. Privacy and data protection: IoT devices collect
large-scale IoT deployments is a challenge. The and transmit sensitive data, making privacy and data
models should be adaptable to various devices, protection essential considerations in IoT-IDS. ML
algorithms should be designed to respect privacy

65
Tikrit Journal of Pure Science Vol. 29 (3) 2024

https://doi.org/10.25130/tjps.v29i3.1553
requirements and ensure secure data handling. in the presence of adversarial threats is an ongoing
Additionally, models should be robust against attacks challenge [23].
targeting privacy-sensitive information[21, 22]. 3. ML Techniques for IoT-IDS
5. Adversarial attacks and model robustness: IoT To guarantee the security and integrity of IoT
networks are vulnerable to adversarial attacks, where systems, intrusion detection in networks is essential.
malicious actors intentionally manipulate or evade In Internet of Things (IoT) contexts, machine learning
detection mechanisms. ML models used in IoT-IDS (ML) approaches have become effective instruments
should be robust against adversarial attacks and for identifying and reducing intrusions [24, 25]. See
resilient to adversarial perturbations. Developing Fig. 2.
techniques to enhance the robustness of ML models

ML Techniques for IoT-IDS

Classification Anomaly Detection Deep Learning Ensemble Learning

RF
DT OCSVM CNNs
XGBoost
SVM k-Means LSTMs
AdaBoost
k-NN Autoencod GRUs
ers GBDT

Fig 2. Taxonomy of ML Techniques for IoT-IDS

The several ML approaches that have been used to (OCSVM), k-means clustering, and autoencoders.
IoT intrusion detection are covered in this section. OCSVM is a variant of SVM that learns a boundary
3.1 Classification Algorithms around the normal instances in the feature space [25,
Intrusion detection systems (IDS) frequently use 33]. It can then detect deviations from this boundary
classification algorithms to categorize network traffic as anomalies. K-means clustering partitions the data
into distinct classifications, such as malicious or into k clusters, where instances that do not belong to
benign. These algorithms categorize unseen instances any cluster are considered anomalies. Autoencoders
by using patterns they have learned from labeled are deep learning models that aim to reconstruct the
training data. Many classification algorithms have input data from a compressed representation.
been applied in the context of IoT-IDS, such as Instances that have a high reconstruction error are
decision trees (DT) [25, 26, 27, 28, 29, 30], random identified as anomalies.
forests (RF) [25, 7, 26, 27, 31, 8, 24], support vector 3.3 Deep Learning Techniques
machines (SVM) [25, 27, 31, 29, 24, 32], k-nearest Deep learning techniques, specifically neural
neighbors (KNN) [27, 33, 30,32], and XGBoost networks, have gained significant attention in IoT-
[26,28, 24]. Decision trees are straightforward yet IDS due to their ability to learn complex patterns
powerful algorithms that generate a feature-based from high-dimensional data. Convolutional neural
decision tree model. Multiple decision trees are networks (CNNs), long short-term memory (LSTM)
combined to create random forests, which are well- networks, and gated recurrent units (GRUs) are
known for their strong classification performance and commonly used deep learning architectures for IoT-
capacity to handle high-dimensional data. The SVM IDS [34,35, 36]. CNNs are effective in capturing
algorithm is a binary classification technique that spatial dependencies in data, making them suitable
determines the best hyperplane to divide several for analyzing IoT network traffic. LSTM and GRU
groups. KNN classifies instances based on their networks are recurrent neural networks (RNNs) that
proximity to labeled instances in the feature space. excel at capturing temporal dependencies [3, 25, 27].
XGBoost is an ensemble learning algorithm that They can effectively model sequential data, making
combines weak classifiers to form a strong classifier. them well-suited for analyzing time-series data in
3.2 Anomaly Detection Algorithms IoT-IDS.
Anomaly detection algorithms are particularly useful 3.4 Ensemble Learning Approaches
for identifying unknown and novel attacks in IoT- Ensemble learning combines multiple models to
IDS. These algorithms learn the normal behavior of improve the overall performance and robustness of
the system and flag instances that deviate the intrusion detection system. Bagging and boosting
significantly from the learned patterns as anomalies. are two popular ensemble learning approaches used
Popular anomaly detection algorithms used in IoT- in IoT-IDS [24]. Bagging, short for bootstrap
IDS include one-class support vector machines aggregating, involves training multiple models on

66
Tikrit Journal of Pure Science Vol. 29 (3) 2024

https://doi.org/10.25130/tjps.v29i3.1553
different subsets of the training data and combining feature selection approaches. Several feature selection
their predictions through voting or averaging. This techniques are used in hybrid feature selection to take
helps reduce the impact of individual model biases advantage of each one's unique advantages. It can
and improves the overall accuracy. Random forests help improve detection performance and offer a more
and XGBoost are examples of bagging-based thorough examination of feature relevance [7].
ensemble methods. Boosting, on the other hand, 3. Network Profiling
focuses on iteratively training weak models and Employed a feature selection method based on the
giving more weight to misclassified instances [26, correlation coefficient. The linear link between traits
28]. This allows the ensemble to emphasize the is measured by the correlation coefficient, which
difficult instances and improve the overall shows how dependent they are on one another. The
classification performance. AdaBoost and gradient algorithm can concentrate on the most pertinent data
boosting are well-known boosting algorithms used in for precise identification by choosing characteristics
IoT-IDS.4. Feature Selection in IoT-IDS that have a strong correlation to the goal variable
4. Feature Selection in IoT-IDS (intrusion or normal behavior) [31,24].
4.1 Importance of Feature Selection 4. Correlation Coefficient
Feature selection is a critical step in developing an employed a feature selection method based on the
effective Intrusion Detection System (IDS) for correlation coefficient. The linear link between traits
Internet of Things (IoT) networks. With the rapid is measured by the correlation coefficient, which
growth of IoT and the increasing number of shows how dependent they are on one another. The
connected devices, the amount of data generated has algorithm can concentrate on the most pertinent data
also increased significantly [37]. However, not all for precise identification by choosing characteristics
features or attributes of the data contribute equally to that have a strong correlation to the goal variable
the detection of intrusions or anomalies. In fact, (intrusion or normal behavior) [31,24].
including irrelevant or redundant features can 5. Supervised Learning Algorithms in IoT-
introduce noise and negatively impact the IDS
performance of the IDS. By determining the most 5.1 Survey of Research Works
pertinent and instructive features for intrusion The domain of IoT Intrusion Detection Systems (IoT-
detection, feature selection is essential to enhancing IDS) has witnessed a notable surge in interest in
the efficacy and efficiency of IoT-IDS [7]. The supervised learning methods. These algorithms use
intrusion detection system (IDS) can concentrate on labeled data to train models that are capable of
critical information and minimize the computational precisely identifying and classifying intrusions in
complexity involved in handling vast volumes of data Internet of Things networks. We provide a review of
by choosing a subset of characteristics with strong studies that have investigated the use of supervised
discriminating power. As a result, the IDS performs learning techniques in IoT-IDS in this section.
better overall and detects threats more quickly and The application of deep learning algorithms for
with fewer false positives [38]. Additionally, feature intrusion detection in Internet of Things networks was
selection aids in resolving IoT devices' resource the subject of one research by Banaamah and Ahmad
limitations. These gadgets frequently feature [35]. Using a typical dataset for intrusion detection in
constrained memory, processor, and energy the Internet of Things, they evaluated the
capacities. The computational load on IoT devices effectiveness of many deep learning models,
may be minimized by choosing a smaller number of including convolutional neural networks (CNNs),
characteristics, allowing them to effectively carry out long short-term memory (LSTM), and gated recurrent
intrusion detection duties within their limited units (GRUs). When compared to current methods,
resources. their suggested method showed better accuracy.
4.2 FS Techniques in IoT-IDS A comparative research of machine learning methods
Supervised learning methods that may be applied to for IoT network intrusion detection was carried out
feature selection (FS) in Internet of Things intrusion by Marwa Baich et al. [31]. They examined how
detection systems (IoT-IDS) based on the data different machine learning techniques, such as
presented in Table 1: decision trees, performed when applied to a dataset
1. Manual Feature Selection: that had both binary and multi-class categorization.
Used methods for manual feature selection in their According to the study, the Fisher score Decision
studies. Manual feature selection is the process of Tree algorithm performed the best, achieving high
choosing pertinent features using subject skills and accuracy and short forecast times.
knowledge. With this method, researchers may Another work by Bouazza et al. [29] used an
concentrate on particular characteristics that are most intrusion detection system based on machine learning
likely to aid in the intrusion detection process [25,35]. to identify routing assaults in the Internet of Things.
2. Hybrid Feature Selection: Using machine learning techniques and a dataset of
used Information Measure of Feature (IMF) and IoT assaults produced via simulations, they created an
Uncertainty Measure of Feature (UMF) hybrid

67
Tikrit Journal of Pure Science Vol. 29 (3) 2024

https://doi.org/10.25130/tjps.v29i3.1553
anomaly-based intrusion detection system. They effectiveness and performance by lowering the
suggested a technique that detected routing-based dataset's dimensionality.
attacks with more accuracy and precision by adding A well-known paper by Rose et al. [39] suggests an
additional sensitive characteristics and balancing the anomaly-based approach to intrusion detection that
dataset. integrates machine learning and network monitoring
Arhore [24] concentrated on machine learning-based methods. All networked IoT devices are dynamically
intrusion detection in Internet of Things platforms. profiled and monitored by the system, which looks
The study examined a number of machine learning for abnormal network transactions and tampering
approaches and assessed how well they performed attempts. Any departure from the specified device
using measures including F1 score, recall, precision, profile is viewed as an assault and is examined more
and classification accuracy. The goal of the study was closely. The authors analyze raw traffic and find
to provide an appropriate algorithm that can identify possible assaults using a machine learning classifier.
network intrusions effectively and efficiently, with Cyber-Trust testbed experimental findings show
99% accuracy and high efficiency. encouraging results, with a low false-positive rate of
A machine learning-based distributed intrusion 0.98% and an overall accuracy of 98.35%.
detection solution for Internet of Things networks To identify cyber threats in IoT networks, Kothari et
was proposed by Gad et al. [28]. To train and evaluate al. [34] present intelligent intrusion detection systems
several machine learning techniques, they used the (IDS) models based on deep learning approaches.
ToN-IoT dataset, which represents data from multiple They create deep learning algorithms that can identify
levels of the IoT system. Their suggested model malware in IoT networks and categorize stolen
proved the effectiveness of the XGBoost strategy for programs using the TensorFlow framework. To train
intrusion detection in IoT networks by using ML and assess their models, the authors make use of
algorithms in binary and multi-class classification email datasets and the Google Code Jam dataset.
tasks. Their method offers an effective way to find harmful
A number of IoT dangers were discovered, and Islam assaults in Internet of Things infrastructures.
et al. [25] talked about both shallow and deep The problem of creating a multi-class attack detection
machine learning-based intrusion detection systems and classification system for Internet of Things
in IoT environments. They used benchmark datasets networks is addressed by Othman and Abdullah [32].
to assess these models' performance and discovered They suggest an intelligent intrusion detection system
that deep machine learning performed better at that takes advantage of machine learning techniques'
identifying IoT threats than shallow machine categorization capabilities, including support vector
learning. machines, artificial neural networks, and K-Nearest
Ayub et al. [30] created an intelligent intrusion Neighbor. To train and evaluate their models, the
detection system for smart city networks using authors utilize the IoT23 dataset, which contains
machine learning in a different research. They used a millions of examples of both benign and harmful
variety of supervised machine learning methods, such activity from IoT-connected devices. The outcomes
as decision trees, XGBoost, k-nearest neighbors show how well the suggested IDS can identify and
(KNN), linear and quadratic discriminant analysis, categorize assaults.
and XGBoost, and compared the outcomes. The KNN A hybrid intrusion detection system (HID) is
algorithm offered a quick, safe, and clever intrusion suggested by Alghayadh and Debnath [26] for smart
detection system (IDS) solution. It also demonstrated home security in Internet of Things environments.
the greatest accuracy, followed by XGBoost and Their technology analyzes user activity and finds
decision trees. intrusions by combining machine learning methods
For Internet of Things systems, Siham and Kerem such as Xgboost, random forest, decision tree, K-
[33] suggested a novel detection approach based on nearest neighbors, and abuse detection tool. For smart
deep learning and machine learning techniques. To homes, the HID system offers improved security and
find abnormalities in IoT networks, they ran trials and privacy by adjusting to user behavior and
contrasted several AI models. Their research surroundings.
demonstrated how ML and DL algorithms may be The problem of creating lightweight intrusion
used to identify different kinds of assaults on Internet detection systems for Internet of Things networks is
of Things platforms. addressed by Ozer et al. [27]. They provide a method
The issue of large dimensionality in IoT intrusion that focuses on choosing the best and most effective
detection systems was tackled by Albulayhi et al. [7]. feature pairs from datasets in order to facilitate the
They used set theory and entropy-based techniques to creation of lightweight IDS. The BoT-IoT (2018)
present a unique feature extraction and selection dataset and machine learning methods are used by the
strategy. Their strategy led to the selection of a subset authors to create and contrast feature-pair-based and
of pertinent attributes that successfully gathered the full-feature-based intrusion detection systems. Their
data needed for intrusion detection. Their method results demonstrate that feature-pair-based intrusion
increased the intrusion detection system's

68
Tikrit Journal of Pure Science Vol. 29 (3) 2024

https://doi.org/10.25130/tjps.v29i3.1553
detection systems (IDS) may achieve excellent techniques in identifying assaults with high accuracy
detection accuracy. (99.51%) in high-dimensional, complicated, and
An improved dynamic SBPSO (Sticky Binary unbalanced data.
Particle Swarm Optimization) is the foundation of These methods have been used with diverse datasets,
Sarwar et al.'s [8] proposed enhanced anomaly feature selection strategies, and machine learning
detection system for the Internet of Things. To algorithms in IoT-IDS research projects. The
improve the searchability of SBPSO for feature effectiveness and precision of these methods differ
selection, they add dynamic parameters and a based on the particular application and assessment
dynamic search space reduction technique. When criteria applied in every research project. When
compared to traditional PSO-based feature selection choosing and evaluating the efficacy of these
techniques, the suggested system exhibits better strategies, it is crucial to take the unique needs and
accuracy, lower computing costs, and shorter features of the IoT system into account.
prediction times. It is tested on two IoT network 5.2 Comparison and Analysis of Existing
datasets. Approaches
By combining Principal Component Analysis (PCA) Numerous studies have been carried out in the area of
and Mayfly Optimization (MAO) for dimensionality intrusion detection systems (IDS) for Internet of
reduction, Borderline Synthetic Minority Things networks, as listed in Table 1. With the use of
Oversampling Technique (BSMOTE) for data various datasets, feature selection strategies, machine
balancing, and Long Short-Term Memory (LSTM) learning methods, and reporting accuracy metrics,
for classification, Karamollaoğlu et al.[3] present a each research focuses on a distinct component of
novel IDS for IoT environments. The suggested IDS.
model outperforms conventional machine learning
Table 1: Summary of Research Works
Paper year Dataset Feature Selection ML Algorithm Acc
N. Islam et al. 2021 NSL-KDD, IoTDevNet, manual Bi-LSTM, DT, RF, and Bi-LSTM =
[25] DS2OS, IoTID20, and SVM 99.04%
IoT Botnet
K. Albulayhi et al. 2021 IoTID20 and NSL-KDD hybrid feature selection RF, MLP, J48, and IBk RF = 99.98%
[7] (IMF, UMF)
J. R. Rose et al. 2021 Cyber-Trust Network profiling MobileNetV3 98.35%
[39]
T. Kothari et al. 2021 custom dataset Colour graphics DCNN CNN+LSTM
[34] construction from raw (97.16)
binary data
Alghayadh and 2021 CSE-CIC-IDS2018 NSL- full features RF, Xgboost, DT, K-NN, Xgboost =
Debnath [26] KDD and misuse detection 98.6%
technique
E. Özer et al. [27] 2021 BoT-IoT (2018) feature-pair-based KNN RBF SVM Gaussian RF = 99.9
Process DT RF ANN
AdaBoost NB
A. M. Banaamah 2022 Bot-IoT manual CNN, GRN and LSTM GRN = 0.998
et al. [35]
M. Baich et al. 2022 NSL-KDD Pearson correlation DT, SVM, NB, and RF DT = 99.26%
[31] Fisher Score
A. Bouazza et al. 2022 custom dataset full features DT, SVM, NB, and RF RF = 0.999
[29]
A. R. Gad et al. 2022 ToN-IoT Chi2 RF, XGboost and DT XGboost =
[28] 0.999
Siham and Kerem 2022 UNSW-NB15 random forest NB, kNN, LR, DT, RF = 87.09%
[33]
Karamollaoğlu et 2022 IoTID20 PCA-MAO LSTM 99.51%
al [3]
Sarwar et al. [8] 2022 IoTID20 and UNSW- IDSBPSO RF 99%
NB15
S. A. Arhore [24] 2023 IoT correlation coefficient RF, XGboost and SVM RF = 99.42%
NID
M. Y. Ayub et al. 2023 UNSW-NB15 full features XG Boost, KNN and DT KNN
[30]
Othman and 2023 IoT23 correlations coefficient KNN, SVM, and ANN KNN = 0.99
Abdullah [32]
B. Mansi et al. 2023 IoTID20 correlation PCC-CNN 99%
[36]

69
Tikrit Journal of Pure Science Vol. 29 (3) 2024

https://doi.org/10.25130/tjps.v29i3.1553
An overview of several research studies on intrusion or with certain attack kinds, such as DoS, Probe,
detection systems (IDS) for Internet of Things R2L, and U2R, make up NSL-KDD. It is frequently
networks is given in Table 1. The paper's details, used to assess how well ML algorithms function in
publication year, dataset, feature selection methods, IoT-IDS [42].
machine learning (ML) algorithms, and accuracy 4. UNSW-NB15 Dataset (2015):
claims are all included in the table. NSL-KDD, A large-scale dataset created especially for network
IoTDevNet, DS2OS, IoTID20, IoT Botnet, Cyber- intrusion detection research is the UNSW-NB15
Trust, CSE-CIC-IDS2018, BoT-IoT, UNSW-NB15, dataset. It includes data from attack and regular traffic
and bespoke datasets are only a few of the datasets that was produced in an actual Internet of things
covered by the mentioned articles. Each article uses a scenario. Numerous attack types are covered by the
different feature selection strategy, such as chi- dataset, such as Reconnaissance, Shellcode, Analysis,
square, correlation coefficient, manual selection, Backdoor, DoS, Exploits, Fuzzers, Generic, Normal,
network profiling, hybrid feature selection (IMF, and Worms. It is often used to assess the performance
UMF), Pearson correlation, Fisher score, feature-pair- of ML algorithms in IoT-IDS [43].
based selection, and manual selection. Bi-LSTM, 5. AWID Dataset (2016):
decision tree (DT), random forest (RF), support The goal of the AWID dataset is to identify intrusions
vector machine (SVM), multilayer perceptron (MLP), into wireless networks. It covers a range of attack
J48, IBk, MobileNetV3, deep convolutional neural scenarios, including denial-of-service (DoS), man-in-
network (DCNN), XGBoost, K-nearest neighbors the-middle, and key cracking. The dataset is used to
(KNN), Gaussian Process, artificial neural network assess how well IDS performs in wireless IoT
(ANN), AdaBoost, and Naive Bayes (NB) are just a networks by capturing the unique issues associated
few of the models that are used in the ML algorithms. with these networks [44].
The suggested methods' efficacy is shown by the 6. CIC_IDS2017 Dataset (2017):
stated accuracy numbers, several of which achieve A comprehensive collection of network traffic data
high accuracy rates. The accuracy statistics show that produced by several attack methods, such as Brute
ML algorithms have been successfully applied for Force, HeartBleed, Botnet, DoS, DDoS, Web, and
IoT intrusion detection, ranging from 87.09% to Infiltration, is included in the CIC_IDS2017 dataset.
99.98%. The dataset's purpose is to assess how well machine
3.5 Datasets for IoT-IDS learning algorithms identify and categorize Internet of
In order to create and assess intrusion detection Things network threats [45].
systems (IDS) for Internet of Things networks, 7. CSECIC_IDS2018 Dataset (2018):
scientists use a variety of datasets that are intended to Similar to the CIC_IDS2017 dataset, the
reflect the features and difficulties of IoT settings. We CSECIC_IDS2018 dataset also includes attack types
go over a number of frequently used datasets for IoT- such Web, HeartBleed, and Infiltration. Its goal is to
IDS in this part, along with the attributes associated offer a wide range of attack scenarios so that IDS
with each. performance in IoT networks may be assessed [46].
1. KDDCup-99 Dataset (1998): 8. LITNET_2020 Dataset (2020):
A well-known dataset that is frequently used in the The LITNET_2020 dataset comprises a wide range of
field of network intrusion detection is KDDCup-99. It attack types, such as Smurf, ICMP Flood, UDP
offers a thorough collection of network traffic data Flood, SYN flood, HTTP Flood, LAND,
and is frequently used as a standard for assessing IDS W32.Blaster, Code Red, SPAM, Reaper Worm, Scan,
performance, despite not being designed with IoT- and Packet Fragmentation, and is primarily focused
IDS in mind. Many attack methods, such as Denial of on network intrusion detection in Internet of Things
Service (DoS), Probe, Remote to Local (R2L), and settings. In order to assess ML-based IDS, it offers a
User to Root (U2R), are included in the dataset [40]. realistic IoT network traffic scenario [47].
2. Kyoto_2006 Dataset (2006): 9. BOUN_DDoS Dataset (2020):
The Kyoto_2006 dataset, which is based on actual Specifically, distributed denial-of-service (DDoS)
network traffic data gathered at Kyoto University, is assaults on Internet of Things networks are the focus
primarily concerned with IoT network intrusion of the BOUN_DDoS dataset. It contains both regular
detection. It is appropriate for assessing the and DDoS attack traffic, enabling the assessment of
effectiveness of anomaly detection techniques in IoT- machine learning methods for identifying and
IDS as it encompasses both known and unknown averting DDoS assaults in Internet of Things settings
threat types [41]. [48].
3. NSL-KDD Dataset (2009): 10. IoTID20 Dataset (2020):
An improved version of the KDDCup-99 dataset is The purpose of the IoTID20 dataset is to assess
called NSL-KDD. It improves upon the previous intrusion detection in Internet of Things networks. It
dataset's shortcomings and duplications to more covers a variety of attack types, including ARP
accurately depict contemporary network activity. spoofing, HTTP flooding, UDP flooding, Brute
Numerous network connections classified as regular Force, and Syn flooding. The dataset offers a

70
Tikrit Journal of Pure Science Vol. 29 (3) 2024

https://doi.org/10.25130/tjps.v29i3.1553
thorough assessment platform for ML-based IDS and systems in identifying different kinds of assaults in
attempts to capture the distinctive features of IoT Internet of Things networks. Researchers can aid in
assaults [49]. the creation of more reliable and efficient IDS
These datasets are useful tools for ML algorithm solutions for protecting IoT devices by using
testing, training, and benchmarking in IoT-IDS. They representative datasets. Researchers can view the
are used by researchers to assess the effectiveness, datasets and their attributes in Table 2.
precision, and efficiency of intrusion detection
Table 1: datasets and properties
Ref Dataset name Year No. of Attack Classes
Classes
[40] KDDCup-99 1998 4 Normal ,DoS, Probe, R2L, U2R
[41] Kyoto_2006 2006 2 Attacks, not Attacks
[42] NSL_KDD 2009 4 Normal, DoS, Probe, R2L, U2R
[43] UNSW_NB15 2015 9 Analysis, Backdoor, DoS, Exploits, Fuzz, Generic, Normal, Rec, Shell,
Worms
[44] AWID 2016 4 Keycracking, Key stream retrieving, Dos, Man in the M
[45] CIC_IDS2017 2017 7 Brute, Heart Bleed, Bot net, DoS, D DoS, Webs, Infiltration
[45] CSECIC_IDS2018 2018 7 Heart Bleed, DoS, Botnet, DDoS, Force, Infiltration, Web
[46] LITNET_2020 2020 12 Smurf, ICMP Flood, UDP Flood, SYN flood, HTTP Flood, LAND, W32,
Code Red, SPAM, Reaper Worm, Scan, Packet Frag
[47] BOUN_DDoS 2020 2 Attacks, not Attacks
[48] IoTID20 2020 9 Normal,
Syn Flooding,
Brute Force, HTTP Flooding, UDP Flooding
ARP Spoofing
Host Port, OS
Normal,Syn Flooding,Brute Force, HTTP Flooding, UDP FloodingARP
SpoofingHost Port, OS

Table 2 shows how the data utilized in IoT-IDS is 6. Challenges and Future Directions
oriented to give thorough analysis and performance 6.1 Challenges in Applying ML in IoT-IDS
testing of intrusion detection systems in Internet of Applying ML (ML) in IoT-IDS (IDS) poses several
Things networks. This data represents real-world challenges. Firstly, IoT environments' diverse and
difficulties in this environment and covers a range of dynamic nature makes it difficult to create effective
attack types directed towards IoT networks. The and generalizable ML models. Secondly, large-scale
history of this data extends from 1998 to 2020, and and heterogeneous IoT data require preprocessing
this shows the development that has occurred in the techniques and F.S. methods tailored to IoT-specific
field of intrusion detection over the years as well as characteristics. Thirdly, the limited computational
the emergence and development of IoT technologies. resources of IoT devices restrict the complexity and
This data provides a variety of attack types such as size of ML models that can be deployed. Additionally,
Denial of Service (DoS), Probe, Remote to Local real-time intrusion detection is crucial in IoT systems,
(R2L), User to Root (U2R), Analysis, Backdoor, demanding low-latency ML algorithms. Ensuring the
Exploits, Fuzzers, Generic, Reconnaissance, security and privacy of IoT data and handling high
Shellcode, Worms, Key cracking, Keystream dimensionality and noise in IoT data are further
retrieving, Man-in-the-Middle, Brute Force, challenges in ML-based IoT-IDS. Lastly, the scarcity
HeartBleed, Botnet, DDoS, Web, Infiltration, and of labeled training data for IoT-specific attacks
others. This can help researchers evaluate the hinders the development of accurate and robust ML
efficiency and accuracy of intrusion detection models.
systems in detecting a wide range of potential attack 6.2 Potential Future Research Directions
types. Some of the statements focus on simulating In applying ML in IoT-IDS, several potential future
specific IoT network challenges, such as wireless research directions can be explored. Firstly,
communications, IoT attacks, and distributed DDoS developing advanced ML algorithms that are
attacks. This helps in evaluating the performance of specifically designed to handle the unique
intrusion detection systems in this specific characteristics of IoT data, such as heterogeneity,
environment. Various intrusion detection techniques high dimensionality, and dynamicity, can enhance the
are used, including intrusion detection, anomaly performance of IDS. Secondly, integrating anomaly
detection, machine learning, and network analysis. detection techniques with ML models to detect
This enhances the diversity of tools and techniques emerging and previously unseen attacks in real time
used to develop intrusion detection systems in IoT is an important area of research. Thirdly, exploring
networks. federated learning approaches that enable

71
Tikrit Journal of Pure Science Vol. 29 (3) 2024

https://doi.org/10.25130/tjps.v29i3.1553
collaborative learning among distributed IoT devices how well machine learning (ML) algorithms work to
while preserving data privacy can address the identify intrusions and improve the security of
challenges of limited computational resources and Internet of Things (IoT) systems. To increase the
data privacy. Additionally, investigating the use of precision and effectiveness of IDS (IDS) in IoT,
explainable A.I. techniques to enhance the several machine learning (ML) approaches have been
transparency and interpretability of ML-based IDS in used, including ensemble learning and F.S. methods.
IoT can facilitate trust and adoption. Additionally, The dynamic nature of IoT data and the constrained
investigating the integration of machine learning computing capacity of IoT devices are two obstacles
(ML) with other cybersecurity methods like that still need to be addressed. Notwithstanding these
encryption and secure communications can offer all- difficulties, this field of study is still developing.
encompassing security solutions for Internet of Upcoming paths include creating sophisticated
Things environments. Last but not least, developing machine learning algorithms specific to the properties
benchmark datasets and assessment frameworks of IoT data, incorporating anomaly detection
especially for machine learning-based IoT-IDS can methods, and investigating explainable A.I. and
facilitate the standardization of assessment and federated learning strategies. ML-based intrusion
comparison of various methodologies, encouraging detection systems (IDSs) in the Internet of Things
more developments in the field. (IoT) can enhance security and ensure the secure and
7. Conclusion dependable functioning of IoT systems by tackling
In conclusion, machine learning (ML) has become a these obstacles and venturing into novel research
viable method for Internet of Things (IoT) intrusion directions.
detection. The research examined in this paper shows

References
[1]. Guo, H., Goodchild, M. F., & Annoni, A. [8]. Gyamfi, E., & Jurcut, A. (2022). Intrusion
(2020). Internet of Things :In Manual of Digital Detection in Internet of Things Systems: A Review on
Earth. Springer, Singapore, pp. 253-270. Design Approaches Leveraging Multi-Access Edge
https://doi.org/10.1007/978-981-32-9915-3_11 Computing, Machine Learning, and Datasets.
[2]. Bellini, P., Nesi, P., & Pantaleo, G. (2022). IOT- Sensors, 22 (10), 3744.
enabled Smart Cities: A review of concepts, https://doi.org/10.3390/s22103744
frameworks and Key Technologies. Applied Sciences, [9]. Arshad, J., Azad, M. A., Abdeltaif, M. M., &
12(3), 1607. https://doi.org/10.3390/app12031607 Salah, K. (2020). An Intrusion Detection Framework
[3]. Syed, A. S., Sierra-Sosa, D., Kumar, A., & For Energy Constrained IoT Devices. Mech. Syst.
Elmaghraby, A. (2021). IOT in Smart Cities: A Signal Process., 136 , 106436.
Survey of Technologies, practices and challenges. https://doi.org/10.1016/j.ymssp.2019.106436
Smart Cities, 4(2), 429–475. [10]. Mazhar, T., Talpur, D. B., Shloul, T. A., Ghadi,
https://doi.org/10.3390/smartcities4020024 Y. Y., Haq, I., Ullah, I., ... & Hamam, H. (2023).
[4]. Bhushan, B., Kumar, A., Agarwal, A. K., Analysis of IoT Security Challenges and Its Solutions
Kumar, A., Bhattacharya, P., & Kumar, A. (2023). Using Artificial Intelligence. Brain Sciences, 13(4),
Towards a secure and sustainable internet of medical 683.
things (IOMT): Requirements, design challenges,
[11]. Saheed, Y. K., Abiodun, A. I., Misra, S., Holone,
security techniques, and future trends. Sustainability,
M. K., & Colomo-Palacios, R. (2022). A machine
15(7), 6177. https://doi.org/10.3390/su15076177
learning-based intrusion detection for detecting
[5]. Tariq, U., Ahmed, I., Bashir, A. K., & Shaukat,
internet of things network attacks. Alexandria
K. (2023). A critical cybersecurity analysis and future
Engineering Journal, 61 (12), 9395-9409.
research directions for the internet of things: A
[12]. Kaur, B., Dadkhah, S., Shoeleh, F., Neto, E. C.
comprehensive review. Sensors, 23(8), 4117.
P., Xiong, P., Iqbal, S., ... & Ghorbani, A. A. (2023).
https://doi.org/10.3390/s23084117
Internet of things (IoT) security dataset evolution:
[6]. E. Altulaihan, M.A. Almaiah, and A.
Challenges and future directions. Internet of Things,
Aljughaiman. (2022). Cybersecurity Threats,
100780.
Countermeasures and Mitigation Techniques on the
[13]. Benkhelifa, E., Welsh, T., & Hamouda, W.
IoT: Future Research Directions, Electronics, vol. 11,
(2018). A Critical Review of Practices and Challenges
no. 11, p. 3330,.
in Intrusion Detection Systems for IoT: Toward
https://doi.org/10.3390/electronics11203330
Universal and Resilient Systems. IEEE
[7]. Altulaihan, E., Almaiah, M. A., & Aljughaiman,
Communications Surveys & Tutorials, 20 (4), 3496-
A. (2022). Cybersecurity Threats, Countermeasures
3509. https://doi.org/10.1109/COMST.2018.2844742
and Mitigation Techniques on the IoT: Future
[14]. Sicato, J. C. S., Singh, S. K., Rathore, S., &
Research Directions. Electronics, 11 (11), 3330.
Park, J. H. (2020). A comprehensive analyses of
https://doi.org/10.3390/electronics11203330
intrusion detection system for IoT environment.

72
Tikrit Journal of Pure Science Vol. 29 (3) 2024

https://doi.org/10.25130/tjps.v29i3.1553
Journal of Information Processing Systems, 16 (4), based on machine learning and user behavior.
975-990. Advances in Internet of Things, 11 (1), 10-25.
[15]. Diro, A., Chilamkurti, N., Nguyen, V.-D., & [27]. Özer, E., İskefiyeli, M., & Azimjonov, J. (2021).
Heyne, W. (2021). A Comprehensive Study of Toward lightweight intrusion detection systems using
Anomaly Detection Schemes in IoT Networks Using the optimal and efficient feature pairs of the Bot-IoT
Machine Learning Algorithms. Sensors, 21 , 8320. 2018 dataset. International Journal of Distributed
https://doi.org/10.3390/s21248320 Sensor Networks, 17(10), 15501477211052202.
[16]. Zehra, S., Faseeha, U., Syed, H. J., Samad, F., [28]. Gad, A. R., Haggag, M., Nashat, A. A., &
Ibrahim, A. O., Abulfaraj, A. W., & Nagmeldin, W. Barakat, T. M. (2022). A Distributed Intrusion
(2023). Machine Learning-Based Anomaly Detection Detection System using Machine Learning for IoT
in NFV: A Comprehensive Survey. Sensors, 23 , based on ToN-IoT Dataset. International Journal of
5340. https://doi.org/10.3390/s23115340 Advanced Computer Science and Applications, 13(6).
[17]. Zikria, Y. B., Afzal, M. K., Kim, S. W., Marin, [29]. Amouri, A., Alaparthy, V. T., & Morgera, S. D.
A., & Guizani, M. (2020). Deep learning for (2020). A machine learning based intrusion detection
intelligent IoT: Opportunities, challenges and system for mobile Internet of Things. Sensors, 20(2),
solutions. Computer Communications, 164 , 50-53. 461.
[18]. Gerodimos, A., Maglaras, L., Ferrag, M. A., [30]. Ayub, M. Y., Haider, U., Haider, A., Tashfeen,
Ayres, N., & Kantzavelou, I. (2023). IoT: M. T. A., Shoukat, H., & Basit, A. (2023). An
Communication protocols and security threats. Intelligent Machine Learning based Intrusion
Internet of Things and Cyber-Physical Systems, 3, 1– Detection System (IDS) for Smart cities networks.
13. EAI Endorsed Transactions on Smart Cities, 7(1), e4-
e4.
[19]. Al-Amiedy, T. A., Anbar, M., Belaton, B.,
[31]. Baich, M., Hamim, T., Sael, N., & Chemlal, Y.
Kabla, A. H. H., Hasbullah, I. H., & Alashhab, Z. R.
(2022). Machine Learning for IoT based networks
(2022). A Systematic Literature Review on Machine
intrusion detection: a comparative study. Procedia
and Deep Learning Approaches for Detecting Attacks
Computer Science, 215, 742-751.
in RPL-Based 6LoWPAN of Internet of Things.
[32]. Othman, T. S., & Abdullah, S. M. (2023). An
Sensors, 22 , 3400. https://doi.org/10.3390/s22093400
Intelligent Intrusion Detection System for Internet of
[20]. Rodríguez-Rodríguez, I., Campo-Valera, M.,
Things Attack Detection and Identification Using
Rodríguez, J.-V., & Frisa-Rubio, A. (2023).
Machine Learning. ARO-THE SCIENTIFIC
Constrained IoT-Based Machine Learning for
JOURNAL OF KOYA UNIVERSITY, 11(1), 126-
Accurate Glycemia Forecasting in Type 1 Diabetes
137.
Patients. Sensors, 23, 3665.
[33]. Amarouche, s., & küçük, k. (2022). Machine
https://doi.org/10.3390/s23073665
and deep learning-based intrusion detection and
[21]. Asharf, J., Moustafa, N., Khurshid, H., Debie,
comparison in internet of things. Journal of naval
E., Haider, W., & Wahab, A. (2020). A Review of
sciences and engineering, 18(2), 333-361.
Intrusion Detection Systems Using Machine and
[34]. Wang, Y., Sun, T., Li, S., Yuan, X., Ni, W.,
Deep Learning in Internet of Things: Challenges,
Hossain, E., & Poor, H. V. (2023). Adversarial
Solutions and Future Directions. Electronics, 9 (7),
Attacks and Defenses in Machine Learning-Powered
1177. https://doi.org/10.3390/electronics9071177
Networks: A Contemporary Survey. ArXiv,
[22]. Shahid, J., Ahmad, R., Kiani, A. K., Ahmad, T.,
abs/2303.06302.
Saeed, S., & Almuhaideb, A. M. (2022). Data
[35]. Banaamah, A. M., & Ahmad, I. (2022). Intrusion
Protection and Privacy of the Internet of Healthcare
Detection in IoT Using Deep Learning. Sensors,
Things (IoHTs). Appl. Sci., 12 (4), 1927.
22(21), 8417.
https://doi.org/10.3390/app12041927
[36]. Bhavsar, M., Roy, K., Kelly, J., & Olusola, O.
[23]. Taherdoost, H. (2023). Security and Internet of
(2023). Anomaly-based intrusion detection system for
Things: Benefits, Challenges, and Future
IoT application. Discover Internet of Things, 3(1), 5.
Perspectives. Electronics, 12 (8), 1901.
[37]. Nimbalkar, Pushparaj & Kshirsagar, Deepak.
https://doi.org/10.3390/electronics12081901
(2021). Feature selection for intrusion detection
[24]. Arhore, S. A. (2022). Intrusion Detection in IoT
system in Internet-of-Things (IoT). ICT Express. 7.
Systems using Machine Learning (Doctoral
10.1016/j.icte.2021.04.012.
dissertation, Dublin, National College of Ireland).
[38]. Rodríguez, M., Alesanco, Á., Mehavilla, L., &
[25]. Islam, N., Farhin, F., Sultana, I., Kaiser, M. S.,
García, J. (2022). Evaluation of Machine Learning
Rahman, M. S., Mahmud, M., ... & Cho, G. H.
Techniques for Traffic Flow-Based Intrusion
(2021). Towards Machine Learning Based Intrusion
Detection. Sensors, 22(23), 9326.
Detection in IoT Networks. Computers, Materials &
[39]. Rose, J. R., Swann, M., Bendiab, G., Shiaeles,
Continua, 69 (2).
S., & Kolokotronis, N. (2021, June). Intrusion
[26]. Alghayadh, F., & Debnath, D. (2021). A hybrid
detection using network traffic profiling and machine
intrusion detection system for smart home security
learning for IoT. 2021 IEEE 7th International

73
 Tikrit Journal of Pure Science Vol. 29 (3) 2024

https://doi.org/10.25130/tjps.v29i3.1553
Conference on Network Softwarization (NetSoft) (pp. [44]. Chen, J., Yang, T., He, B., & He, L. (2021). An
409-415). analysis and research on wireless network security
[40]. Tavallaee, M., Bagheri, E., Lu, W., & Ghorbani, dataset. 2021 International Conference on Big Data
A. A. (2009). A detailed analysis of the KDD CUP 99 Analysis and Computer Science (BDACS), 80-83.
data set. 2009 IEEE Symposium on Computational https://doi.org/10.1109/BDACS53596.2021.00025
Intelligence for Security and Defense Applications, 1- [45]. Sharafaldin, I., Lashkari, A. H., & Ghorbani, A.
6. https://doi.org/10.1109/CISDA.2009.5356528 A. (2018). Toward generating a new intrusion
[41]. Song, J., Takakura, H., Okabe, Y., Eto, M., detection dataset and intrusion traffic
Inoue, D., & Nakao, K. (2011). Statistical analysis of characterization. ICISSp, 1, 108-116.
honeypot data and building of Kyoto 2006+ dataset [46]. Damasevicius R, Venckauskas A, Grigaliunas S,
for NIDS evaluation. Proceedings of the First Toldinas J, Morkevicius N, Aleliunas T, Smuikys P.
Workshop on Building Analysis Datasets and (2020). LITNET-2020: An Annotated Real-World
Gathering Experience Returns for Security Network Flow Dataset for Network Intrusion
(BADGERS '11) (pp. 29–36). Detection. Electronics, 9(5), 800.
https://doi.org/10.1145/1978672.1978676 https://doi.org/10.3390/electronics9050800
[42]. Tavallaee, M., Bagheri, E., Lu, W., & Ghorbani, [47]. Derya Erhan. (2019). Boğaziçi University DDoS
A. A. (2009). A Detailed Analysis of the KDD CUP Dataset. IEEE Dataport.
99 Data Set. Submitted to Second IEEE Symposium https://dx.doi.org/10.21227/45m9-9p82
on Computational Intelligence for Security and [48]. Ullah, I., & Mahmoud, Q. H. (2020, May). A
Defense Applications (CISDA), 2009. scheme for generating a dataset for anomalous
[43]. Moustafa, N., & Slay, J. (2015). UNSW-NB15: activity detection in iot networks. In Canadian
a comprehensive data set for network intrusion conference on artificial intelligence (pp. 508-520).
detection systems (UNSW-NB15 network data set). Cham: Springer International Publishing.
2015 Military Communications and Information https://doi.org/10.1007/978-3-030-47358-7_52.
Systems Conference (MilCIS), 1-6.
https://doi.org/10.1109/MilCIS.2015.7348942

74
View publication stats