IEEE TRANSACTIONS ON INDUSTRIAL INFORMATICS, VOL. 19, NO.

1, JANUARY 2023 683

An Intelligent Two-Layer Intrusion Detection

System for the Internet of Things
Mohammed M. Alani , Senior Member, IEEE, and Ali Ismail Awad , Senior Member, IEEE

Abstract—The Internet of Things (IoT) has become an because it can facilitate people’s interactions with real-world ap-
enabler paradigm for different applications, such as health- plications. The development of IoT systems goes hand-in-hand
care, education, agriculture, smart homes, and recently, with advances in technologies such as sensing, actuating, cloud
enterprise systems. Significant advances in IoT networks
have been hindered by security vulnerabilities and threats, computing, and big data analytics and visualization [1].
which, if not addressed, can negatively impact the deploy- An enterprise Internet of Things (E-IoT) is an anticipated
ment and operation of IoT-enabled systems. This article extension of the IoT model. An E-IoT comprises the same IoT
addresses IoT security and presents an intelligent two- components and facilitates the engagement of IoT devices (e.g.,
layer intrusion detection system for IoT. The system’s in- sensors and actuators) to automate enterprise operations, such as
telligence is driven by machine learning techniques for in-
trusion detection, with the two-layer architecture handling business processes. An E-IoT can enhance decision-making and
flow-based and packet-based features. By selecting sig- improve an enterprise’s efficiency by collecting, aggregating,
nificant features, the time overhead is minimized without analyzing, and visualizing heterogeneous data from different
affecting detection accuracy. The uniqueness and novelty sensors [2].
of the proposed system emerge from combining machine The development of the IoT has turned it into a mandatory
learning and selection modules for flow-based and packet-
based features. The proposed intrusion detection works at enabler for many applications. However, the different compo-
the network layer, and hence, it is device and application nents and layers of an IoT network are vulnerable to various
transparent. In our experiments, the proposed system had security threats [3] that could affect whatever application the
an accuracy of 99.15% for packet-based features with a IoT is used for [4], [5]. Therefore, security is a key concern
testing time of 0.357 µs. The flow-based classifier had an for any real-world smart environment based on the IoT model.
accuracy of 99.66% with a testing time of 0.410 µs. A com-
parison demonstrated that the proposed system outper- Different approaches have been adopted to address these security
formed other methods described in the literature. Thus, it threats [6]–[9].
is an accurate and lightweight tool for detecting intrusions Limitations in the computing capabilities and storage of IoT
in IoT systems. devices have made it difficult to deploy standard encryption tech-
Index Terms—Efficiency, flow-based features, Internet of niques and common intrusion detection systems (IDSs). There-
Things (IoT), intrusion detection, machine learning, packet- fore, customized intrusion detection as a second line of defense
based features. has become imperative for IoT systems. Intrusion detection
classifies traffic and applications as benign or malicious [10].
I. INTRODUCTION
Therefore, a machine learning classifier is the right tool for
HE Internet of Things (IoT) has evolved to become an
T enabler for various applications, including healthcare, au-
tonomous driving, education, agriculture, military, smart homes,
building an accurate IDS [11], [12]. According to the survey
described in [4], a few IDSs have been specifically designed and
customized for the IoT.
and recently, enterprise systems. An IoT network is beneficial This study addresses the lack of an efficient IDS that is fully
customized for the IoT and presents an intelligent two-layer IDS
Manuscript received 10 April 2022; revised 15 June 2022; accepted based on machine learning. The central idea of the proposed
30 June 2022. Date of publication 18 July 2022; date of current version system is that it combines flow-based and packet-based features
8 November 2022. Paper no. TII-22-1533. (Corresponding author: Ali
Ismail Awad.)
to achieve high detection accuracy. Furthermore, only the most
Mohammed M. Alani is with the School of IT Administration and influential features are used, which hence, reduces the detection
Security,Seneca College of Applied Arts and Technology, Toronto, M2J time and the processing load for the detection process.
2X5, Canada, and also with Toronto Metropolitan University, Toronto,
ON M5B 2H3, Canada (e-mail: [email protected]).
As discussed in Section II, previous research on intrusion de-
Ali Ismail Awad is with the College of Information Technology, United tection in IoT environments has focused on either flow-based or
Arab Emirates University, Al Ain 17551, UAE, with the Department of packet-based features. Limiting the detection process to packet-
Computer Science, Electrical and Space Engineering, Luleå University
of Technology, 971 87 Luleå, Sweden, also with the Electrical Engi-
or flow-specific features reduces the performance in detecting
neering Department, Faculty of Engineering, Al-Azhar University, Qena various types of attacks. Malicious actors utilize different attack
83513, Egypt, and also with the Centre for Security, Communications techniques. These may rely on individual malicious packets,
and Network Research, University of Plymouth, PL4 8AA Plymouth, U.K.
(e-mail: [email protected]; [email protected]).
such as in port scanning, or on a group of malicious packets that
Color versions of one or more figures in this article are available at can be compiled into a network flow, such as man-in-the-middle
https://doi.org/10.1109/TII.2022.3192035. attacks. In this research, we address this gap by devising a
Digital Object Identifier 10.1109/TII.2022.3192035

1551-3203 © 2022 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission.
See https://www.ieee.org/publications/rights/index.html for more information.

Authorized licensed use limited to: UNIVERSITY TEKNOLOGI MALAYSIA. Downloaded on February 13,2023 at 02:58:30 UTC from IEEE Xplore. Restrictions apply.
684 IEEE TRANSACTIONS ON INDUSTRIAL INFORMATICS, VOL. 19, NO. 1, JANUARY 2023

two-layer system that detects an attack through both packet and Pajouh et al. [14] presented a two-layer dimension reduction
network flow features. and two-tier classification model for anomaly-based intrusion
detection in IoT backbone networks. Linear discriminant anal-
A. Research Contributions ysis (LDA) and principal component analysis (PCA) were used
for feature reduction. The system uses a naive Bayes classifier
Our research into the proposed IDS makes the following to classify traffic, and then the normal traffic is passed through
contributions. a certainty-factor k-nearest neighbor (CF-KNN) classifier as an
1) This research presents a novel two-layer IoT IDS based on additional check. The accuracy achieved was 84.86% with an
machine learning that handles traffic at both packet level FPR of 4.86% measured using the NSL-KDD dataset. However,
and flow level. To the best of our knowledge, the proposed the detection time was not reported.
two-layer architecture handling two types of features is Li et al. [15] proposed a two-stage IDS based on the Bat
novel and unique. algorithm (BAT) and artificial intelligence for software-defined
2) The proposed IDS relies on a reduced number of fea- IoT networks. It is flow-based and can capture network flows
tures, which helps to make the system more efficient to detect attacks. The system was evaluated with the KDD Cup
and realizable. The feature selection technique used not 1999 dataset and achieved a detection accuracy of 96.42% with
only reduces the dimensionality of the data going into the an FPR of 0.98%. The time overhead proportionally increased
classifier but also reduces the number of features that the with the number of flows, and reached almost 4.5 s for 5 × 104
system needs to collect in the data acquisition phase of flows.
deployment. In [16], the authors proposed an intrusion detection frame-
3) The selected classifiers achieve very high accuracy, low work with a dense random neural network (DnRaNN) for the
false positive rate (FPR), low false negative rate (FNR), IoT. It had a detection accuracy of 99.14% and 99.05% for binary
and reduced detection time in comparison to other ap- class and multi-class classification, respectively. However, the
proaches. time overhead and the complexity of the proposed framework
Compared to other systems described in the literature, the were not measured.
proposed IDS for IoT applications is unique and efficient due Kamaldeep et al. [17] developed an IDS for the IoT cross-
to its use of both packet-based and flow-based features and its layer called IoT-Sentry. The system achieved an accuracy of
two-layer architecture and because it selects the most influential 99.46%, evaluated on a non-standard dataset, compared to its
features. Furthermore, the proposed system works mainly at the competitors. IoT-Sentry uses only packet-based features and
network layer. Hence, it is application transparent and conse- guards against only a limited number of attacks. No details were
quently, can be used as a valuable security measure for E-IoT given of the time overhead.
applications. Recently, in 2022, Saba et al. [18] proposed the deployment
of deep learning via a convolutional neural network (CNN)
B. Paper Layout for anomaly-based detection. This IDS can efficiently examine
The rest of this article is organized as follows. The introduc- all the traffic flowing across an IoT system. The model was
tion is presented in Section I. Section II presents previous works evaluated using the NID and BoT-IoT [19] datasets, attaining
relevant to this study. The information introduced in that sec- accuracies of 99.51% and 92.85%, respectively. The study did
tion is later utilized in the comparative analysis of the proposed not consider feature optimization, and the detection time was
system and other systems. The architecture and components of not reported.
the proposed IDS are described in Section III. The dataset used, As demonstrated by this literature review, intrusion detection
including the flow-based and packet-based features, is discussed is an outstanding problem that is highly relevant to the current
in Section IV. The experiments and the results are presented IoT and cybersecurity research communities. Based on a careful
in Section V. Section VI is a discussion of the results and the analysis of the relevant literature, we concluded that realizing
research limitations. Finally, Section VII concludes this article, a balance of superior detection accuracy and reduced detection
along with suggestions for future research. time with a simple and implementable machine learning model
was still a valid challenge, and this motivated the current study.
Table IX briefly compares the performance of the IDSs described
II. RELATED WORK in the literature review with the proposed system.
Intrusion detection has been the subject of a considerable
amount of published research. Particular attention has been
III. OVERVIEW OF THE PROPOSED SYSTEM
given to the deployment of different machine learning models to
achieve high detection accuracy. However, intrusion detection The aim of the proposed system is to provide additional
for the IoT is still a challenge due to the data heterogeneity, protection by utilizing two different machine learning classifiers:
limited device capabilities, and the huge number of possible 1) one classifier operates with packet-extracted features; 2) the
applications. Therefore, an IDS for the IoT has to be a complete other operates with flow-extracted features. Fig. 1 is an overview
system [13]. Artificial intelligence, such as machine learning, of the proposed system.
has been used as a powerful tool to solve IoT security issues due As shown in Fig. 1, the system operation is divided into two
to its ability to cope with data heterogeneity and velocity. phases: 1) development; 2) deployment. During the development

Authorized licensed use limited to: UNIVERSITY TEKNOLOGI MALAYSIA. Downloaded on February 13,2023 at 02:58:30 UTC from IEEE Xplore. Restrictions apply.
ALANI AND AWAD: INTELLIGENT TWO-LAYER INTRUSION DETECTION SYSTEM FOR THE INTERNET OF THINGS 685

Fig. 1. Overview of the proposed IDS for the IoT. The bold blocks have been implemented in this study, while the green blocks are the core
modules of the proposed system.

phase, flow and packet features are separately extracted from the the whole flow is just one packet. In similar attacks where flow
original raw traffic data. Both feature datasets are preprocessed, information is scarce, packet-level detection achieves higher
specifically to address the observations made while individually accuracy for a much faster detection time. These attacks are
examining them (Section IV). Then, a pipeline of classifiers is especially important to prevent because they constitute the first
trained using each dataset independently. Once the best classifier step of higher-risk attacks, such as botnets and remote code
has been identified for each dataset, it is deployed in the next execution.
phase. Another design choice we made was to use classification
In the deployment phase, all incoming and outgoing packets at algorithms that do not use neural networks or deep learning.
a designated interface are captured. The raw traffic is then passed Neural networks are resource-intensive in comparison to other
to two units. The first unit extracts the significant packet-level machine learning classifiers [22]. All blocks with thicker borders
features. These are passed to the packet classifier, which assesses in Fig. 1 have been implemented.
whether each packet is malicious or benign. The other unit
collects each packet as part of a flow. When the flow is complete IV. DATASET
or the flow collection timer has expired, the flow information As the proposed system requires data in both packet-based
is passed to a flow-level feature extraction unit. From the flow and flow-based formats, we selected the dataset “IoT network
features, the flow classifier decides whether a flow is malicious intrusion dataset” presented in [23]. This dataset was created by
or benign. If a malicious packet or flow is detected, the system capturing raw network packets from actual IoT devices, includ-
signals a detection alert. This alert can be used to block the ing actual attack traffic. The dataset consists of 42 packet capture
source of the attack immediately. (pcap) files that include benign and attack packets. The types
Most of the previous works explored in Section II utilize of attack captured in the dataset are denial-of-service (DoS)
flow-based detection, which is commonly described in the lit- SYN-flooding, man-in-the-middle address resolution protocol
erature [20], [21]. The proposed system utilizes both packet- (ARP) spoofing, host scanning, port scanning, and Mirai botnet
and flow-based features to improve the overall accuracy of attacks (host brute force, user datagram protocol (UDP) flood-
detection. Some attacks, specifically reconnaissance attacks, ing, hyper-text transfer protocol (HTTP) flooding, and ACK
such as port scanning and OS detection, do not use a complete flooding).
communication session. For example, port scanning attacks send The dataset has 2 985 994 packets (1 229 718 malicious and
only one packet per port during the scanning process. This 1 756 276 benign). Upon examination, we noticed that 949 284
makes it difficult to identify them based on flow features, as of the packets were for the Mirai UDP flooding attack, so that

Authorized licensed use limited to: UNIVERSITY TEKNOLOGI MALAYSIA. Downloaded on February 13,2023 at 02:58:30 UTC from IEEE Xplore. Restrictions apply.
686 IEEE TRANSACTIONS ON INDUSTRIAL INFORMATICS, VOL. 19, NO. 1, JANUARY 2023

Algorithm 1: Packet-Based Dataset Preprocessing. Algorithm 2: Flow-Based Dataset Preprocessing.

Input: Packet-based dataset (1 731 858 instances and 21 Input: Flow-based dataset (1 731 858 instances and 20
features) features)
Output: Balanced dataset with no missing data (1 259 982 Output: Balanced dataset with no absent data (1 259 982
instance and 21 features) instances and 14 features)
Array ← RawDataset Array ← RawDataset
In (Array) label-encode icmp and arp features Array ← Remove_HostSpecif icF eatures(Array)
In (Array) convert ip.f lags and tcp.f lags to decimal In (Array) label-encode
In (Array) assign −1 to mutually exclusive features proto, service, conn_state, history features
Array ← Array ←
RandomU nderSampling_M ajorityClass(Array) RandomOverSampling_M inorityClass(Array)
Dataset ← Array Dataset ← Array

attack type was seriously imbalanced. Hence, we decided to omit perform label encoding on icmp and arp features. If a packet
two of the pcap files that hold Mirai UDP flooding attacks. This is an Internet control messaging protocol (ICMP) packet, the
left a final raw dataset with a total of 2 151 852 packets (419 994 value of the icmp feature is set to 1, otherwise it is set to 0.
malicious and 1 731 858 benign). If the packet is an ARP packet, the value of the arp feature is
To fulfill the goals of this research, two datasets were needed set to 1, otherwise it is set to 0. The second step is to convert
to train the two layers of the proposed system: 1) packet-based the ip.flags and tcp.flags features from hexadecimal to decimal.
dataset; 2) flow-based dataset. The packet-based dataset would For the mutually exclusive features, we set absent values to
include features extracted at the packet level, which are to be −1. We chose −1 over 0 because 0 is a valid value for these
used for training and testing the packet layer. On the other hand, features. Hence, all UDP features will have a value of −1 for
the flow-level dataset would include flow-based features, which each instance of a TCP packet. Similarly, all TCP features will
are to be used in training and testing the flow layer. The following have a value of −1 for instances of UDP packets. The last step
sections discuss the extraction and preprocessing of these two reduces the imbalance between the two classes by randomly
datasets. undersampling benign packets, so that the final dataset contains
66.66% benign and 33.33% malicious instances. It comprises
A. Packet-Based Dataset 1 259 982 instances (839 988 benign and 419 994 malicious),
and all values are populated.
Features for all packets in the 40 pcap files selected were
extracted with the tshark tool [24]. The proposed system used 27
B. Flow-Based Dataset
features based on the description document for the raw dataset.
After extraction, all host-specific features were removed, such as The same 40 pcap files that were used to build the packet-
the source and destination IP and media access control (MAC) based dataset were used for the flow-based dataset. Altogether,
addresses. This was to ensure that the trained model can gener- 20 flow features were extracted for all packets with the Zeek
alize beyond its training dataset. A few empty features were also tool [25], and these were stored in the conn.log file. As for
removed. The resulting dataset comprises 2 151 852 instances, the packets, to ensure that the trained model can generalize
each of which represents 21 features extracted from one packet. beyond its training dataset, all host-specific features were re-
As the research goal is to detect any type of attack, without moved, such as the source and destination IP addresses and flow
distinguishing the specific types, we chose to label the instances timestamps. Two empty features (local_orig and local_resp)
only as “malicious” or “benign.” We did not use the specific were also removed. The resulting dataset comprises 198 064
attack type as a label. instances. Each instance represents 14 features extracted from
Upon examining the resulting dataset, we noted the following one network flow. As with the packets, we labeled the instances
observations. as either “malicious” or “benign.”
1) The features “icmp” and “arp” are in text format. Again, the resulting dataset was examined, and the following
2) The features “ip.flags” and “tcp.flags” are hexadecimal. observations were noted.
3) Some features have mutually exclusive values. Specif- 1) The features “proto,” “service,” “conn_state,” and “his-
ically, all transmission control protocol (TCP)-related tory” are in text format.
features, such as “tcp.flags,” “tcp.checksum.status,” and 2) The number of benign instances was 86 719, while there
“tcp.len,” are missing in instances extracted from UDP were 111 345 malicious instances.
packets, and vice versa. To address the observations listed above, we developed the
4) There is a noticeable imbalance between the malicious preprocessing steps shown in Algorithm 2. The first step of pre-
class and the benign class, with 1 731 858 benign and processing is to remove host-specific features. The second step
419 994 malicious instances. performs label encoding on the proto, service, conn_state, and
To address the observations listed above, we developed the history features. The final step reduces the imbalance between
preprocessing steps shown in Algorithm 1. The first step is to the two classes by randomly oversampling benign packets, so

Authorized licensed use limited to: UNIVERSITY TEKNOLOGI MALAYSIA. Downloaded on February 13,2023 at 02:58:30 UTC from IEEE Xplore. Restrictions apply.
ALANI AND AWAD: INTELLIGENT TWO-LAYER INTRUSION DETECTION SYSTEM FOR THE INTERNET OF THINGS 687

TABLE I
HARDWARE AND SOFTWARE FOR THE IMPLEMENTATION ENVIRONMENT

that the final dataset has 50% benign and 50% malicious in-
stances. It comprises 222 690 instances (111 345 benign and
111 345 malicious) and 14 features. All values are populated.

V. EXPERIMENTS AND RESULTS

Table I lists the hardware and software specifications of the
experimental environment. 5) The two pipelines of classifiers were retrained and
retested using the feature-reduced datasets, with a similar
A. Experimental Design 66.66% and 33.33% training/testing random split. The
purpose of this stage was to measure the impact of feature
The experiments were implemented as follows.
selection on the performance of the classifiers.
1) After preprocessing both the packet-based and flow-based
6) To ensure that the classifiers trained using the feature-
datasets, we split each dataset randomly, with 66.66% as
reduced dataset can generalize well beyond their training
a training subset and 33.33% as a testing subset.
dataset, we implemented ten-fold cross-validation. The
2) We created a pipeline of five different classifiers for
data were randomly split into ten subsets or folds. The
each dataset to be trained using the training subset. The
data then went through ten cycles of training followed
five classifiers chosen were: 1) random forest (RF); 2)
by testing. In each cycle, one of the ten subsets was
Gaussian naive Bayes (GNB); 3) xgradient boost (XGB);
excluded from training and used instead for testing. Dur-
4) logistic regression (LR); 5) decision tree (DT). The
ing the ten cycles, each of the ten subsets was used
purpose of building this pipeline was to find the classifica-
once for testing. Each cycle produced a classifier with
tion algorithm that would provide the best performance in
specific performance parameters. If these parameters have
comparison to the others. The pipeline was run separately
a high variance, then the classifier suffers from overfitting
for the packet features and the flow features datasets.
and cannot properly generalize within the dataset. If the
3) The two pipelines of classifiers were trained, one with
process produces a low variance, then the performance
the packet-based training subset and the other with the
parameters are reliable.
flow-based training subset. Testing was done with the
corresponding testing subsets.
B. Packet-Based Classifier Results
4) The best classifier in each pipeline was used to measure
feature importance based on recursive feature elimina- The five classifiers were trained using 66.66% of the packet-
tion (RFE). Algorithm 3 shows the RFE steps imple- based dataset, as explained in Section V-A. Table II shows the
mented to reduce the number of features and improve results of testing using the remaining 33.33% of the packet-based
efficiency [26]. Feature importance can be measured as dataset. XGB performed slightly better than the other classifiers,
the average decrease in impurity computed from all DTs with an accuracy of 0.9937, an F1 score of 0.9930, and a training
in the forest, without assuming that the data are linearly time of 14.41 s. Hence, it was the one we chose for the RFE
separable [27]. This algorithm was chosen over other algorithm. Since the F1 score falls with less than nine features,
dimensionality reduction algorithms for two reasons: a) as shown in Fig. 2(a), to prevent the performance from dropping
dimensionality reduction algorithms of a statistical na- significantly, we decided to use nine features. The selected
ture, such as PCA and LDA, are computationally in- features are listed in Table III.
tensive, not only at the development stage but also at The next step was to test the nine-feature packet-based dataset
the deployment stage, because these algorithms require to ensure that its performance was comparable to that of the
intensive preprocessing to produce the final features to full-feature dataset. Table IV shows that the performance metrics
be fed into the classifier; b) RFE not only reduces the of XGB, RF, LR, and DT were not significantly affected, while
number of features fed into the classifier (without any the performance of GNB was noticeably worse.
additional preprocessing) but also reduces the number of Fig. 3 compares the performance metrics for the 21- and nine-
features to be captured at the data acquisition stage. This feature datasets. For the XGB and RF classifiers, performance
helps in improving the overall efficiency. did not degrade with fewer features, as both accuracy and F1

Authorized licensed use limited to: UNIVERSITY TEKNOLOGI MALAYSIA. Downloaded on February 13,2023 at 02:58:30 UTC from IEEE Xplore. Restrictions apply.
688 IEEE TRANSACTIONS ON INDUSTRIAL INFORMATICS, VOL. 19, NO. 1, JANUARY 2023

TABLE II
INITIAL RESULTS OF PACKET-BASED CLASSIFIER TESTING

Fig. 2. F1 score plotted against the number of features. (a) Number of packet-based features. (b) Number of flow-based features.

Fig. 3. Comparison of accuracy and F1 score for the classifiers with 21- and nine-feature packet-based datasets.

TABLE III classifiers when applied to the nine-feature packet-based dataset.

FEATURES USED FROM PACKET-BASED AND FLOW-BASED DATASETS
As the table shows, the performance of XGB, RF, and DT are
consistent with the previously obtained results. In addition, all
the classifiers had a low standard deviation. This proves that the
classifiers can generalize well beyond their training dataset.

C. Flow-Based Classifier Results

The selected five classifiers were trained using 66.66% of
the flow-based dataset, as explained in Section V-A. Table VI
score remained above 99%. Furthermore, Fig. 4 shows that the shows the results of testing using the remaining 33.33% of the
training and testing times witnessed a noticeable improvement dataset. RF performed slightly better than the other classifiers,
compared to the 21-feature dataset. with an accuracy of 0.9973, an F1 score of 0.9974, and a training
For the ten-fold cross-validation, Table V shows the means time of 7.88 s. Therefore, we chose it for the RFE algorithm to
and standard deviations of the accuracy and F1 score for the five select a low number of features to improve the efficiency of

Authorized licensed use limited to: UNIVERSITY TEKNOLOGI MALAYSIA. Downloaded on February 13,2023 at 02:58:30 UTC from IEEE Xplore. Restrictions apply.
ALANI AND AWAD: INTELLIGENT TWO-LAYER INTRUSION DETECTION SYSTEM FOR THE INTERNET OF THINGS 689

TABLE IV
RESULTS OF NINE-FEATURE PACKET-BASED CLASSIFIER TESTING

Fig. 4. Time overhead measured for training and testing processes for 21- and nine-feature packet-based datasets. (a) Training times. (b) Testing
times.

TABLE V
RESULTS OF TEN-FOLD CROSS-VALIDATION OF THE NINE-FEATURE PACKET-BASED DATASET

TABLE VI
INITIAL RESULTS OF FLOW-BASED CLASSIFIER TESTING

TABLE VII
RESULTS OF FIVE-FEATURE FLOW-BASED CLASSIFIER TESTING

the system. Since the F1 score falls with less than five features, dataset. Table VII shows that the performance metrics of XGB,
as shown in Fig. 2(b), to prevent the performance from drop- RF, and DT were not significantly affected, while the perfor-
ping significantly, we decided to use five features, as listed in mance of LR and GNB was noticeably better.
Table III. Fig. 5 compares the performance metrics for the 14- and five-
We then tested the five-feature flow-based dataset to ensure feature datasets. For the XGB and RF classifiers, performance
that its performance was comparable to that of the full-feature did not degrade with fewer features, as the accuracy and F1

Authorized licensed use limited to: UNIVERSITY TEKNOLOGI MALAYSIA. Downloaded on February 13,2023 at 02:58:30 UTC from IEEE Xplore. Restrictions apply.
690 IEEE TRANSACTIONS ON INDUSTRIAL INFORMATICS, VOL. 19, NO. 1, JANUARY 2023

Fig. 5. Comparison of accuracy and F1 score for the classifiers with 14- and five-feature flow-based datasets.

Fig. 6. Time overhead measured for training and testing processes for 14- and five-feature flow-based datasets. (a) Training times.
(b) Testing times.

TABLE VIII
RESULTS OF TEN-FOLD CROSS-VALIDATION OF THE FIVE-FEATURE FLOW-BASED DATASET

score remained above 99%. Furthermore, Fig. 6 indicates that the dataset (Table VII), notice that the difference in accuracy and F1
training and testing times were significantly shorter compared score between RF and XGB is minimal. However, as one of our
to the 14-feature dataset. research goals is to produce an efficient system, we consequently
For the ten-fold cross-validation, Table VIII shows the mean used XGB, as it has the best combination of high accuracy and
and standard deviation of the accuracy and F1 score for the five low testing time.
classifiers when applied to the five-feature flow-based dataset. For this classifier, the measured FPR was 0.96% for the
As shown in the table, the performance of XGB, RF, and DT packet-based classifier (Table IX), whereas the FNR was
is consistent with the results previously obtained. In addition, 0.61%. The flow-based classifier had a lower FPR of 0.26%
all the classifiers had a low standard deviation. This proves that and a lower FNR of 0.40%. These low rates indicate that, in
these classifiers can generalize well beyond the training dataset. comparison to previous approaches, both classifiers performed
very well with a low number of features extracted from captured
traffic.
D. Classifier Selection Figs. 7 and 8 show the confusion matrix plots for the
From the results of the classifier pipeline for the nine-feature XGB classifier using nine-feature packet-based dataset and
packet-based dataset (Table IV) and the five-feature flow-based five-feature flow-based dataset, respectively.

Authorized licensed use limited to: UNIVERSITY TEKNOLOGI MALAYSIA. Downloaded on February 13,2023 at 02:58:30 UTC from IEEE Xplore. Restrictions apply.
ALANI AND AWAD: INTELLIGENT TWO-LAYER INTRUSION DETECTION SYSTEM FOR THE INTERNET OF THINGS 691

TABLE IX
COMPARISON OF THE PROPOSED SYSTEM WITH STATE-OF-THE-ART APPROACHES

improves efficiency and reduces processing overhead, which are

important for the resource-constrained environment of the IoT.
Table IX compares the performance metrics for our proposed
system with those for related approaches. The table confirms that
our proposed system outperforms related approaches in terms
of accuracy and testing time. In addition, our proposed system
delivers a noticeable reduction in the FPR and FNR. At the
packet level, the FPR was 0.96%, and the FNR was 0.61%,
whereas at the flow-level, the FPR was only 0.26% and the FNR
only 0.40%.
As Section II suggests, most previous works rely on flow-
based features to detect intrusion. That works well if the attacker
exchanges a reasonable amount of information with the target.
However, other types of attack, such as port scanning, ping
Fig. 7. Confusion matrix for XGB classifier using the packet-based
nine features.
sweep, and OS fingerprinting, are better detected using packet-
based features. This is because the attacker targets different
ports using different packets, which makes it impossible to
follow a network flow. Hence, the combination of flow-based and
packet-based features used in our system ensures that different
types of attacks can be detected.
Another advantage of our proposed system over other sys-
tems is that it utilizes XGB as a classification algorithm. This
algorithm requires noticeably less intensive processing in com-
parison to other deep learning algorithms [22]. XGB was chosen
not only for its high performance but also due to the processing
limitations of the deployment environment.

VII. CONCLUSION
In this article, we presented a novel two-layer IoT IDS based
on machine learning. The proposed system examines features
Fig. 8. Confusion matrix for XGB classifier using the flow-based five
features. extracted from packets as well as from network flows. Combin-
ing these two defenses provides the maximum possible protec-
tion. In testing, the proposed system had a very high accuracy
VI. DISCUSSION AND COMPARATIVE ANALYSIS of 99.15% at the packet level and 99.66% at the flow level.
Many research studies have tried addressing intrusion detec- This high accuracy was combined with noticeable efficiency
tion in IoT devices. These studies, as we explained in Section II, improvements, namely, detection times of 0.357 µs at the packet
have mostly focused on high accuracy while ignoring barriers level and 0.410 µs at the flow level. For the packet-based
to deployment in real-world applications. This study presents a classifier, the FPR was only 0.96% and the FNR was 0.61%.
novel two-layer solution that is designed to harvest the benefits of For the flow-based classifier, the FPR was only 0.26%, while the
packet- and flow-level features. Using only the features selected FNR was 0.40%. These metrics show that the proposed system
by RFE produced a noticeable reduction in training time. The outperforms previous approaches. Our future work will focus
advantage of using RFE over other dimensionality reduction on the decentralized implementation of the proposed two-layer
solutions is that fewer features need to be captured and extracted system in the edge to offload some of the processing from IoT
in the data acquisition phase of a real-time deployment. This devices.

Authorized licensed use limited to: UNIVERSITY TEKNOLOGI MALAYSIA. Downloaded on February 13,2023 at 02:58:30 UTC from IEEE Xplore. Restrictions apply.
692 IEEE TRANSACTIONS ON INDUSTRIAL INFORMATICS, VOL. 19, NO. 1, JANUARY 2023

REFERENCES [19] N. Koroniotis, N. Moustafa, E. Sitnikova, and B. Turnbull, “Towards

the development of realistic botnet dataset in the Internet of Things for
[1] B. Ali and A. I. Awad, “Cyber and physical security vulnerability as- network forensic analytics: BoT-IoT dataset,” Future Gener. Comput. Syst.,
sessment for IoT-based smart homes,” Sensors, vol. 18, no. 3, 2018, vol. 100, pp. 779–796, 2019. [Online]. Available: https://doi.org/10.1016/
Art. no. 817. [Online]. Available: https://doi.org/10.3390/s18030817 j.future.2019.05.041
[2] S. Ahmad and D. Kim, “A multi-device multi-tasks management and [20] A. Sperotto, G. Schaffrath, R. Sadre, C. Morariu, A. Pras, and B. Stiller,
orchestration architecture for the design of enterprise IoT applications,” “An overview of IP flow-based intrusion detection,” IEEE Commun. Surv.
Future Gener. Comput. Syst., vol. 106, pp. 482–500, 2020. [Online]. Tut., vol. 12, no. 3, pp. 343–356, Jul.–Sep. 2010. [Online]. Available: https:
Available: https://doi.org/10.1016/j.future.2019.11.030 //doi.org/10.1109/SURV.2010.032210.00054
[3] M. Mamdouh, A. I. Awad, A. A. Khalaf, and H. F. Hamed, “Authentication [21] A. F. AlEroud and G. Karabatis, “Queryable semantics to detect cyber-
and identity management of IoHT devices: Achievements, challenges, attacks: A flow-based detection approach,” IEEE Trans. Syst., Man, Cy-
and future directions,” Comput. Secur., vol. 111, 2021, Art. no. 102491. bern. Syst., vol. 48, no. 2, pp. 207–223, Feb. 2018. [Online]. Available:
[Online]. Available: https://doi.org/10.1016/j.cose.2021.102491 https://doi.org/10.1109/TSMC.2016.2600405
[4] M. F. Elrawy, A. I. Awad, and H. F. Hamed, “Intrusion detection systems for [22] A. Géron, Hands-On Machine Learning With Scikit-Learn, Keras, and
IoT-based smart environments: A survey,” J. Cloud Comput., vol. 7, no. 1, TensorFlow: Concepts, Tools, and Techniques to Build Intelligent Systems.
pp. 1–20, 2018. [Online]. Available: https://doi.org/10.1186/s13677-018- Sebastopol, CA, USA: O’Reilly Media, Inc., 2019.
0123-6 [23] H. Kang, D. H. Ahn, G. M. Lee, J. D. Yoo, K. H. Park, and H. K. Kim, “IoT
[5] A. I. Awad and J. Abawajy, Security and Privacy in the Internet of Things: network intrusion dataset,” 2019. [Online]. Available: https://doi.org/10.
Architectures, Techniques, and Applications, 1st ed. Hoboken, NJ, USA: 21227/q70p-q449
Wiley, 2021. [24] tshark(1). Mar. 2022, Accessed: Mar. 9, 2022. [Online]. Available: https:
[6] M. Hassaballah, M. A. Hameed, A. I. Awad, and K. Muhammad, “A novel //www.wireshark.org/docs/man-pages/tshark.html
image steganography method for industrial Internet of Things security,” [25] The zeek network security monitor. Mar. 2022, Accessed: Mar. 30, 2022.
IEEE Trans. Ind. Informat., vol. 17, no. 11, pp. 7743–7751, Nov. 2021. [Online]. Available: https://zeek.org
[Online]. Available: https://doi.org/10.1109/TII.2021.3053595 [26] M. M. Alani, “Implementation-oriented feature selection in UNSW-NB15
[7] Q.-D. Ngo, H.-T. Nguyen, V.-H. Le, and D.-H. Nguyen, “A survey of IoT intrusion detection dataset,” in Proc. Int. Conf. Intell. Syst. Des. Appl.,
malware and detection methods based on static features,” ICT Exp., vol. 6, 2022, pp. 548–558.
no. 4, pp. 280–286, 2020. [Online]. Available: https://doi.org/10.1016/j. [27] S. Raschka, Y. Liu, and V. Mirjalili, Mach. Learn. With PyTorch and Scikit-
icte.2020.04.005 Learn. Birmingham, U.K.: Packt Publishing, 2022.
[8] M. M. Alani, “Detection of reconnaissance attacks on IoT devices using
deep neural networks,” in Advances in Nature-Inspired Cyber Security
and Resilience, S. K. Shandilya, N. Wagner, V. Gupta, and A. K. Na- Mohammed M. Alani (Senior Member, IEEE)
gar, Eds., Cham, Switzerland:Springer International Publishing, 2022, received the Ph.D. in computer engineering
pp. 9–27. from College of Engineering, Nahrain Universi-
[9] A. A. Cook, G. Mısırlı, and Z. Fan, “Anomaly detection for IoT ety, Iraq, in 2007, with a specialization in net-
time-series data: A survey,” IEEE Internet Things J., vol. 7, no. 7, work security.
pp. 6481–6494, Jul. 2020. [Online]. Available: https://doi.org/10.1109/ He was a Professor and a Cybersecurity Ex-
JIOT.2019.2958185 pert in many countries around the world. His
[10] N. Lu, D. Li, W. Shi, P. Vijayakumar, F. Piccialli, and V. Chang, “An experience includes serving as VP of Academic
efficient combined deep neural network based malware detection frame- Affairs in the United Arab Emirates, network
work in 5G environment,” Comput. Netw., vol. 189, 2021, Art. no. 107932. and security consultancies in the Middle East,
[Online]. Available: https://doi.org/10.1016/j.comnet.2021.107932 and Cybersecurity Program Manager in Toronto
[11] P. Illy, G. Kaddoum, K. Kaur, and S. Garg, “ML-based IDPS enhance- Canada. He is currently a Cybersecurity Professor with Seneca College,
ment with complementary features for home IoT networks,” IEEE Trans. Toronto, ON, Canada, and a Research Fellow with Ryerson University,
Netw. Service Manag., vol. 19, no. 2, pp. 772–783, Jun. 2022. [Online]. Toronto. He has authored or coauthored four books in different areas
Available: https://doi.org/10.1109/TNSM.2022.3141942 of networking and cybersecurity along with many research papers pub-
[12] M. M. Alani and A. I. Awad, “AdStop: Efficient flow-based mobile lished in highly ranked journals and conferences. His current research
adware detection using machine learning,” Comput. Secur., vol. 117, 2022, interests include applications of ML in cybersecurity and ML security.
Art. no. 102718. [Online]. Available: https://doi.org/10.1016/j.cose.2022. Dr. Alani is a Senior Member of the Association for Computing
102718 Machinery (ACM).
[13] E. Benkhelifa, T. Welsh, and W. Hamouda, “A critical review of practices
and challenges in intrusion detection systems for IoT: Toward univer-
Ali Ismail Awad (Senior Member, IEEE) re-
sal and resilient systems,” IEEE Commun. Surv. Tut., vol. 20, no. 4,
ceived the Ph.D. degree in computer science
pp. 3496–3509, Oct.–Dec. 2018. [Online]. Available: https://doi.org/10.
from Kyushu University, Fukuoka, Japan, in
1109/COMST.2018.2844742
2012. He is currently an Associate Profes-
[14] H. H. Pajouh, R. Javidan, R. Khayami, A. Dehghantanha, and K.-K. R.
sor with the College of Information Technology
Choo, “A two-layer dimension reduction and two-tier classification model
(CIT), United Arab Emirates University (UAEU),
for anomaly-based intrusion detection in IoT backbone networks,” IEEE
Al Ain, United Arab Emirates. He is also an As-
Trans. Emerg. Topics Comput., vol. 7, no. 2, pp. 314–323, Apr.–Jun. 2019.
sociate Professor (Docent) with the Department
[Online]. Available: https://doi.org/10.1109/TETC.2016.2633228
of Computer Science, Electrical and Space
[15] J. Li, Z. Zhao, R. Li, and H. Zhang, “AI-based two-stage intrusion detection
Engineering, Luleå University of Technology,
for software defined IoT networks,” IEEE Internet Things J., vol. 6, no. 2,
Luleå, Sweden, where he also served as a co-
pp. 2093–2102, Apr. 2019. [Online]. Available: https://doi.org/10.1109/
ordinator of the Master Program in Information Security from 2017 to
JIOT.2018.2883344
2020. He is an Associate Professor with the Electrical Engineering
[16] S. Latif et al., “Intrusion detection framework for the Internet of Things
Department, Faculty of Engineering, Al-Azhar University at Qena, Qena,
using a dense random neural network,” IEEE Trans. Ind. Informat., vol. 18,
Egypt. He is also a Visiting Researcher with the University of Plymouth,
no. 9, pp. 6435–6444, Sep. 2022. [Online]. Available: https://doi.org/10.
Plymouth, U.K.
1109/TII.2021.3130248
He has edited or coedited eight books and authored or coauthored
[17] Kamaldeep, M. Malik, M. Dutta, and J. Granjal, “IoT-Sentry: A cross-
several journal articles and conference papers in these areas. His
layer-based intrusion detection system in standardized Internet of Things,”
research interests include cybersecurity, network security, Internet of
IEEE Sensors J., vol. 21, no. 24, pp. 28066–28076, Dec. 2021. [Online].
Things security, and image analysis with biometrics and medical imag-
Available: https://doi.org/10.1109/JSEN.2021.3124886
ing applications.
[18] T. Saba, A. Rehman, T. Sadad, H. Kolivand, and S. A. Bahaj, “Anomaly-
Dr. Awad is an Editorial Board Member of the Future Generation Com-
based intrusion detection system for IoT networks through deep learning
puter Systems Journal, Computers and Security Journal, the Internet
model,” Comput. Elect. Eng., vol. 99, 2022, Art. no. 107810. [Online].
of Things, Engineering Cyber Physical Human Systems Journal, and
Available: https://doi.org/10.1016/j.compeleceng.2022.107810
Health Information Science and Systems Journal.

Authorized licensed use limited to: UNIVERSITY TEKNOLOGI MALAYSIA. Downloaded on February 13,2023 at 02:58:30 UTC from IEEE Xplore. Restrictions apply.