Cyber Attack Detection Based on Anomaly Intrusion Detection System for IoT Network

Abstract

 The rapid expansion of Internet of Things (IoT) technologies has created major opportunities for smart communication systems and digital services. At the same time, this development has introduced serious cybersecurity challenges because IoT devices are often characterized by limited memory capacity, low computational power, and insufficient built-in security mechanisms. Consequently, IoT infrastructures have become vulnerable to a wide range of cyber threats, including Distributed Denial of Service (DDoS) attacks, spoofing attacks, malware injection, and unauthorized access attempts.

To strengthen the security of modern IoT environments, this study proposes an anomaly-based Intrusion Detection System (IDS) utilizing the Random Forest machine learning algorithm. The proposed framework was implemented and evaluated using the CICIDS2017 benchmark dataset, which contains realistic network traffic records and diverse attack categories. In addition, the performance of the proposed model was compared with several machine learning and deep learning techniques, including Convolutional Neural Networks (CNN), Logistic Regression (LR), Support Vector Machine (SVM), and Gradient Boosting (GB).

A preprocessing stage was conducted before model training to improve data quality and learning efficiency. The preprocessing operations included removing missing values, converting categorical variables into numerical form, normalizing dataset features, and balancing minority attack classes using the Synthetic Minority Over-sampling Technique (SMOTE).

Experimental findings demonstrated that the Random Forest model achieved superior performance compared with the other investigated approaches. The model produced high values of accuracy, precision, recall, and F1-score while maintaining low false positive rates. The results also confirmed that integrating SMOTE with ensemble learning techniques improves intrusion detection capability and enhances the identification of rare and sophisticated cyberattacks in IoT communication environments.