Comparative Analysis of Stack-Ensemble-Based Intrusion Detection System for Single-Layer and Cross-layer DoS Attack Detection in IoT

Detection of Denial-of-Service (DoS) Attack in IoT is challenging as these attacks happen at multiple layers of IoT architecture. Machine learning (ML)-based Intrusion Detection Systems (IDSs) are more efficient approaches in detecting such attacks by identifying anomalies than traditional ones. However, using a single ML algorithm in such IDS is not sufficiently able to detect DoS attacks as it may end up with over-fitting and under-fitting. In this paper, we propose an anomaly-based IDS (AIDS) using an ensemble learning technique to detect both single and cross-layer DoS attacks in IoT. The proposed model is designed by ensembling multiple ML models, which are K-nearest neighbor (KNN), Support Vector Machine (SVM), Decision Tree (DT), and Logistic Regression (LR). The novelty of the proposed AIDS is that it efficiently detects both single-layer and cross-layer DoS attacks in IoT. A comparative analysis shows a maximum detection accuracy of 96.5% for single-layer attacks and 94.98% for cross-layer attacks using a simulation environment.