A Generalized Lightweight Intrusion Detection Model With Unified Feature Selection for Internet of Things Networks

ABSTRACT The applicability of the Internet of Things (IoT) cutting across different domains has resulted in newer “things” acquiring IP connectivity. These things, technically known as IoT devices, are vulnerable to diverse security threats. Consequently, there has been an exponential increase in IoT malware over the past 5 years, and securing IoT devices from such attacks is a pressing concern in the current era. However, the traditional peripheral security measures do not comply with the lightweight security requirements of the IoT ecosystem. Considering this, we propose a lightweight intrusion detection model for IoT networks (LIDM‐IoT) that demonstrates similar efficiency in exposing malicious activities compared with the existing computationally expensive methods. The crux of the proposed model is that it provides efficient attack detection with lower computational requirements in IoT networks. LIDM‐IoT achieves the feat through a novel unified feature selection strategy that unifies filter‐based and embedded feature selection methods. The proposed feature selection strategy reduces the feature space by 94%. Also, we use only the records of a single attack type to build the model using the XGBoost algorithm. We have tested LIDM‐IoT with unseen attack types to ensure its generalized behavior. The results indicate that the proposed model exhibits efficient attack detection, with a reduced feature set, in IoT networks compared with the state‐of‐the‐art models. In this paper, we present a novel lightweight intrusion detection model for Internet of Things networks (LIDM‐IoT) with a unified feature selection strategy. The proposed model, which uses the records of only a single attack type using XGBoost algorithm, demonstrates better performance in attack detection with the reduced feature set as validated by the experimental results.