IoT Data from IoT-23, NSL-KDD, and TON_IoT

As the Internet of Things (IoT) continues to evolve, securing IoT networks and devices remains a continuing challenge.The deployment of IoT applications makes protection more challenging with the increased attack surfaces as well as the vulnerable and resource-constrained devices. Anomaly detection is a crucial procedure in protecting IoT. A promising way to perform anomaly detection on IoT is through the use of machine learning algorithms. There is a lack in the literature to identify the optimal (with regard to both effectiveness and efficiency) anomaly detection models for IoT. To fill the gap, this work thoroughly investigated the effectiveness and efficiency of XGBoost in IoT anomaly detection and compared it with the well-known learning models, Support Vector Machines (SVM) and Deep Convolutional Neural Networks (DCNN). Identifying the optimal anomaly detection models for IoT is highly challenging due to diverse IoT applications and dynamic IoT networking environments. It is of vital importance to evaluate the ML powered anomaly detection models using multiple datasets collected from different environments. We utilized three well-known datasets to benchmark the aforementioned machine learning methods, namely, IoT-23, NSL_KDD, and TON_IoT. Our results show that XGBoost outperformed both SVM and DCNN achieving accuracies up to 99.98%. Moreover, XGBoost proved to be the most computationally efficient method where the model performed 717.75 times faster than SVM and significantly faster than DCNN in terms of training times. The research results have been further confirmed by using our real-world IoT data collected from an IoT testbed consisting of physical devices that we recently built. Our evaluation of the anomaly detection models using the real-world data proves that XGBoost can be used to efficiently and accurately detect anomalies in real-world IoT applications.

随着物联网（IoT）的持续演进，保障物联网网络与设备的安全构成了一项持续性的挑战。物联网应用的部署使得保护工作更为艰巨，这不仅是因为攻击面不断扩大，还因为设备本身易于受到攻击且资源受限。异常检测是保护物联网的关键程序。利用机器学习算法在物联网中执行异常检测是一种颇具前景的方法。然而，在文献中尚缺乏识别针对物联网的优化（就有效性和效率而言）异常检测模型的指导。为了填补这一空白，本研究深入探讨了XGBoost在物联网异常检测中的有效性与效率，并将其与已知的支持向量机（SVM）和深度卷积神经网络（DCNN）学习模型进行了比较。鉴于物联网应用的多样性和动态的物联网网络环境，确定适用于物联网的最佳异常检测模型是一项极具挑战性的任务。采用多个从不同环境收集的数据集来评估基于机器学习的异常检测模型至关重要。本研究利用了三个著名的物联网数据集，即IoT-23、NSL_KDD和TON_IoT，以基准测试上述机器学习方法。我们的结果表明，XGBoost在准确率方面优于SVM和DCNN，达到99.98%的准确率。此外，XGBoost在计算效率方面表现出色，其模型性能比SVM快717.75倍，并且在训练时间上显著快于DCNN。通过使用我们最近构建的包含物理设备的物联网测试床收集的真实世界物联网数据，进一步验证了研究结果。利用真实世界数据进行异常检测模型的评估证实，XGBoost能够高效且准确地检测现实世界物联网应用中的异常。