Evaluation of SMOTE-ENN+SFMI+PCA (in %).

Internet of things (IoT) facilitates a variety of heterogeneous devices to be enabled with network connectivity via various network architectures to gather and exchange real-time information. On the other hand, the rise of IoT creates Distributed Denial of Services (DDoS) like security threats. The recent advancement of Software Defined-Internet of Things (SDIoT) architecture can provide better security solutions compared to the conventional networking approaches. Moreover, limited computing resources and heterogeneous network protocols are major challenges in the SDIoT ecosystem. Given these circumstances, it is essential to design a low-cost DDoS attack classifier. The current study aims to employ an improved feature selection (FS) technique which determines the most relevant features that can improve the detection rate and reduce the training time. At first, to overcome the data imbalance problem, Edited Nearest Neighbor-based Synthetic Minority Oversampling (SMOTE-ENN) was exploited. The study proposes SFMI, an FS method that combines Sequential Feature Selection (SFE) and Mutual Information (MI) techniques. The top k common features were extracted from the nominated features based on SFE and MI. Further, Principal component analysis (PCA) is employed to address multicollinearity issues in the dataset. Comprehensive experiments have been conducted on two benchmark datasets such as the KDDCup99, CIC IoT-2023 datasets. For classification purposes, Decision Tree, K-Nearest Neighbor, Gaussian Naive Bayes, Random Forest (RF), and Multilayer Perceptron classifiers were employed. The experimental results quantitatively demonstrate that the proposed SMOTE-ENN+SFMI+PCA with RF classifier achieves 99.97% accuracy and 99.39% precision with 10 features.

物联网（Internet of Things，IoT）依托多样网络架构，为各类异构设备赋予网络连接能力，使其能够采集并交换实时信息。另一方面，物联网的普及也催生了分布式拒绝服务（Distributed Denial of Services，DDoS）等安全威胁。相较于传统组网方案，近年来兴起的软件定义物联网（Software Defined-Internet of Things，SDIoT）架构能够提供更优异的安全解决方案。此外，计算资源有限与异构网络协议并存，是SDIoT生态系统面临的核心挑战。在此背景下，设计一款低成本DDoS攻击分类器实属必要。本研究拟采用一种改进的特征选择（Feature Selection，FS）方法，筛选出最具相关性的特征，以提升攻击检测率并缩短训练时长。首先，为解决数据不平衡问题，本研究采用了基于编辑最近邻的合成少数类过采样（Synthetic Minority Oversampling Technique-Edited Nearest Neighbor，SMOTE-ENN）方法。本研究提出了一种融合序列特征选择（Sequential Feature Selection，SFE）与互信息（Mutual Information，MI）的特征选择方法SFMI，基于SFE与MI方法从预选特征中提取出Top-K公共特征。进一步采用主成分分析（Principal Component Analysis，PCA）以解决数据集中的多重共线性问题。本研究在KDDCup99、CIC IoT-2023两款基准数据集上开展了全面的对比实验。分类环节采用了决策树、K近邻、高斯朴素贝叶斯、随机森林（Random Forest，RF）以及多层感知器共五种分类器。实验结果定量验证表明，所提SMOTE-ENN+SFMI+PCA结合RF分类器的方案，在仅使用10个特征的情况下，即可达到99.97%的准确率与99.39%的精确率。