An optimized Deep and Active Learning oriented framework for intrusion detection in Internet of Sensor Things

Abstract

Intrusion Detection Systems (IDS) play a key role in protecting modern network infrastructures from malicious activities in the internet of sensor things domain. However, the presence of class imbalance, limited labeled data, and the need for hyperparameter tuning frequently restricts the overall effectiveness of traditional deep learning techniques. In this study, we propose an enhanced IDS framework that integrates data pre-processing, data balancing, active learning, and optimization techniques. The data preprocessing involves label encoding for converting categorical class labels of the WSN_DS dataset to a numeric form and data normalization for transforming numerical features to the same scale. Later, the data balancing utilizes the proposed oversampled balancing with minority class and borderline samples technique for handling class imbalance to reduce the risk of overfitting. Finally, a Convolutional Neural Network (CNN) serves as the base classifier, which is further improved through Margin-based Active Learning CNN (MAL-CNN), Entropy-based Active Learning CNN (EAL-CNN), and Grasshopper Optimization Algorithm CNN (GOA-CNN). Experimental results demonstrate that the proposed MAL-CNN, EAL-CNN, and GOA-CNN models significantly outperform existing ML and DL techniques with an improvement in accuracy score of 3%, 4%, 6%, and receiver operating characteristics area under the curve score of 1%, 2%, 3%. Additionally, the GOA-CNN model achieved the highest accuracy with an execution time of 1023.0 seconds, while EAL-CNN offered the fastest performance at 169.83 seconds, demonstrating a trade-off between optimization and computational efficiency. These results are extensively validated with the 10-fold cross-validation technique, and analysis of variance is used to statistically compare the performance of multiple models across various metrics, which further increases the proposed models' reliability. Our proposed models, MAL-CNN, EAL-CNN, and GOA-CNN, not only outperform traditional CNN models on smaller datasets but also demonstrate superior performance on large-scale datasets like the TON_IoT, ensuring robustness and scalability for real-world cybersecurity applications. The explainable artificial intelligence techniques, including local interpretable model-agnostic explanations and Shapley additive explanations, provide insights into complex MAL-CNN, EAL-CNN, and GOA-CNN models by explaining individual predictions and feature importance. Finally, our proposed models, MAL-CNN, EAL-CNN, and GOA-CNN, not only outperform the traditional CNN model on WSN_DS datasets but also demonstrate enhanced generalizability and robustness when tested on large-scale and diverse datasets such as TON_IoT , validating their scalability and applicability in real-world cybersecurity environments. The integration of active learning and optimization not only enhances detection accuracy but also ensures robust and scalable intrusion detection suitable for real-world security applications.

Topics & Concepts