Cascading Bagging and Boosting Ensemble Methods for Intrusion Detection in Cyber‐Physical Systems
Ram Ji, Arvind Selwal, Neerendra Kumar, Devanand Padha
Abstract
ABSTRACT An ensemble‐inspired intrusion detection approach for cyber‐physical systems (CPSs) has been proposed. CPSs are susceptible to different cyber‐attacks. Attacks on CPSs result in the hindrance of critical services made available by them. To protect CPSs various intrusion detection systems (IDSs) exist. However, present IDSs have limitations of constrained detection accuracy, high false alarm rate, and latency. A hybrid intrusion detection approach for CPSs that integrates the pros of bagging and boosting methods has been proposed to minimize the mentioned limitations. The proposed approach uses AdaBoost and random forest (RF) algorithms as base models. Optimal features most indicative of attack behavior are selected based on the aggregated significant scores of each feature calculated using the base models. The base models are retrained using the selected features. The final selection of features is predicted by adopting the majority vote technique. The proposed method is implemented on the CIC‐IoT‐2023 dataset for multiclassification of intrusions. Thereby selecting only the best‐exclusive number of features for intrusion detection, the proposed approach gives better results like accuracy (98.27%), precision (0.98), recall (0.98), F1‐score (0.98), average false positive rate (FPR) (0.0006), and testing time (0.1563s). By conducting extensive experiments, it has been observed that selecting the best 21 out of 46 features aids in minimizing the space and time complexities of the proposed approach. The proposed approach performs better than the existing state‐of‐the‐art approaches available in the literature regarding FPR and testing time.