Application of Traditional Machine Learning Models to Detect Abnormal Traffic in the Internet of Things Networks

Abstract

The relevance of solving the problem of choosing machine learning models for detecting anomalies in network traffic of the Internet of Things is associated with the need to analyze a large number of security events to identify abnormal behavior of smart devices. The aim of the research was to investigate machine learning models for detecting anomalies in IoT network traffic. A comparative analysis of machine learning models was carried out and recommendations for their use for detecting anomalies in the Internet of Things network traffic were provided. Naive Bayes, Support Vector Machine, Logistic Regression, K-nearest neighbors, Boosting and Random Forest were considered as basic machine learning models. Anomaly detection efficiency indicators were the following metrics: accuracy, precision, recall and F score, as well as the time spent on training the model. As a result of the study, it was found that the preparation of traditional machine learning models takes a little time, since it does not require more resources and computing power. The machine learning models built during the experiment demonstrated high accuracy rates for detecting anomalies in large heterogeneous traffic typical of the Internet of Things. The distinctive features of the research were both conducting an experiment on a single software and hardware and using the same data-set and taking into account the estimate of the time spent on training the model, in addition to the accuracy, precision, recall and F score of anomaly detection efficiency. Practical significance is that the results obtained in the research can be used to build systems for detecting network anomalies in the Internet of Things.