Optimizing intrusion detection with data balancing and feature selection techniques

Abstract

The rapid growth of IoT devices has brought significant security challenges, particularly in detecting various types of attacks within heterogeneous network environments. This study explores the effectiveness of data balancing techniques, including Random Undersampling (RUS), Cost-Sensitive Learning (CSL), Synthetic Minority Oversampling Technique (SMOTE), and Randomized Combination Sampling (RCS). Feature selection methods, namely correlation (threshold 0.8) and mutual information (top 15 features), were employed to optimize feature sets. The Decision Tree (DT) and Linear Discriminant Analysis (LDA) classifiers were used to evaluate the performance of balanced datasets. The evaluation metrics included accuracy, precision, recall, F1-score, G-mean, and ROC curves. The results revealed that SMOTE and RCS outperformed other balancing methods, with SMOTE achieving the highest accuracy (98.7%) and RCS demonstrating robust G-mean values across both feature selection techniques. DT consistently showed better performance compared to LDA across all metrics, while feature selection significantly improved the classification results, particularly under mutual information criteria. However, the analysis highlighted limitations of LDA in handling imbalanced datasets and high-dimensional features. This study concludes that a combination of advanced data balancing and effective feature selection significantly enhances the accuracy of intrusion detection in IoT networks. Future work will focus on integrating real-time detection systems and exploring hybrid models to further improve the detection of complex attacks in dynamic IoT environments.