IoT attack prediction using big Bot-IoT data
Joffrey L. Leevy, Taghi M. Khoshgoftaar, John M. Hancock · International Journal of Internet of Things and Cyber-Assurance · 2022
Bot-IoT is a recent and publicly available dataset that depicts attack traffic launched by BotNets against internet of things (IoT) networks. Normal (non-attack) traffic is represented by over 9,000 of the approximately 73,000,000 instances of big data that constitute this dataset. We present an easy-to-learn Bot-IoT approach, centred on the use of a minimum number of dataset features and a simple machine learning algorithm. Our contribution is defined by decision tree models built from derived Bot-IoT datasets with no more than three features. As per our definition of easy-to-learn, we require that predictive models have area under the receiver operating characteristic curve (AUC) mean scores greater than 0.99. According to our results, all the derived datasets produce easy-to-learn models. To the best of our knowledge, this work, in terms of its simplicity, interpretability, and performance, is an improvement over Bot-IoT classification approaches in existing literature.