Recurrent Neural Network-Based Intrusion Detection for IoT Networks: Host-Temporal Sequence Modelling, Attention-Based Bidirectional GRUs and a Statistically Rigorous Comparison

Abstract

Intrusion detection is a crucial need of the hour for Internet of Things (IoT) networks. Several Machine Learning models are applied for this task. Recurrent neural networks (RNNs) are also popular in this list to try and look for intrusion in IoT networks.This article proposes Att-BiGRU- Attention-based bidirectional gated recurrent unit based on the principles of Recurrent Neural Networks (RNN). IoTID20 dataset is used for analysis. Five bench mark baseline models were used for comparing the performance of this work, they are, ten recurrent, convolutional, feed-forward, tree-based and linear models. Extensive statistical analysis is also performed using Friedman, Nemenyi critical differences, Holm-corrected Wilcoxon signed-rank tests. By gradually extending the flows, the macro-F1 of proposed system increases from 0.7445 to 0.9586.. When the flow is five, the score was 0.7445 and when the flows are increased to 20, the score is increased to 0.9586. Usually, the recurrent modelsaccuracy increases as the window grows, while the window size also needs to be optimized. Apart from F1(macro), the other metrics used for performance analysis are F1(weighted), MCC Cohen’s K, Precision (macro), Recall (mcro), AUC (macro), DR and FAR. This paper concludes with the host-temporal window formulation has worked effectively even at 10 flows, and the performance metrics shown better results than the base line models. Unlike the windowed Random Forest, this method improve the performance as the window size grows.