A Hybrid Machine-Learning Based Security Algorithm for Improved Detection of Distributed-Denial-of-Services Attacks in Internet of Things Networks

Technical Summary: A Hybrid Machine-Learning Based Security Algorithm for Improved Detection of Distributed-Denial-of-Services Attacks in Internet of Things Networks

Problem Statement
The rapid proliferation of Internet of Things (IoT) devices has significantly expanded the attack surface for cyber threats, particularly Distributed Denial of Service (DDoS) attacks. While IoT enables intelligent systems across sectors like agriculture, healthcare, and smart infrastructure, its inherent characteristics—resource-constrained devices, heterogeneous protocols, and open wireless channels—make it highly vulnerable. Existing machine learning (ML) and deep learning (DL) approaches for Intrusion Detection Systems (IDS), such as Decision Trees, Support Vector Machines (SVM), and standalone K-Nearest Neighbors (KNN), often suffer from suboptimal classification accuracy, high response latency, and poor adaptability to evolving, zero-day, and dynamic traffic patterns. Furthermore, many current models struggle with high false positive rates and fail to generalize effectively under noisy data conditions or class imbalances common in real-world IoT environments.

Methodology
To address these limitations, the authors propose a hybrid Machine Learning-Based Security (MLBS) framework that integrates K-Nearest Neighbors (KNN) and Recurrent Neural Networks (RNN). The system architecture is designed for IoT Wireless Sensor Networks (WSN), where an Edge node acts as a gateway to aggregate data and monitor traffic for anomalies.

The proposed MLBS algorithm operates through a sequential pipeline:

1. Feature Pre-processing: The study utilizes the TON-IoT dataset. Data cleaning removes missing values and duplicates, reducing attributes from over 80 to 70. Principal Component Analysis (PCA) and Pearson's correlation are then applied to reduce dimensionality, selecting 19 highly relevant features (e.g., packet counts, flow duration, header lengths) to minimize computational complexity and remove redundancy.
2. Hybrid Integration:
   • KNN Component: Acts as an instance-based learning layer. It calculates Euclidean distances between incoming traffic instances and training samples to identify similarities with known attack patterns. It serves as a feature enhancement layer, providing distance-based results and class labels.
   • RNN Component: Processes the output of the KNN layer combined with original traffic features. Leveraging its recurrent connections, the RNN captures temporal dependencies and sequential behaviors in network traffic, analyzing how traffic evolves over time. This allows the model to detect time-dependent attack patterns that static models might miss.
3. Training and Validation: The model was implemented in the MATLAB R2025a environment. The dataset was split into 70% for training and 30% for testing. A 5-fold cross-validation strategy was employed to ensure reliability. The model was trained using back-propagation with categorical cross-entropy loss and optimized with dropout and batch normalization.

Key Contributions
The paper outlines four primary contributions:

1. Novel Hybrid Framework: The introduction of an MLBS framework that synergizes the instance-based classification strength of KNN with the temporal learning capability of RNN to detect both known and zero-day DDoS attacks.
2. Adaptive Detection Mechanism: Development of a mechanism designed to mitigate misclassification, high false positive rates, and poor generalization, specifically addressing challenges posed by noisy and imbalanced data.
3. Comprehensive Validation: Extensive experimental validation demonstrating the model's superiority over conventional baselines (KNN, RNN, Random Forest, SVM, and LSTM) across multiple performance metrics.
4. Robustness Demonstration: Evidence that the model maintains stable performance under challenging scenarios, including noisy data and previously unseen attack patterns, suggesting suitability for real-world deployment.

Results
The proposed MLBS algorithm was evaluated against baseline models using the TON-IoT dataset, with performance metrics averaged over 10 independent simulation runs. The results indicate that the hybrid model outperforms all individual baseline algorithms:

• Accuracy: The MLBS model achieved 98.72%, surpassing LSTM (97.56%), Random Forest (96.67%), RNN (95.67%), KNN (94.17%), and SVM (93.46%).
• Precision: The model reached 97.95%, indicating a low rate of false positives compared to baselines like KNN (93.05%) and SVM (92.65%).
• Recall: The model achieved 98.94%, demonstrating a superior ability to detect actual DDoS attacks and minimize false negatives compared to KNN (92.67%) and SVM (91.78%).
• F1-Score: The balanced performance metric was 98.39%, confirming the model's effectiveness in balancing precision and recall.
• AUC and ROC: The MLBS model achieved an Area Under the Curve (AUC) score of 0.999, outperforming all baselines.
• Statistical Significance: Paired t-tests on the cross-validation results confirmed the statistical significance of the improvements (e.g., p-value = 0.004 for accuracy).

Significance and Claims
The authors claim that the significance of this work lies in providing a scalable, adaptive, and high-precision intrusion detection solution. By combining KNN's ability to handle local data similarity with RNN's capacity to model sequential temporal dependencies, the framework addresses the specific limitations of single-model approaches in dynamic IoT environments. The paper asserts that this hybrid approach enhances the resilience of IoT networks against both known and emerging DDoS threats.

However, the authors maintain a modest stance regarding practical deployment. They acknowledge that the study is currently limited to a simulation-based evaluation using the TON-IoT dataset. They explicitly state that the reliance on a specific dataset with predefined attacks and a controlled environment may limit generalizability to the full complexity of real-world IoT networks. Consequently, the paper concludes that while the results are promising, future work must focus on validating the framework in live network environments, optimizing computational efficiency for resource-constrained devices, and testing against a broader range of multi-vector and adaptive cyber threats.