Nidhi -

Dhruv -
Samaksh -

1. Best Cybersecurity Practices, Bot IoT Anomaly Detection, By Dhruv M, Sunidhi M,

Samaksh B,
2. IoT devices are one of the most used devices of 2024. But What exactly are IoT
Devices? Well first, IoT stands for Internet of Things and they are physical objects that
can connect and exchange data with other devices over a wireless network connection;
they include kitchen appliances, sensors, home security systems, and more.
Unfortunately, IoT devices are not equipped with protective security features, making it
easy for hackers to launch cyberattacks. These attacks can be very harmful having the
potential to Crash Networks, lead to Personal Information Loss, and lead to financial
loss.
3. According to Anna Marton, an expert in the department of IoT devices, “IoT malware
globally was up by 37%, resulting in a total of 77.9 million attacks, compared to 57
million attacks in the first six months of 2022.”
4. Looking at all of this led us to create a research question: How effective would an AI
model be in classifying the type of cybersecurity attacks in IoT devices?
5. As seen before, the number of cyberattacks on IoT devices is increasing rapidly. To
tackle this issue, me and my team decided to set an objective. We wanted to Develop an
AI model to classify anomalies using the Bot IoT dataset. Classifying Bot IoT attacks
would allow people to improve their incident response and detection systems, ultimately
preventing future occurrences.
6. The Bot-IoT dataset, sourced from The University of New South Wales (UNSW),
contains a comprehensive set of files with IoT network traffic data. The dataset has 47
features and around 5,000,000 different examples of IoT devices. The dataset was
preprocessed using label encoding for non-numerical features and handling of missing
data points.
7. We performed our EDA on the dataset by using Google Colab and many of the modules
provided in Python, including pandas, SKlearn, numpy, seaborn, and matplotlib. As you
can see in this graph, the DOS and DDoS attacks are the most prevalent throughout the
dataset. The Reconnaissance column is much smaller and Normal and Theft are not
present in the bar graph, which is why they were omitted in our model. The correlation
matrix shown here is a heatmap, which illustrates the correlation between the different
features. Columns that had high correlation were removed due to not needing them as
another column represents similar data. The max and mean columns had a high
correlation, so we decided to remove the max column from the data. This would save
training and testing time while not hindering the results.
8. After performing Exploratory Data Analysis on the dataset and studying the graphs, we
processed the data and omitted certain columns. We then used the data to choose the
most suitable classifier for our AI model. Since the Bot-IoT dataset contains a large
volume of high-dimensional data, we had to use a more complex model alongside the
Logistic Regression model.
9. Models Evaluated
We decided to evaluate 2 AI algorithms to see which one would produce the best results.
The two models were called decision tree and logistic regression.
Let's start with logistic regression. This is a linear model meaning it tries to find a
correlation between different data points. It can only find linear, which is direct of
inversely proportional relationships leading it not to be the best algorithm for more
complex data. If complex data with non-linear relationships occur this model will not be fit
for handling it. This model goes through the test row, checks each parameter, and gives
the overall row a rating for each of the 3 categories (Ddos, dos, reconnaissance. If that
rating is higher than the specified rating, in this case, 0.33, then it will categorize that row
as the category that is being tested. This is a supervised learning model, meaning it uses
labeled datasets to train. Due to the uncomplex nature of this model, it does not take
much time. This is one of the quickest AI training models
because it does not run through features multiple times.
10. Next, we have the Decision Tree model. This AI algorithm contrasts with the logistics
regression due to it being non-linear. This model creates a tree for each row, by
answering simple yes or no questions for each test row. Then after creating a tree for
each test row, it tries to match the tree to the previously trained trees and figures out
which matches the best. This is how it classifies each test case. This also gives it the
ability to find non-linear correlations. This gives it a higher accuracy, as it can find more
precise correlations. However, due to the nature of creating a tree for each test row. It is
time-consuming, leading it not to be used in cases where you need a quick result.
11. Now, we will see how the models performed with different metrics and choose which
model we would like to implement in the real world.
12. These are the confusion matrix for each of the models. The numbers on the top-left to
bottom right diagonal are the times our model predicted correctly. We tested each of the
models on 1.3 million data points. The logistic regression ran in 50 seconds while the
decision tree ran in 8 minutes. As you can see on the confusion matrix, the logistic
regression has more errors than the decision tree, especially in the 1,2 rows and
columns which were Ddos and Dos attacks.
13. These are our f1 score, recall, accuracy and precision for each of the models. As you
can see, generally the logistic regression performed significantly worse than the decision
tree. Our main focus of interest in the f1 score. This is a balance of the decision and the
recall of the model, both of which are important in multi classification problems. It is great
in providing an overall result of the model. In the results, the decision tree has an 0.007
better than the logistic regression. Meaning it performed better overall.
14. So our pick for the model to implement in the real world is the decision tree model. This
is because accuracy is extremely important when dealing with cybersecurity. Data
breaches and other forms of information could be breached if an incorrect prediction
happens from this model. This makes accuracy extremely important because knowing
which type of attack is happening will lead to different types of solutions to the problem.
15. So when we look back at our research question asking: How effective would an AI
model be in classifying the type of cybersecurity attacks in IoT devices? We can
confidently answer that question by saying an AI model would be extremely effective. It
would provide comfort and security to all IoT device users. Ultimately, this model would
create a positive impact on the world and prevent many cyberattacks from taking place.