PaperlayerView exact revision on arXiv

Source-linked AI summary

MLSTL-WSN: Machine Learning-based Intrusion Detection using SMOTETomek in WSNs

Md. Alamin Talukder, Selina Sharmin, Md Ashraf Uddin, Md Manowarul Islam, Sunil Aryal

arXiv:2402.13277v2cs.CRcs.LG

TL;DR

WSN intrusion detection faces imbalanced datasets and challenges including scalability, false positives, and adapting to evolving attacks. The paper combines ML with SMOTE-Tomek resampling and feature standardization; it reports 99.78% binary and 99.92% multiclass accuracy on WSN-DS.

  • Problem

    WSN intrusion detection is challenged by imbalanced datasets, scalability concerns, false positives, and evolving attack techniques.

    Source: §1 · p. 3

  • Method

    The paper combines ML classifiers with SMOTE-Tomek resampling, which synthesizes minority instances and removes Tomek links, and applies feature standardization.

    Source: §1 · pp. 3–4, §3.3 · p. 14

  • Results

    99.78% binary accuracy and 99.92% multiclass accuracy are reported for the proposed model on WSN-DS.

    Source: §4.6 · p. 29, §5 · p. 31

  • Takeaways & Limitations

    The authors conclude that their approach effectively detects intrusions in WSNs in both binary and multiclass settings.

    Source: §5 · p. 31

Abstract

from arXiv · show

Wireless Sensor Networks (WSNs) play a pivotal role as infrastructures, encompassing both stationary and mobile sensors. These sensors self-organize and establish multi-hop connections for communication, collectively sensing, gathering, processing, and transmitting data about their surroundings. Despite their significance, WSNs face rapid and detrimental attacks that can disrupt functionality. Existing intrusion detection methods for WSNs encounter challenges such as low detection rates, computational overhead, and false alarms. These issues stem from sensor node resource constraints, data redundancy, and high correlation within the network. To address these challenges, we propose an innovative intrusion detection approach that integrates Machine Learning (ML) techniques with the Synthetic Minority Oversampling Technique Tomek Link (SMOTE-TomekLink) algorithm. This blend synthesizes minority instances and eliminates Tomek links, resulting in a balanced dataset that significantly enhances detection accuracy in WSNs. Additionally, we incorporate feature scaling through standardization to render input features consistent and scalable, facilitating more precise training and detection. To counteract imbalanced WSN datasets, we employ the SMOTE-Tomek resampling technique, mitigating overfitting and underfitting issues. Our comprehensive evaluation, using the WSN Dataset (WSN-DS) containing 374,661 records, identifies the optimal model for intrusion detection in WSNs. The standout outcome of our research is the remarkable performance of our model. In binary, it achieves an accuracy rate of 99.78% and in multiclass, it attains an exceptional accuracy rate of 99.92%. These findings underscore the efficiency and superiority of our proposal in the context of WSN intrusion detection, showcasing its effectiveness in detecting and mitigating intrusions in WSNs.

1 Introduction

WSN intrusion detection must contend with imbalanced datasets and other security challenges. The paper proposes an ML-based approach combining SMOTE-Tomek resampling and feature scaling, and evaluates it against existing approaches.

1 Introduction

  • WSNs support applications including environmental monitoring, healthcare, smart cities, and industrial automation, while transmitting data that require confidentiality, integrity, and availability.The introduction describes remote, real-time data acquisition and security as important in these networks.Source: §1 · pp. 2–3
  • Imbalanced WSN data, scalability, false positives, and adaptation to evolving attacks are identified as challenges for intrusion detection.The authors state that datasets contain many normal instances but few intrusions, which can compromise detection accuracy.Source: §1 · p. 3
  • The proposed approach combines ML algorithms with SMOTE-Tomek, which synthesizes minority instances and removes Tomek links to balance the dataset.The listed algorithms include DT, RF, MLP, KNN, XGB, and LGB.Source: §1 · p. 3
  • Standardization scales input features to a consistent range, while the authors describe the resampling approach as addressing overfitting and underfitting.The paper presents scaling and resampling as elements of its approach to improve training and intrusion detection.Source: §1 · p. 4
  • The paper evaluates its model using multiple performance metrics and compares it with existing intrusion-detection approaches to identify the best-performing model.The stated metrics include accuracy, precision, recall, and F1 score.Source: §1 · p. 4
  • The paper is organized into literature review, methodology and dataset, experimental evaluation, discussion, and conclusion sections.The roadmap assigns the performance evaluation to Section 4 and the discussion to Section 4.6.Source: §1 · p. 4

2 Related Works

Prior WSN intrusion-detection studies span resampling, feature selection, classifiers, and layered or collaborative systems, with several also addressing other industrial and IoT settings.

2 Related Works

  • Applying SMOTE to oversample minority samples improved Random Forest accuracy to 92.57%; separately, [22] reports DoS-detection accuracy of 98.56% for ANN and 98.4% for KNN.Source: §2 · p. 5
  • Other cited work includes deep-learning WSN prevention [17], HMM-GMM detection [33], and autoencoder or federated IDS approaches for industrial and IoT networks [27–30].[27] reports 97.95% and 97.62% accuracy on gas-pipeline and UNSW-NB15 datasets; the related works characterize these methods as effective in their respective settings.Source: §2 · pp. 6–8
  • [24] reports 99.95% overall accuracy for an STLGBM-DDS system, while [23] reports detection rates above 99% across attack types and 46% less modeling time.[24] combines LightGBM, SMOTE-Tomek balancing, and feature selection; [23] uses SMOTE-Tomek, feature selection, and parameter optimization.Source: §2 · pp. 5–6
  • [14] reports class detection accuracies from 46% to 86% and 99% for normal traffic, while [15] reports class precision from 90.4% to 100%.[14] uses information gain ratio with an online Passive Aggressive classifier; [15] uses edge Naive Bayes and cloud Random Forest layers.Source: §2 · pp. 5–6
  • [25] reports a 97.9% detection rate and 1.8% false alarm rate for collaborative BCO-SVM detection; reports its highest class AUC at 99.99%.[18] compares XGBoost with decision trees and naive Bayes across WSN attack and normal classes.Source: §2 · p. 6
  • On WSN-DS, the proposed SLGBM achieved F-measures of 99.8% for Normal, 99.4% for Blackhole, 99.1% for Grayhole, 96.5% for Flooding, and 96.1% for Scheduling attack detections.[32] introduced RKOA-AEID, using RKOA-based feature selection and an average ensemble model, and achieved 98.94% accuracy on WSN-DS.Source: §2 · pp. 7–8

3 Methodology

The methodology combines dataset preparation and balancing with cross-validation and six classifier families to evaluate WSN intrusion detection. SMOTE-TomekLink produces nearly equal binary classes and a more equitable multiclass distribution.

3 Methodology

  • The workflow standardizes and encodes data, balances classes, uses 10-fold cross-validation, trains six classifiers, and evaluates them with accuracy, precision, recall, and F1-score.The best-performing model is selected based on results across multiple metrics.Source: §3 · pp. 8–9

3.1 Dataset Description

  • WSN-DS contains 374,661 records covering normal behavior and four DoS attacks, uses the LEACH protocol, and has 23 features.The dataset was generated using NS-2 and evaluated with the WEKA toolbox.Source: §3.1 · pp. 9, 12

3.2 Data Preprocessing

  • Preprocessing prepares the dataset for machine learning through standardization and conversion of categorical target classes into numerical labels.The workflow also uses label encoding for categorical data.Source: §3 · pp. 8–9, §3.2 · p. 12

3.2.1 Standardization

  • Standardization transforms features to mean 0 and standard deviation 1, bringing differently scaled measurements to a common scale.The paper describes this as important for algorithms using distance metrics or gradient-based optimization.Source: §3.2.1 · p. 12

3.2.2 Label Encoding

  • Label encoding converts categorical classes into numerical values for use by machine-learning algorithms.The paper applies it to binary and multiclass classification targets.Source: §3.2.2 · pp. 12–13

3.3 Data Balancing using SMOTE-TomekLink

  • SMOTE-TomekLink combines minority-class oversampling with Tomek-link removal; binary classes become nearly equal and the multiclass distribution more equitable.The binary and multiclass distributions are shown in Tables 3 and 4, respectively.Source: §3.3 · pp. 13–14, Table 3 · p. 14, Table 4 · p. 14

3.4 ML Algorithms

  • The evaluated classifiers are Decision Trees, Random Forest, MLP, KNN, XGBoost, and LightGBM.The classifiers were chosen to capture different patterns in the dataset.Source: §3.4 · pp. 15–16

4 Results and Discussion

This section evaluates WSN intrusion detection with and without SMOTETomek-Link, reports binary and multilabel results, and compares the proposal with prior WSN-DS models. It also examines computational cost, identifying Random Forest as the best-performing model in the reported experiments and a cost-effective choice based on its time complexity.

4.1 Experiment Setup

  • Experiments ran on Windows 11 Pro with an Intel Core i7-8665U, 16 GB RAM, Anaconda Navigator, Jupyter, and Python.The environment also included a 500 GB SSD and commonly used data-science and machine-learning libraries.Source: §4.1 · p. 16

4.2 Performance Evaluation Metrics

  • The evaluation metrics include confusion-matrix counts, accuracy, MAE, MSE, RMSE, and ROC curves with AUC as a measure of class separability.The passage describes AUC values closer to 1 as indicating stronger class separability.Source: §4.2 · pp. 16–17

4.3 Results Analysis

  • The experiments compared binary and multilabel intrusion detection using SMOTETomek-Link (WiSTL) and without it (WoSTL).The comparison was intended to assess the effect of data balancing on model performance.Source: §4.3 · p. 17

4.4 Binary Results Analysis

  • In binary WiSTL, Random Forest achieved 99.78% accuracy, 0.22% MAE, 0.22% MSE, 4.72% RMSE, and 99.99% AUC for WSN intrusion detection.RF recorded 33,873 true positives, 33,898 true negatives, 77 false positives, and 74 false negatives.Source: §4.4 · p. 20

4.5 Multilabel Results Analysis

  • In multilabel WiSTL, RF achieved 99.92% accuracy, precision, recall, and F1-score, while its AUC was 100%.RF’s reported true positives and true negatives were 33,840 and 136,122, with 9 false positives and 7 false negatives; WiSTL improved performance for most algorithms.Source: §4.5 · pp. 23, 24, 27, Table 7 · p. 24

4.6 Discussion

  • 99.78% binary and 99.92% multiclass accuracy are reported for the proposal; the discussion compares these with (92.57%), (97.90%), (99%), and (99.95%).The discussion attributes the proposal’s performance to SMOTE-TomekLink balancing and RF, and notes the WSN-DS dataset’s role in training and evaluation.Source: §4.6 · pp. 27, 29, 30, Table 8 · p. 29

4.7 Cost Analysis

  • The cost-analysis subsection frames time complexity in Big O notation and names DT, RF, MLP, KNN, LGB, and XGB for analysis.No algorithm-specific complexity results are included in the supplied passage.Source: §4.7 · p. 30
  • RF is reported to have lower time complexity than the other considered ML models, at O(t · n · m · log(m)), making it a cost-effective computational choice.The analysis gives the complexities O(n · m · log(m)) for DT, O(w · e · n) for MLP, O(n · m) for KNN training, O(t · n · m) for LGB, and generally O(t · d) for XGB; RF comprises multiple decision trees.Source: §4.7 · pp. 30–31, Table 9 · p. 31

5 Conclusion

The conclusion presents an intrusion-detection model combining machine learning, SMOTE-TomekLink resampling, and standardization, reports binary and multiclass accuracy, and notes computational and data-related limitations.

5 Conclusion

  • 99.78% binary accuracy and 99.92% multiclass accuracy are reported for the proposed model.The conclusion describes these results as evidence of the model’s effectiveness in WSN intrusion detection.Source: §5 · p. 31
  • The model combines machine learning with SMOTE-TomekLink resampling, synthesizing minority instances and removing Tomek links to balance WSN datasets.The conclusion also notes that standardization scales input features.Source: §5 · p. 31
  • Resampling and feature scaling add computational cost because the study did not use feature selection to reduce complexity.The conclusion also says performance may depend on hyperparameter choice and training-data quality.Source: §5 · p. 31
  • Future research directions include hybrid feature selection, fine-tuned deep-learning models for IDS, and hierarchical approaches in WSNs.Source: §5 · p. 31
Loading 2402.13277v2…