Network intrusion detection using ensemble weighted voting classifier based honeypot framework

Abstract

The Internet of Things (IoT) is a new model that connects physical objects and the Internet and has become one of the most important technological developments in computing. It is estimated that by 2022, one trillion physical objects will be connected to the Internet. The poor accessibility and lack of interoperability of many of these devices in a vast heterogeneous landscape make it difficult to design specific security measures and implement specific defences mechanism in addition, IoT networks are still open and vulnerable to network disruption attacks. Therefore, there is a need for additional security tools related to IoT. Intrusion Detection System could serve this purpose. Intrusion detection is the process of monitoring and analyzing network traffic in order to detect potential security breaches and unauthorized access to a IOT network. It involves the use of various technologies and techniques to identify and respond to potential threats in real-time. Network intrusion detection helps organizations protect their valuable assets, including sensitive data, intellectual property, and financial resources, from cyberattacks. By detecting and responding to potential security breaches in a timely manner, network intrusion detection systems can help organizations prevent or mitigate the impact of security incidents, minimize downtime and financial losses, and maintain the integrity of their operations and reputation. Weighted soft voting is a technique used in network intrusion detection to improve the accuracy and reliability of the detection process. It involves combining the results of multiple intrusion detection systems (IDS) based on decision tree, random forest and XGBoost using a weighted approach that assigns different levels of importance to each system based on its performance and reliability. The basic idea behind weighted soft voting is to give more weight to the predictions of IDS that have higher accuracy and lower false positive rates, and less weight to those that have lower accuracy and higher false positive rates. The proposed approach can help reduce the impact of false alarms and increase the sensitivity and specificity of the intrusion detection process.