A Mutual Information-Driven Hybrid 1D-CNN and XGBoost Framework for Network Intrusion Detection in IoT

There are a growing number of Internet of Things (IoT) interconnected systems in critical infrastructures that have made these systems vulnerable to increasingly advanced and diverse cyberattacks. However, typical intrusions systems face serious obstacles in operation due to the high dimensional telemetry data, inadequately extracting those non-linear structural patterns, and the inherent class imbalance in network traffic. To overcome these drawbacks, this paper presents an intelligent hybrid model based on Mutual Information (MI), One-Dimensional Convolutional Neural Network (1D-CNN) and eXtreme Gradient Boosting (XGBoost). First, redundant features are removed from the proposed pipeline by using an MI metric and the most discriminative flow attributes are selected by using an elbow heuristic. Later, an optimized 1D-CNN feature extractor is used to obtain non-linear representations, which are mapped to a compact deep feature manifold. Finally, a gradient boosted decision tree (GBDT) classifier is adapted to minimize the class imbalance and achieved a good separation between the benign and malicious flows. The proposed framework achieved an overall accuracy of 98.91%, an Area under the ROC Curve (AUC) of 0.9986, an intrusion class precision of 99.35%, an intrusion class recall of 99.27%, and an F1F_1-score of 99.31% by doing extensive empirical evaluations on the latest ToN-IoT benchmark dataset containing 37,979 independent test flow instances. Comparative analysis validates the effectiveness and reliability of this framework with the basic machine learning and deep learning approaches, giving a proper balance between discrimination and avoiding the majority class bias.