An Effective IoT Attack Detection System With A Symmetrical Uncertainty Factor and Random Forest

Abstract

The rapid expansion of the Internet of Things (IoT) ecosystem has exposed critical security flaws, primarily because the high-dimensional, heavily imbalanced characteristics of IoT network traffic severely compromise existing intrusion detection systems (IDSs). A major limitation in current research is the decoupling of feature selection and classification, which leads to feature redundancy, high computational demands, and less-than-optimal detection rates. To overcome this limitation, we introduce an enhanced IoT attack detection architecture that seamlessly couples the Symmetrical Uncertainty (SU) filter for feature selection with the Random Forest (RF) classifier. Using the extensive CICIoT2023 dataset, which comprises benign traffic and 33 unique attack types, SU was applied to systematically filter out redundant attributes. Empirical evaluations reveal that the integrated SU-RF model, operating on a highly reduced subset of just 15 features (a 68% dimensionality reduction), attains exceptional full-set validation metrics: 99.997% accuracy, 99.996% precision, 99.995% recall, and a 99.995% F1-score. The model's generalization and robustness are further validated through 5-fold and 10-fold cross-validation, which consistently maintained accuracy exceeding 99.35%. When benchmarked against recent state-of-the-art approaches, such as the work by Gheni et al., the proposed framework achieves a 0.55% accuracy improvement while using 53% fewer features, significantly reducing computational costs. Ultimately, this study delivers a highly scalable, computationally lightweight, and robust IDS tailored specifically for the constraints of IoT environments.