# IoTGeM: Generalizable Models for Behaviour-Based IoT Attack Detection

arXiv: https://arxiv.org/abs/2401.01343 · HTML: https://mlsanity.com/paper/2401.01343/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 12 of its 111 references that are in the map.
- First posted on arXiv 17 Oct 2023.

## Builds on (most cited first, 12 of 12)

- [A Unified Approach to Interpreting Model Predictions](https://mlsanity.com/paper/1705.07874/) (2017)
- [Tabular Data: Deep Learning is Not All You Need](https://mlsanity.com/paper/2106.03253/) (2021)
- [Kitsune: An Ensemble of Autoencoders for Online Network Intrusion Detection](https://mlsanity.com/paper/1802.09089/) (2018)
- [Dos and Don'ts of Machine Learning in Computer Security](https://mlsanity.com/paper/2010.09470/) (2020)
- [Towards the Development of Realistic Botnet Dataset in the Internet of Things for Network Forensic Analytics: Bot-IoT Dataset](https://mlsanity.com/paper/1811.00701/) (2018)
- [How Complex is your classification problem? A survey on measuring classification complexity](https://mlsanity.com/paper/1808.03591/) (2018)
- [Machine Learning Based Network Vulnerability Analysis of Industrial Internet of Things](https://mlsanity.com/paper/1911.05771/) (2019)
- [Towards Adversarial Realism and Robust Learning for IoT Intrusion Detection and Classification](https://mlsanity.com/paper/2301.13122/) (2023)
- [An Experimental Analysis of Attack Classification Using Machine Learning in IoT Networks](https://mlsanity.com/paper/2101.12270/) (2021)
- [Feature Extraction for Machine Learning-based Intrusion Detection in IoT Networks](https://mlsanity.com/paper/2108.12722/) (2021)
- [IoTDevID: A Behavior-Based Device Identification Method for the IoT](https://mlsanity.com/paper/2102.08866/) (2021)
- [Machine Learning Based Intrusion Detection Systems for IoT Applications](https://mlsanity.com/paper/2302.12452/) (2023)

## Built on by (most cited first, 1 of 1)

- [Individual Packet Features are a Risk to Model Generalisation in ML-Based Intrusion Detection](https://mlsanity.com/paper/2406.07578/) (2024)

## Abstract (arXiv)

Previous research on behavior-based attack detection for networks of IoT devices has resulted in machine learning models whose ability to adapt to unseen data is limited and often not demonstrated. This paper presents IoTGeM, an approach for modeling IoT network attacks that focuses on generalizability, yet also leads to better detection and performance. We first introduce an improved rolling window approach for feature extraction. To reduce overfitting, we then apply a multi-step feature selection process where a Genetic Algorithm (GA) is uniquely guided by exogenous feedback from a separate, independent dataset. To prevent common data leaks that have limited previous models, we build and test our models using strictly isolated train and test datasets. The resulting models are rigorously evaluated using a diverse portfolio of machine learning algorithms and datasets. Our window-based models demonstrate superior generalization compared to traditional flow-based models, particularly when tested on unseen datasets. On these stringent, cross-dataset tests, IoTGeM achieves F1 scores of 99% for ACK, HTTP, SYN, MHD, and PS attacks, as well as a 94% F1 score for UDP attacks. Finally, we build confidence in the models by using the SHAP (SHapley Additive exPlanations) explainable AI technique, allowing us to identify the specific features that underlie the accurate detection of attacks.