Intrusion Detection in Industrial IoT Networks using NetFlow and Machine Learning Techniques on the NF-ToN-IoT-v2 Dataset.
The massive expansion of industrial IoT networks introduces new and significant security challenges. the class of bad hack attacks that requires real-time detection and only traditional intrusion detection systems cannot perform this task due to their inadequacy in handling very large amounts of dat...
| Publicado en: | Journal of Basrah Researches (Sciences) Vol. 52; no. 1; pp. 110 - 123 |
|---|---|
| Autor principal: | |
| Formato: | Artículo |
| Publicado: |
Republic of Iraq Ministry of Higher Education & Scientific Research (MOHESR)
2026
|
| Materias: | |
| Acceso en línea: | Ver este registro en EBSCOhost |
| fields | @attributes: recordID: 1 pdfLink: plink: https://search.ebscohost.com/login.aspx?direct=true&db=hlh&AN=195078481&site=ehost-live header: @attributes: shortDbName: hlh uiTerm: 195078481 longDbName: Humanities International Complete uiTag: AN controlInfo: bkinfo: jinfo: jid: 18172695 GYGY jtl: Journal of Basrah Researches (Sciences) issn: 18172695 maglogo: N pubinfo: dt: 2026 vid: 52 iid: 1 pid: 25427 pub: Republic of Iraq Ministry of Higher Education & Scientific Research (MOHESR) artinfo: ui: 195078481 10.56714/bjrs.52.1.9 ppf: 110 ppct: 13 formats: tig: atl: Intrusion Detection in Industrial IoT Networks using NetFlow and Machine Learning Techniques on the NF-ToN-IoT-v2 Dataset. aug: au: Almusawy, Buraq N. affil: Center of Information Technology Research and Development, University of Kufa, Najaf, Iraq. su: Intrusion detection systems (Computer security) Machine learning Random forest algorithms Cyber physical systems Computer network traffic sug: subj: Intrusion detection systems (Computer security) Machine learning Random forest algorithms Cyber physical systems Computer network traffic keyword: Industrial Internet Of Things (Iiot) Intrusion Detection System (IDS) Machine Learning Netflow NF-Ton-Iot-V2 Dataset Random Forest SMOTE إنترنت الأشياء الصناعية (IIoT) التعلم الآلي الغابة العشوائية مجموعة بيانات NF TON-IoT-v2 نظام كشف التسلل (IDS) ab: The massive expansion of industrial IoT networks introduces new and significant security challenges. the class of bad hack attacks that requires real-time detection and only traditional intrusion detection systems cannot perform this task due to their inadequacy in handling very large amounts of data, primarily for complete and useful analysis. In addition, there is a very serious classimbalance problem: there are so many normal traffic outnumbering anomaly traffic (even if enough attack samples exist, it is hard to train). In this paper, we propose an improved NetFlow based intrusion detection framework where class imbalance is one individual heterogeneous in the NetFlow data of common traffic is normal. Suppose that a machine learning evaluation would result in low, moderate or high ambiguity results between negative and positive samples. If we could develop better preprocessing tools followed by more extensive machine learning evaluation something like this may be possible. We show that this framework generalizes all BDPs for (at least) the readers who are not interested in more technical details. This approach uses a state of the art NetFlow-based data set (NF-ToN-IoT-v2) for training instances that are deliberately designed to encompass a broad range of IIoT attack types. The main steps of the proposed work are: (1) Hard Preprocessing Log1p transformation for normalization and StandardScaler feature scaling; (2) SMOTE over-Sampling due to high-class imbalance only ~1% original dataset samples are attacks; (3) Random Forest, K-Nearest Neighbors (KNN), Multi-Layer Perceptron evaluation. All pretreatment steps were then applied after splitting the data types. This was to avoid data leakage and therefore obtain a better estimate of performance. All models performed better with SMOTE preprocessing. It can be noted from the tests that compared to the imbalanced baseline used as a test case attack led to an AUC-ROC relative increase of ~13–28% and an attack recall by approximately 300%. Random Forest performed best for all classifiers. AUC-ROC (0.950) and Matthews Correlation Coefficient (MCC) (0.778) offer a balance between detection speed and accuracy. Additionally, MLP (AUC-ROC = 0.949 and MCC = 784) was competitive for being both speedy and powerful, while KNN still has its nature of not being very speedy, as while 99.7% of the summation traffic was in good taste but only 76.5% was for the attacks. Among the features chosen for relevance to our models, we observed that those which had a long-time relationship (dur) and included various types (proto) of protocols that were used by packets and their mean size did provide over 83%. pubtype: Academic Journal doctype: Article src: R language: English refInfo: copyright: @attributes: flag: Y dt: @attributes: year: 2026 holdings: @attributes: islocal: N |
|---|