In recent years, many methods for intrusion detection systems (IDS) have been designed and developed in the research community, which have achieved a perfect detection rate using IDS datasets. Deep neural networks (DNNs) are representative examples applied widely in IDS. However, DNN models are becoming increasingly complex in model architectures with high resource computing in hardware requirements. In addition, it is difficult for humans to obtain explanations behind the decisions made by these DNN models using large IoT-based IDS datasets. Many proposed IDS methods have not been applied in practical deployments, because of the lack of explanation given to cybersecurity experts, to support them in terms of optimizing their decisions according to the judgments of the IDS models. This paper aims to enhance the attack detection performance of IDS with big IoT-based IDS datasets as well as provide explanations of machine learning (ML) model predictions. The proposed ML-based IDS method is based on the ensemble trees approach, including decision tree (DT) and random forest (RF) classifiers which do not require high computing resources for training models. In addition, two big datasets are used for the experimental evaluation of the proposed method, NF-BoT-IoT-v2, and NF-ToN-IoT-v2 (new versions of the original BoT-IoT and ToN-IoT datasets), through the feature set of the net flow meter. In addition, the IoTDS20 dataset is used for experiments. Furthermore, the SHapley additive exPlanations (SHAP) is applied to the eXplainable AI (XAI) methodology to explain and interpret the classification decisions of DT and RF models; this is not only effective in interpreting the final decision of the ensemble tree approach but also supports cybersecurity experts in quickly optimizing and evaluating the correctness of their judgments based on the explanations of the results.

The Industrial Internet of Things (IIoT) has advanced digital technology and the fastest interconnection, which creates opportunities to substantially grow industrial businesses today. Although IIoT provides promising opportunities for growth, the massive sensor IoT data collected are easily attacked by cyber criminals. Hence, IIoT requires different high security levels to protect the network. An Intrusion Detection System (IDS) is one of the crucial security solutions, which aims to detect the network’s abnormal behavior and monitor safe network traffic to avoid attacks. In particular, the effectiveness of the Machine Learning (ML)-based IDS approach to building a secure IDS application is attracting the security research community in both the general cyber network and the specific IIoT network. However, most available IIoT datasets contain multiclass output data with imbalanced distributions. This is the main reason for the reduction in the detection accuracy of attacks of the ML-based IDS model. This research proposes an IDS for IIoT imbalanced datasets by applying the eXtremely Gradient Boosting (XGBoost) model to overcome this issue. Two modern IIoT imbalanced datasets were used to assess our proposed method’s effectiveness and robustness, X-IIoTDS and TON_IoT. The XGBoost model achieved excellent attack detection with F1 scores of 99.9% and 99.87% on the two datasets. This result demonstrated that the proposed approach improved the detection attack performance in imbalanced multiclass IIoT datasets and was superior to existing IDS frameworks.

Load identification is a core concept in non-intrusive load monitoring (NILM). Through NILM systems, users can check their home appliance usage habits and then adjust their behavior to save electricity. In this way, a NILM system offers an effective method to detect the event status of household appliances as well as individual loads' energy consumption. However, prior NILM methods have encountered a challenge in improving recognition accuracy for both linear load and non-linear load types. These methods used a representative feature, namely transient load signals. However, the transient signals on these loads differ in terms of transient time and transient shape, which is the main cause of reduced accuracy performance in load identification. To this end, this paper presents a novel method, HT-LSTM (Hilbert Transform Long Short-Term Memory), which enhances recognition of the various load types that contain the difference in the transient time and the transient shape of any load signal. The proposed method consists of two main parts: (i) generating a novel transient feature based on a Hilbert transform (HT), called APF (Amplitude-Phase-Frequency). APF features are sequential data, which is used for the classification model; and (ii) applying Sequence-to-Sequence Long Short-Term Memory (Seq2Seq LSTM) to identify appliances by using APF features as the input data. In this work, we evaluate the HT-LSTM method using two high-frequency public datasets, Building-Level fUlly-labeled dataset for Electricity Disaggregation (BLUED) and Plug Load Appliance Identification Dataset (PLAID). Also, we evaluate our method using a private dataset collected in the lab. Based on the experimental results obtained and comparison classification performance pointed, the proposed method outperforms previous methods of F-score measurement on both public datasets in load identification as well as the private dataset.

The recent increase in hacks and computer network attacks around the world has intensified the need to develop better intrusion detection and prevention systems. The intrusion detection system (IDS) plays a vital role in detecting anomalies and attacks on the network which have become larger and more pervasive in nature. However, most anomaly-based intrusion detection systems are plagued by high false positives. Furthermore, Remote-to-Local (R2L) and User-to-Root (U2R) are two kinds of attack which have low predicted accuracy scores in advance IDS methods. Therefore, this paper proposes a novel IDS framework to overcome these IDS problems. The proposed framework including three main parts. The first part is to build SFSDT model which is the feature selection model. SFSDT is to generate the best feature subset from the original feature set. This model is a hybrid Sequence Forward Selection (SFS) algorithm and Decision Tree (DT) model. The second part is to build various IDS models to train on the best-selected feature subset. The various Recurrent Neural Networks (RNN) are traditional RNN, Long Short-Term Memory (LSTM), and Gated Recurrent Unit (GRU). Two IDS datasets are used for the learned models in experiments including NSL-KDD in 2010 and ISCX in 2012. The final part is to evaluate the proposed model by comparing the proposed models to other IDS models. The experimental results show the proposed models achieve significantly improved accuracy detection rate as well as attack types classification. Furthermore, this approach can reduce the computation time by memory profilers measurement.

Non-Intrusive Load Monitoring (NILM) systems have gained popularity in recent years for saving more energy. To reduce sensing infrastructure costs, NILM monitors the electrical loads based on a machine learning method. We propose a novel approach to improve the performance of classifying household appliances at a high sampling rate called FFT-BDT. The proposed method includes two main processes. The first process is generating novel features in the feature extraction stage. These features are the magnitude and phase (MP) at lower odd-numbered harmonics based on the Fast Fourier Transform (FFT). MP features are steady-state features at high frequency and used as input for a learning model. The second process is where a machine learning model, a bagging decision tree (BDT), learns the novel MP features. The proposed method enhances the accuracy of recognizing different appliances that have similar power consumption. To evaluate the FFT-BDT, we experimented on two NILM datasets, including the public PLAID dataset and our own private dataset. The method outperformed prior methods and could significantly contribute to load identification in NILM.

Securing the Internet of Things (IoT) against cyber threats is a formidable challenge, and Intrusion Detection Systems (IDS) play a critical role in this effort. However, the lack of transparent explanations for IDS decisions remains a significant concern. In response, we introduce a novel approach that leverages a blending model for attack classification and integrates counterfactual and Local Interpretable Model-Agnostic Explanations (LIME) techniques to enhance explanations. To assess the effectiveness of our approach, we conducted experiments using the recently introduced CICIoT2023 and IoTID20 datasets. These datasets are real-time and large-scale benchmark datasets for IoT environment attacks, offering a realistic and challenging scenario that captures the intricacies of intrusion detection in dynamic IoT environments. Our experimental results demonstrate significant improvements in attack detection accuracy compared to conventional IDS methods. Furthermore, our proposed approach provides clear and interpretable insights into the factors influencing classification decisions, empowering users to make informed security choices. Integrating blending model classification and explanation techniques enhances the security and reliability of IoT systems. Therefore, this work represents a significant advancement in IoT intrusion detection, offering a robust and transparent defense against large-scale cyber-attacks of IoT environment data.