Securing MQTT protocol for IoT environment using IDS based on ensemble learning

Nowadays, the world of the Internet of Things (IoT) enables machines to communicate, collect data, and even make decisions which improve significantly daily human life. However, the proliferation of IoT devices coupled with their inherent vulnerabilities makes them highly exposed to cyber-attacks such as network disruptions or Denial of Service (DoS) attacks. Traditional detection methods based on a single machine learning (ML) technique may not be fully efficient due to the sophistication level and the variety of attacks. In this paper, we propose an intrusion detection model based on ensemble learning (EL) trained using a recent public dataset containing various MQTT attacks. EL is a powerful machine learning (ML) technique that consists of training several ML models independently on random subsets of the training data and then averages the predictions to produce the final result. Basically, we propose the use of three known ensemble learning methods, namely bagging, boosting, and stacking. EL principles allow increasing prediction performances by integrating the capabilities of numerous distinct models. In order to train and test the proposed model, we also propose generating a binary balanced MQTT dataset rather than using imbalanced one as usually used in previous work. To the best of our knowledge, the work in this paper is the first that applies ensemble learning method on this MQTT dataset. The experiment results have shown that our EL-based network IDS increases both the detection accuracy and F1-score up to 95% where Matthews's correlation coefficient (MCC) exceeds 90%.