Intrusion detection systems (IDSs) that continuously monitor data flow and take swift action when attacks are identified safeguard networks. Conventional IDS exhibit limitations, such as reduced detection rates and increased computational complexity, attributed to the redundancy and substantial correlation of network data. Ensemble learning (EL) is effective for detecting network attacks. Nonetheless, network traffic data and memory space requirements are typically significant. Therefore, deploying the EL approach on Internet-of-Things (IoT) devices with limited memory is challenging. In this paper, we use feature importance (FI), a filter-based feature selection technique for feature dimensionality reduction, to reduce the feature dimensions of an IoT/IIoT network traffic dataset. We also employ lightweight stacking ensemble learning (SEL) to appropriately identify network traffic records and analyse the reduced features after applying FI to the dataset. Extensive experiments use the Edge-IIoTset dataset containing IoT and IIoT network records. We show that FI reduces the storage space needed to store comprehensive network traffic data by 86.9%, leading to a significant decrease in training and testing time. Regarding accuracy, precision, recall, training and test time, our classifier that utilised the eight best dataset features recorded 87.37%, 90.65%, 77.73%, 80.88%, 16.18 s and 0.10 s for its overall performance. Despite the reduced features, our proposed SEL classifier shows insignificant accuracy compromise. Finally, we pioneered the explanation of SEL by using a decision tree to analyse its performance gain against single learners.

中文翻译：

---

用于 IoT/IIoT 网络中攻击检测的轻量级 SEL


入侵检测系统 (IDS) 持续监控数据流并在发现攻击时迅速采取行动，保护网络。由于网络数据的冗余和大量相关性，传统的 IDS 存在局限性，例如检测率降低和计算复杂性增加。集成学习（EL）对于检测网络攻击非常有效。尽管如此，网络流量数据和内存空间需求通常很大。因此，在内存有限的物联网 (IoT) 设备上部署 EL 方法具有挑战性。在本文中，我们使用特征重要性（FI），一种基于过滤器的特征降维技术，来减少物联网/工业物联网网络流量数据集的特征维度。我们还采用轻量级堆叠集成学习（SEL）来正确识别网络流量记录，并在将 FI 应用于数据集后分析减少的特征。大量实验使用包含 IoT 和 IIoT 网络记录的 Edge-IIoTset 数据集。我们发现，FI 将存储综合网络流量数据所需的存储空间减少了 86.9%，从而显着减少了训练和测试时间。在准确率、精确率、召回率、训练和测试时间方面，我们的分类器利用八个最佳数据集特征，其整体性能分别为 87.37%、90.65%、77.73%、80.88%、16.18 秒和 0.10 秒。尽管特征有所减少，但我们提出的 SEL 分类器在准确性方面的影响并不显着。最后，我们通过使用决策树来分析 SEL 相对于单个学习者的性能增益，开创了 SEL 的解释。