Intrusion Detection System Traffic Classification Based on Machine Learning with Correlation-Based Filtering and a Genetic Algorithm-Inspired Feature Selection Method for IoT Networks
Received: 18 July 2025 | Revised: 29 July 2025 and 3 August 2025 | Accepted: 15 August 2025 | Online: 19 August 2025
Corresponding author: Alaa A. Almelibari
Abstract
Securing Internet of Things (IoT) networks against diverse cyber-attacks remains a critical challenge due to their constrained resources and complex traffic patterns. This paper proposes a lightweight, multiclass Intrusion Detection System (IDS) that addresses the limitations of prior binary models by classifying five types of network traffic: Normal, DoS, Mirai, Man-in-the-Middle (MITM), and Scan. A key contribution of this work is the application of a Genetic Algorithm (GA)-inspired feature selection method, which significantly enhances model accuracy and efficiency by isolating the most relevant attributes. Combined with traditional machine learning models, the proposed approach was evaluated using a simulated dataset modeled after IoTID20. Among the classifiers, the Random Forest model, when integrated with GA-inspired feature selection, achieved the highest accuracy of 96.5%. The results highlight the effectiveness of combining lightweight feature optimization with robust classification techniques, making the system highly suitable for real-world IoT deployments.
Keywords:
IDS, traffic classification, IoT, DoS, cyber security, network securityDownloads
References
P. Mamatha, S. Balaji, and S. S. Anuraghav, "Development of Hybrid Intrusion Detection System Leveraging Ensemble Stacked Feature Selectors and Learning Classifiers to Mitigate the DoS Attacks," International Journal of Computational Intelligence Systems, vol. 18, no. 1, Feb. 2025, Art. no. 20.
W. B. Dennyson and C. Jothikumar, "Securing Automotive Networks from DoS and Fuzzy Attacks with Optimized LSTM Models," International Journal of Computational Intelligence Systems, vol. 18, no. 1, Apr. 2025, Art. no. 95.
M. Zahid and T. S. Bharati, "Enhancing cybersecurity in IoT systems: a hybrid deep learning approach for real-time attack detection," Discover Internet of Things, vol. 5, no. 1, Jul. 2025, Art. no. 73.
H. Yang and M. Effatparvar, "A deep learning based intrusion detection system for CAN vehicle based on combination of triple attention mechanism and GGO algorithm," Scientific Reports, vol. 15, no. 1, Jun. 2025, Art. no. 19462.
A. Sagu, N. S. Gill, P. Gulia, N. Alduaiji, P. K. Shukla, and M. A. Shah, "Advances to IoT security using a GRU-CNN deep learning model trained on SUCMO algorithm," Scientific Reports, vol. 15, no. 1, May 2025, Art. no. 16485.
O. Martins Onyekwelu, S. Yanxia, and D. Mashao, "Deep Learning-Based Intrusion Detection System: Embracing Long Short-Term Memory (LSTM) and Roughly Balanced Bagging Synergies," Inteligencia Artificial, vol. 28, no. 76, pp. 40–65, Jun. 2025.
L. Shan, "(IoT) Network intrusion detection system using optimization algorithms," Scientific Reports, vol. 15, no. 1, Jul. 2025, Art. no. 21706.
S. B, S. M, M. K, and L. B, "Ensemble of feature augmented convolutional neural network and deep autoencoder for efficient detection of network attacks," Scientific Reports, vol. 15, no. 1, Feb. 2025, Art. no. 4267.
K. Rajkumar and S. M. Shalinie, "SHAP-based intrusion detection in IoT networks using quantum neural networks on IonQ hardware," Journal of Parallel and Distributed Computing, vol. 204, Oct. 2025, Art. no. 105133.
Z. Zhang, A. Das, G. Huang, and S. Baskiyar, "CAT: A simple heterogeneous ensemble learning framework for network intrusion detection," Peer-to-Peer Networking and Applications, vol. 18, no. 4, Jun. 2025, Art. no. 213.
M. A. Ahmed and S. Alnatheer, "Intrusion Detection in a Digital Twin-Enabled Secure Industrial Internet of Things Environment for Industrial Sustainability," Engineering, Technology & Applied Science Research, vol. 15, no. 2, pp. 21263–21269, Apr. 2025.
N. Alkhafaji, T. Viana, and A. Al-Sherbaz, "Integrated Genetic Algorithm and Deep Learning Approach for Effective Cyber-Attack Detection and Classification in Industrial Internet of Things (IIoT) Environments," Arabian Journal for Science and Engineering, vol. 50, no. 15, pp. 12071–12095, Aug. 2025.
C. Khammassi and S. Krichen, "A GA-LR wrapper approach for feature selection in network intrusion detection," Computers & Security, vol. 70, pp. 255–277, Sep. 2017.
V. Kumar, D. Sinha, A. K. Das, S. C. Pandey, and R. T. Goswami, "An integrated rule based intrusion detection system: analysis on UNSW-NB15 data set and the real time online dataset," Cluster Computing, vol. 23, no. 2, pp. 1397–1418, Jun. 2020.
R. Chaganti, A. Mourade, V. Ravi, N. Vemprala, A. Dua, and B. Bhushan, "A Particle Swarm Optimization and Deep Learning Approach for Intrusion Detection System in Internet of Medical Things," Sustainability, vol. 14, no. 19, Jan. 2022, Art. no. 12828.
E.-S. M. El-Kenawy, M. M. Eid, H. L. Hussein, A. M. Osman, and A. M. Elshewey, "Optimized Deep Learning Model Using Binary Particle Swarm Optimization for Phishing Attack Detection: A Comparative Study," Mesopotamian Journal of CyberSecurity, vol. 5, no. 2, pp. 685–703, Jul. 2025.
R. Amin Labid, "iotid20 dataset." [Online]. Available: https://www.kaggle.com/datasets/rohulaminlabid/iotid20-dataset.
A. M. Elshewey, S. A. Z. Hassan, R. Y. Youssef, H. M. El-Bakry, and A. M. Osman, "Enhancing Hydrogen Energy Consumption Prediction Based on Stacked Machine Learning Model with Shapley Additive Explanations," Process Integration and Optimization for Sustainability, May 2025.
Downloads
How to Cite
License
Copyright (c) 2025 Alaa A. Almelibari
This work is licensed under a Creative Commons Attribution 4.0 International License.
Authors who publish with this journal agree to the following terms:
- Authors retain the copyright and grant the journal the right of first publication with the work simultaneously licensed under a Creative Commons Attribution License that allows others to share the work with an acknowledgement of the work's authorship and initial publication in this journal.
- Authors are able to enter into separate, additional contractual arrangements for the non-exclusive distribution of the journal's published version of the work (e.g., post it to an institutional repository or publish it in a book), with an acknowledgement of its initial publication in this journal.
- Authors are permitted and encouraged to post their work online (e.g., in institutional repositories or on their website) after its publication in ETASR with an acknowledgement of its initial publication in this journal.
