A BEHAVIOUR-BASED MACHINE LEARNING FRAMEWORK FOR DEVICE IDENTIFICATION AND MULTI-CLASS ATTACK CLASSIFICATION WITH JOINT EVALUATION IN IoT NETWORK

Abstract

The deployment of numerous connected devices in various areas, including as health care, home automation, transportation systems, and industry automation systems, has advanced significantly due to the of IoT technology advancement. The growing preva lence of IoT devices is linked to significant security risks that have surfaced as a result of different communication channels and cyberattacks. Traditional methods of intru sion detection mainly depend on the flow-based characteristics of network traffic and may not be able to detect some aspects of the device communication behaviour.. This thesis presents a framework using behaviour-based machine learning for iden tifying IoT Device also multi-class Anomaly Detection (AD) with joint evaluation ca pability. The work is carried out in two phases using the CICIoT-DIAD 2024 dataset. In Phase 1, a flow-based baseline model is developed for anomaly detection and attack classification. In Phase 2, behaviour-based traffic representations are utilized to per form both recognise device and anomaly detection tasks. Multiple machine learning algorithms are trained and evaluated. Experimental results show that behaviour-based features provide more discriminative information than traditional flow-based features. Random Forest outperformed all other models in overall performance for both DI and ADtasks. For Device Identification, the Random Forest model achieved a classification ac curacy of 99.24% on the test dataset, while the 5-fold cross-validation analysis pro duced an average accuracy of 99.15%, demonstrating stable and consistent perfor mance across different folds. Similarly, for Anomaly Detection, the model attained an accuracy of accuracy of 99.72% on test, whereas the average 5-fold cross-validation accuracy was 99.68% with a very high AUC score, indicating strong generalization capability and robustness. To improve processing efficiency and eliminate unnecessary information from the dataset, a combined feature refinement strategy using Mutual Information and Recur sive Feature Elimination (RFE) is adopted. Rather than relying on all available at tributes, this approach prioritizes the most informative features by filtering out less relevant ones, leading to a more compact feature space while maintaining compara ble detection performance. In addition, a joint correctness evaluation is performed to analyze the capability of the proposed framework in simultaneously identifying IoT devices and classifying attack categories. The overall findings demonstrate that behaviour-based traffic analysis can signif icantly improve IoT security performance while also enabling accurate device iden tification. The developed framework offers a practical and scalable mechanism for intelligent IoT security systems operating in realistic network environments.