IoT Intrusion Detection: A Comprehensive Benchmark of Feature Selection and Machine Learning Models

Abstract

Machine learning (ML) and feature selection (FS) are crucial for enhancing the accuracy and efficiency of Intrusion Detection Systems (IDS) in IoT networks. However, existing studies evaluate ML models or FS methods in isolation, lacking a holistic comparison among combinations of FS and ML across different datasets and attack types. In this study, we address this gap by conducting a comprehensive benchmark of 10 ML models and 17 FS methods with various settings on 7 IDS datasets. We first establish baseline performance of the ML models without FS, then analyze the impact of individual FS techniques on each model. Our experimental results show that (1) tree-based models consistently outperform other models in various scenarios; (2) while non-ranking-based FS methods generally show better results, ranking-based methods can be equally effective with a sufficient number of features; and (3) the combination of tree-based models and non-ranking-based FS methods consistently outperform others. These findings provide insights for security experts in developing an efficient and effective IDS in IoT networks.