Optimal Fuzzy Logic Enabled Intrusion Detection for Secure IoT-Cloud Environment

1  Introduction

Recently, the Internet of Things (IoT) network and its smart gadgets are widening in all respects of our community, namely smart grids, smart homes, intelligent distributed networks, smart manufacturing industries, smart virtual learning environments, smart hospitals, and intelligent vehicles, [1]. Currently, various activities associated with IoT have obtained interest within the industry as well as in the academic region because of its potential usage in various human actions. IoT depicts a potential solution for enhancing standards of people’s life (for example, the smartwatch, that observes health via sensors [2]), and various technologies made familiar with the decline in sensor prices, the outreach of remote memory services, and huge data. It has been made clear that accessibilities to these resources reinforce IoT while gadgets with various resources are linked to a network, therefore endowing to the advent of new applications [3]. Such a new whole ground has accompanied by a price they are, the need for security. Therefore, large-scale diffusion of such technology is joined by various security difficulties regarding the huge amount of streams of data flowing from or to the smart gadgets themselves [4]. As a result, many IoT applications need protection and security, including precise validation and categorization methods in turn, along with those sufficient solutions for guaranteeing integrity and confidentiality. Furthermore, offering the extensive usage of IoT gadgets, immoral actions would have deep effects on the strength and the security of the whole Internet [5,6]. Fig. 1 illustrates the process invovled in deep learning (DL) techniques.

Figure 1: Process in DL technique

Currently, there seems to be developing attention to the exploration of the efficiency of machine learning (ML) methods for improving IoT security [7–9]. ML methods vary in their computational and efficiency necessities. For instance, few supervised models have high memory and central processing unit (CPU) necessities while their training stage since it demands low resources once applied in comparison to unsupervised learning model [10]. When ML methods are utilized for enhancing the network’s security they are performed on conventional networked devices and they are specially placed in order to safeguard the IoT architecture.

In contrast, DL has obtained lots of momentum in the past few years as it was utilized for solving, with a growing extent of precision, distinct issues, that were generally solved by conventional ML methods, namely prediction, recession, classification, and son on [11]. Actually DL includes a group of well-known ML methods on the basis of artificial neural networks permitting one to experiment with the information processing of biological nervous systems comprises of multiple perceptron’ layers [12]. Governing security difficulties in another network includes 3 broad approaches such as detection, mitigation, and prevention. All the three mentioned measures must be adopted for successful security solutions for IoT networks. For the scope of this work, we aim at Intrusion Detection Systems (IDS) and assume DL related IDS for classifying and identifying network traffic inside an IoT environment [13].

This paper presents novel metaheuristics feature selection with fuzzy logic enabled intrusion detection system (MFSFL-IDS) in the IoT environment. The presented MFSFL-IDS technique employs data pre-processing to transform the data into useful format. Besides, henry gas solubility optimization (HGSO) technique is applied as a feature selection approach to derive useful feature vectors. Moreover, adaptive neuro fuzzy inference system (ANFIS) technique was utilized for the recognition and classification of intrusions in the network. Finally, binary bat algorithm (BBA) is exploited for adjusting parameters involved in the ANFIS model. A comprehensive experimental validation of the MFSFL-IDS model is carried out using benchmark dataset and the results are assessed under distinct aspects.

2  Literature Review

In this section, a detailed survey of recently developed approaches for intrusion detection classification in IoT environments is provided. Nguyen et al. [14] presented real guard and deep neural network (DNN)-based network IDS (NIDS) operated directly on local gateways for protecting IoT gadgets. The advantage of the presented method is that it could precisely identify cyberattacks in real time with a smaller computation footprint. It can be accomplished by a light weighted feature extraction method and an effectual attack detection system powered by deep neural network. In [15], introduce a hybrid ML method using extreme gradient boosing (XGB) with random forest (RF) called XGB-RF for identifying intrusion attacks. The presented model was employed for the N-BaIoT data comprising hazardous botnet attacks. The RF has been utilized for selecting the features and XGB technique was utilized for detecting various kinds of attacks on IoT environment.

In [16], introduced a hybrid mechanism of shallow learning and DL to identify the intrusion in the IoT device. Firstly, the presented method with spider monkey optimization feature selection model search for selecting key features. In [17], proposed an ensemble-based IDS. In the presented method, DT, logistic regression (LR), and Naïve Bayes (NB) were deployed by voting classification afterward analyzing model efficiency with modern technologies. In [18], proposed a new a distributed combined DL-IDS for the Internet of Vehicles (IoV) based on Apache Spark architecture regarding the problem. The cluster integrates DL based convolutional neural network (DL-CNN) and long short term memory (LSTM) models for extracting features.

Alohali et al. [19] presented a novel IDS based ensemble-based voting classification model which integrates traditional classifier as a basic learner and provides the vote to the prediction of the classic classifier to obtain the concluding prediction. Friha et al. [20] a federated learning-based IDS (FELIDS) is proposed to secure agriculture based IoT infrastructure. Especially the FELIDS method protects the data through local learning, whereas device get benefitted in the knowledge of its peers by sharing upgrades in the model with aggregation server which produces an effective method.

3  The Proposed Model

A novel MFSFL-IDS model was established to recognize the existence of intrusions and accomplish security in the IoT environment. The MFSFL-IDS model primarily employed data pre-processing to transform the data into useful format. Followed by, the HGSO algorithm has been utilized to derive useful features. In addition, the BBA-ANFIS classifier is employed for the recognition and classification of intrusions in the network. Fig. 2 illustrates the block diagram of MFSFL-IDS technique.

Figure 2: Block diagram of MFSFL-IDS technique

3.1 Data Pre-Processing

In several ML techniques, data normalized was generally utilized to obtain effectual performances. The value of features can vary in lower to higher values. Thus, the normalized procedure was utilized for data scaling, as given in Eq. (1):

s=1N−1∑i=1N(xi−x¯)2(1)

3.2 Feature Selection Using HGSO Algorithm

In order to optimally choose the features, the HGSO algorithm has been exploited for choosing an optimal subset of features [21]. The presented FS solution is a three step process, which can be defined as follows: initially, the HGSO creates population initialization of N candidate solutions, whereas all the individuals characterize a set of features that chosen for calculation. The population X0 is arbitrarily generated. Here, lbi and ubi lower and upper boundaries for every candidate solution i lies within [0, 1]. Hence, every solution xi0 need to be transformed into binary xibin as follows:

xibin={1ifxi0>0.50otherwise.(2)

In order to explain the conversion procedure, we assumed the solution xi that has six components as xi0=[0.6,0.1,0.7,0.43,0.2,0.81]. The conversion operation can be used for making a binary vector: xibin=[1,0,1,0,0,1], while 1 denotes that the feature that selected; or else considered as unselected when 0. Afterward defining the set of features, the fitness function can be estimated for all the solution xibin for determining the quality of feature. The objective value for ith solution can be described by the following equation.

Fit1=w1×Erri+w2×diD(3)

Here w1=0.99 and w2=1−w1,D indicates the overall size of attribute in original data.

Here, the ANFIS classification is employed as evaluator or expert system in the FS method. The Erri indicates the error rate of testing set calculated by ANFIS mechanism. Now, updating solution comprises of using the clustering stage that focuses on splitting the population into distinct clusters. Next, evaluate the fitness of the new population for determining the optimal solution xbest0. Afterward completing HGSO procedure, we return the optimal solution xbest0. In original dataset, we keep the feature with the value corresponding to one in xbesf.

3.3 ANFIS Classifier

Next to feature selection, the ANFIS classifier is employed for the recognition and classification of intrusions in the network [22]. The rules are listed below

Rule 1: if x is A1 and y is B1 then f1=p1x+q1y+r1

Rule 2: if x is A2 and y is B2 then f2=p2x+q2y+r2

where x and y inputs, the fuzzy sets are Bi and Ai.pi,qi and ri indicates the parameter of model that is represented in training and fi indicates the output defined by the fuzzy rule.

Layer 1: Each node i in layer 1 are adopted with node function

Oi1=μAi(x)(4)

whereas x indicates the input to node i,μAi denotes the membership function of Ai. The membership function can be chosen as follows:

μAi(x)=11+[(x−ciai)2]bi′′′(5)

Or

μAi(x)=exp(−(x−ciai)2)(6)

Here ai,bi,ci denotes the principle parameter set and x indicates the input

Layer 2: The fixed node is presented in layers 2 and 3. The resultant is given for Layer 2:

Oi2=ωi=μAi(x).μBi(y),i=1,2(7)

These are firing strengths of rules.

Layer 3: The firing strength of layer 2 can be normalizing with the nodes and marked as N and it is given in the following:

Oi3=ωi¯=ωiω1+ω2,i=1,2(8)

Layer 4: The product of 1st-order polynomial as well as normalize firing strength. The output is demonstrated in the following:

Oi4=ω¯fi=ω¯i(pix+qiy+ri),i=1,2(9)

Now ω¯i indicates the output of layer 3 and {pi,qi,ri} denotes the subsequent parameter set

Layer 5: There is a single fixed node marked as S in layer 5. Every incoming signal is summed up through the node. The output can be shown in the following:

Oi5=overalloutput=∑i(ω¯ifi)=∑iωifi∑iωi(10)

3.4 Parameter Tuning Using BBA

Finally, the optimization is exploited for adjusting parameters involved in the ANFIS model [23–25]. The BBA distinguishes amongst barrier and prey [26]. It is also noticeable the bat is variation the wavelength of its emitted pulse and the rate of emissions dependent upon its comparative position in terms of the targets. During the context of FS, this provides the technique flexibility for adapting modifies from the feature space and exploring superior solutions. Afterward initialized the place, frequency, and velocity vector, and optimum solution was noted and upgraded throughout the technique. It can be completed mostly utilizing the subsequent formulas:

Qi=Qmin+(Qmin−Qmax).rand(11)

v(i,j)=v(i,j)+(x(i,j)−best(j)⋅Qi(12)

x~(i,j)=x(i,j)+v(i,j)(13)

whereas rand signifies the arbitrarily created number from the interval of zero and one, and x~ implies the novel solution. These novel solutions could not always be implemented and are upgraded according to specific other parameters from the technique. The threshold was chosen according to the value of velocity of the bat that controls the count of exploration, the bat is able of attaining as is provided in Eq. (14). When the specific arbitrary number was lesser than this threshold value, a novel solution is upgraded and bat moves on to novel solution space.

V−value=|2πarctan(π2 v(i,j))|.(14)

The rate of pulse emission resolves if the bat is stuck to preceding optimum solution attained or implements the recently upgrade solution. It can be same as an optimum global solution adoption stage is one of the metaheuristics and uses to steer and clear off too much redundant exploration. The loudness parameter establishes more filtering to implementation of solutions as the novel accepted solutions. The solution is only established when the arbitrary number selected is lower than the loudness value and fitness of novel solution was superior to the old solution.

4  Experimental Validation

This section investigates the performance of the MFSFL-IDS model using Kaggle dataset (available at https://www.kaggle.com/datasets/mkashifn/nbaiot-dataset). It comprises of 115 attributes with 11 class labels. In this work, a set of 64 features are chosen from the dataset. Tab. 1 provides the details related to the dataset.

Fig. 3 exemplifies the confusion matrix generated by the MFSFL-IDS model. Tab. 2 offers a detailed classification outcome of the MFSFL-IDS model on the entire dataset. The experimental outcomes implied that the MFSFL-IDS model has able to improve performance under all class labels. For instance, with class C-1, the MFSFL-IDS model has reached accuy, recal, specy, Fscore, and Mathew Correlation Coefficient (MCC) of 99.79%, 98.98%, 99.84%, 98.17%, and 98.06% respectively. In addition, with class C-3, the MFSFL-IDS method has reached accuy, recal, specy, Fscore, and MCC of 99.85%, 98.70%, 99.90%, 98.23%, and 98.16% correspondingly. Also, with class C-10, the MFSFL-IDS technique has reached accuy, recal, specy, Fscore, and MCC of 99.78%, 98.71%, 99.90%, 98.94%, and 98.82% respectively.

Figure 3: Confusion matrix of MFSFL-IDS technique on distinct datasets

Fig. 4 provides an average classification result of the MFSFL-IDS model on entire dataset. The figure portrayed that the MFSFL-IDS model has gained effective outcome with an average accuy, recal, specy, and Fscore, and MCC of 99.80%, 98.89%, 99.89%, and 98.82% respectively.

Figure 4: Average analysis of MFSFL-IDS technique on entire dataset

Tab. 3 provided a brief classification outcome of the MFSFL-IDS approach on 70% of training set (TRS) dataset. The experimental outcomes implied that the MFSFL-IDS methodology has accomplished higher performance under all class labels. For instance, with class C-1, the MFSFL-IDS approach has reached accuy, recal, specy, Fscore, and MCC of 99.80%, 99.02%, 99.84%, 98.22%, and 98.12% correspondingly. Moreover, with class C-5, the MFSFL-IDS model has reached accuy, recal, specy, Fscore, and MCC of 99.82%, 98.80%, 99.89%, 98.64%, and 98.54% correspondingly. Besides, with class C-10, the MFSFL-IDS approach has reached accuy, recal, specy, Fscore, and MCC of 99.78%, 98.70%, 99.90%, 98.92%, and 98.80% correspondingly.

Fig. 5 gives an average classification result of the MFSFL-IDS model on 70% of TRS dataset. The result portrayed that the MFSFL-IDS system has reached effective outcome with an average accuy, recal, specy, Fscore, MCC, kappa, and threat score of 99.80%, 98.89%, 99.89%, 98.82%, 98.71%, 98.78%, and 97.82% correspondingly.

Figure 5: Average analysis of MFSFL-IDS technique on 70% TRS dataset

Tab. 4 provides a detailed classification outcome of the MFSFL-IDS method on the 30% of testing set (TSS) dataset. The experimental outcomes implied that the MFSFL-IDS system has accomplished enhanced performance under all class labels. For sample, with class C-1, the MFSFL-IDS model has reached accuy, recal, specy, Fscore, and MCC of 99.77%, 98.89%, 99.83%, 98.04%, and 97.92% correspondingly. Furthermore, with class C-3, the MFSFL-IDS model has reached accuy, recal, specy, Fscore, and MCC of 99.87%, 98.86%, 99.92%, 98.46%, and 98.40% correspondingly. Also, with class C-10, the MFSFL-IDS technique has reached accuy, recal, specy, Fscore, and MCC of 99.79%, 98.73%, 99.91%, 98.98%, and 98.87% correspondingly.

Fig. 6 provides an average classification result of the MFSFL-IDS system on 30% of TSS dataset. The figure outperformed that the MFSFL-IDS approach has gained effectual outcome with an accuy, recal, specy, Fscore, MCC, kappa, and threat score of 99.80%, 98.90%, 99.89%, 98.84%, 98.73%, 98.80%, and 97.86% correspondingly.

Figure 6: Average analysis of MFSFL-IDS technique on 30% TSS dataset

The training accuracy (TA) and validation accuracy (VA) attained by the MFSFL-IDS model on test dataset is demonstrated in Fig. 7. The experimental outcomes implied that the MFSFL-IDS model has gained maximum values of TA and VA. In specific, the VA is seemed to be higher than TA.

Figure 7: TA and VA analysis of MFSFL-IDS technique

The training loss (TL) and validation loss (VL) achieved by the MFSFL-IDS model on test dataset are established in Fig. 8. The experimental outcomes inferred that the MFSFL-IDS model has accomplished least values of TL and VL. In specific, the VL is seemed to be lower than TL.

Figure 8: TL and VL analysis of MFSFL-IDS technique

Tab. 5 provides a detailed comparative study of the MFSFL-IDS model with recent models such as RF-RF, XGB-RF, RF-recursive feature elimination (RFE), RF-Feature Selection with Recursive Feature Elimination (RFECV), RF-SelectK, and RF-weighted feature selection (WFS) interms of different measures. Fig. 9 illustrates an extensive comparative investigation of the MFSFL-IDS model with existing models. The experimental results implied that the RF-RF, RF-RFE, RF-RFECV, and RF-SelectK models have accomplished lower values of accuy, sensy, andspecy. Moreover, the RF-WFS model has resulted in slightly improved values of accuy, sensy, and specy. Though XGB-RF model has exhibited reasonable performance with accuy, sensy, and specy of 99.42%, 98.82%, and 99.51%, the presented MFSFL-IDS model has showcased maximum outcome with accuy, sensy, and specy of 99.80%, 98.90%, and 99.89% respectively.

Figure 9: Accy, sensy, and specy analysis of MFSFL-IDS technique with existing algorithms

Fig. 10 depicts an extensive comparative investigation of the MFSFL-IDS model with existing models. The experimental outcomes referred that the RF-RF, RF-RFE, RF-RFECV, and RF-SelectK models have accomplished lower values of Fscore, kappa, MCC, and TS. Moreover, the RF-WFS approach has resulted in somewhat improved values of Fscore, kappa, MCC, and TS. Though XGB-RF technique has outperformed reasonable performance with Fscore, kappa, MCC, and TS of 98.44%, 98.32%, 98.49%, and 97.67%, the presented MFSFL-IDS algorithm has showcased maximal outcome with Fscore, kappa, MCC, and TS of 98.84%, 98.80%, 98.73%, and 97.86% correspondingly.

Figure 10: Comparison study of MFSFL-IDS technique with recent models

5  Conclusion

In this study, a novel MFSFL-IDS model was established to recognize the existence of intrusions and accomplish security in the IoT environment. The MFSFL-IDS model primarily employed data pre-processing to transform the data into useful format. Followed by, the HGSO algorithm has been utilized to derive useful features. In addition, the ANFIS classifier is employed for the recognition and classification of intrusions in the network. At last, the BBA is exploited for adjusting parameters involved in the ANFIS model. A comprehensive experimental validation of the MFSFL-IDS model is carried out using benchmark dataset and the outcomes are assessed under distinct aspects. The experimentation outcomes highlighted the better performance of the MFSFL-IDS model over recent approaches. Therefore, the MFSFL-IDS model can be utilized for accomplishing security in the IoT environment. In future, feature reduction and outlier removal approaches can be developed for enhancing security in the IoT environment.

Funding Statement: Princess Nourah bint Abdulrahman University Researchers Supporting Project Number (PNURSP2022R319), Princess Nourah bint Abdulrahman University, Riyadh, Saudi Arabia. The authors would like to thank the Deanship of Scientific Research at Umm Al-Qura University for supporting this work by Grant Code: (22UQU4310373DSR27).

Conflicts of Interest: The authors declare that they have no conflicts of interest to report regarding the present study.