Evaluating the performance of TinyML singular and ensemble techniques for intrusion detection in IoT networks

Abstract

As the Internet of Things (IoT) expands, safeguarding IoT networks from vulnerabilities becomes critical. Intrusion detection systems (IDS) leveraging machine learning (ML) techniques are essential for enhancing security and preventing unauthorized access. However, transmitting data to the cloud can introduce latency, impeding real-time attack detection. This research evaluates three TinyML ensemble techniques (random forest, XGBoost, and extra trees) and three singular techniques (decision tree, Gaussian naive Bayes, and multilayer perceptron) using two feature selection methods (maximum relevance minimum redundancy and analysis of variance) on the NF-ToN-IoT-v2 and NF-BoT-IoT-v2 datasets for cyberattack detection. Evaluations on the Arduino UNO used the prediction performance criteria (Cohen’s kappa and Matthew’s correlation coefficient), device metrics (latency, static RAM, and flash memory), and the Scott-Knott test and Borda count voting system to assess the statistical significance and to rank the models. Results show that singular TinyML models outperformed ensemble models for multiclass classification in the IDS-IoT context. The best models are: (1) MLP with 20 features and a hidden layer size of 56 for NF-ToN-IoT-v2; and (2) ET with 13 features, 2 estimators, and a tree depth of 16 for NF-BoT-IoT-v2.