A ranked filter-based three-way clustering strategy for intrusion detection in highly secure IoT networks

Abstract

The primary issue with the current intrusion detection systems (IDS) for IoT networks is that they are based on two-way decisions, meaning that a decision must be taken regardless of the quality of the information available. This can result in inaccurate classification decisions when there is insufficient and incomplete information. Misclassifying objects can have serious consequences, especially in security-sensitive systems. Moreover, many of these approaches fail to deliver transparent and understandable results from the model, making it difficult to interpret how decisions are being made. To address these limitations, this article proposes a novel ranked filter-based three-way clustering (RF3WC) strategy for intrusion detection, which involves making decisions about acceptance, rejection, or deferment. The inclusion of the deferred decision option allows for the deferment of a specific decision in cases when sufficient information is lacking. Based on a three-way decision, this approach divides the data into three regions: malicious, non-malicious, and suspicious. The inclusion of the suspicious region can make the IDS extremely secure, more reliable, and quite confident and can significantly reduce false alerts. In addition, we employed the eXplainable Artificial Intelligence (XAI) technique to facilitate a more transparent understanding of the model’s output. Results obtained from extensive experiments using four cutting-edge datasets demonstrate that the proposed RF3WC model enhances detection accuracy and minimizes misclassification.