Intruder Detection System for IOT network Using Hyperparameter Optimization Framework

Intruder Detection System for IOT network Using Hyperparameter Optimization Framework | Research Square window.SnipcartSettings = { analytics: { enabled: false } }; (function() { var accessVector = localStorage.getItem('access_vector') || ''; window.dataLayer = window.dataLayer || []; if (accessVector) { window.dataLayer.push({ user: { profile: { profileInfo: { snid: accessVector } } } }); } })(); (function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','GTM-K279D39R'); Browse Preprints In Review Journals COVID-19 Preprints AJE Video Bytes Research Tools Research Promotion AJE Professional Editing AJE Rubriq About Preprint Platform In Review Editorial Policies Our Team Advisory Board Help Center Sign In Submit a Preprint Cite Share Download PDF Research Article Intruder Detection System for IOT network Using Hyperparameter Optimization Framework Abubucker Samsudeen Shaffi This is a preprint; it has not been peer reviewed by a journal. https://doi.org/ 10.21203/rs.3.rs-7538012/v1 This work is licensed under a CC BY 4.0 License Status: Posted Version 1 posted You are reading this latest preprint version Abstract The rapid adoption of the Internet of Things (IoT) due to its ease of use and diversity has prompted serious security concerns about networked devices around the world. This emphasizes the critical necessity for robust Intrusion Detection Systems (IDS) to combat cyber threats. However, the widespread interconnectedness and diversity of IoT devices have posed substantial security challenges, particularly in terms of network infiltration. This study investigates the design and implementation of an IDS for IoT networks utilizing the OPTUNA Hyperparameter Optimization Framework. The proposed IDS seeks to identify and prevent several cyber threats through investigating network traffic and recognizing aberrant patterns that indicate intrusions. This study contributes to the field of IoT security by presenting an effective and extensible ID method that takes advantage of the optimization framework. Additionally, the OPTUNA framework is utilized to optimize classifier performance by fine-tuning hyperparameters and determining the ideal model configuration. These models are evaluated using publicly available NSL-KDD datasets. The results of this study show that OPTUNA hyperparameter optimization can improve classification results significantly. Evaluation using the NSL-KDD dataset, the proposed OPTUNA XGB model has generated the better accuracy performance as 0.9675 while compared to other classification models. IOT OPTUNA Hyperparameter Optimization Intrusion Detection Systems (IDS) Network Attack Figures Figure 1 Figure 2 Figure 3 Figure 4 Figure 5 Figure 6 Figure 7 Figure 8 Figure 9 1. Introduction With its enormous potential, quick growth, and profound impact, the IoT is a cutting-edge invention. The IoT is a network of devices which exchange information to allow inventive uses. IoT devices differ in size and design from lightweight gadgets to smart objects. Time and money can be saved by automating procedures with IoT. A server frequently receives data collected by cameras, instruments, and other IoT devices for monitoring and analysis. The quality of the data stored on the storage device needs to be maintained to prevent malicious attempts to alter the data, even while other individuals and infrastructure must constantly have access to it [ 1 ]. The main issue with these devices is that security is rarely considered, as the login and password are frequently left unchanged following deployment. Attackers have therefore resorted to IoT devices as their major target, attempting to hack them in order to launch Distributed Denial-of-Service (DDoS) attacks or utilize them as malware networks to steal data [ 2 ]. The 105 million malicious attacks on IoT devices that occurred in the initial half of 2019 serve as evidence of this. Several verification approaches, design concepts and procedures have been presented to accommodate for the resource limits of IoT strategies [ 3 – 4 ]. IoT networks are typically associated with CC and data centers. The fast acceptance of IoT technology has resulted in an unprecedented increase in the number of linked devices, improving convenience and efficiency across a variety of industries. However, due to their heterogeneity and limited resources, numerous security risks, including intrusion, data breaches, and network attacks, can affect IoT devices. The conventional security methods are frequently insufficient to handle these issues, requiring the creation of enhanced IDS designed specifically for IoT contexts. IDS serve as vital security events for networks, identifying unauthorized access and potential attacks by analysing network activity and internal behaviours [ 5 ]. Traditional IDS, designed for standardized and centralized networks, face limitations in adapting to the dynamic and heterogeneous IoT environment. The lack of standardization in IoT security measures, coupled with resource constraints on IoT devices, hinders the effectiveness of traditional ID methods. Additionally, the decentralized nature of IoT architectures complicates security management for traditional systems. Therefore, there is a clear need for innovative ID approaches tailored to the specific challenges of IoT networks [ 6 ]. IoT networks are vulnerable to hacker attacks due to weak security credentials, inadequate firmware vulnerability assessments, and infrequent security audits. These vulnerabilities make IoT networks, which rely on network-level communication for efficiency, prime targets for intrusion attacks, particularly within smart systems and networks [ 7 ]. ID methods include anomaly-based detection, which involves simulating and analysing behavioural patterns to uncover potentially malicious activities. Additionally, hybrid-based detection systems syndicate signature-based and intrusion-based detection methods [ 8 , 9 ]. Machine Learning (ML) based ID techniques are essential for bolstering IoT device security. They excel in data monitoring and analysis, efficiently processing large volumes of IoT data. Through algorithmic training, they can detect abnormal patterns, flagging potential threats like irregular network traffic, unauthorized access attempts, and unusual sensor readings. Continuous monitoring is essential for real-time risk identification, facilitating rapid security responses and proactive threat prevention. This approach is critical in today’s IoT security landscape to effectively mitigate ever-evolving cyber threats [ 10 ]. Moreover, IDS employing behaviour or anomaly detection goes beyond identifying specific attack signatures. Instead, they focus on detecting and analysing patterns of behaviour that are either malicious or deviate from established norms [ 11 ]. These advanced systems utilize statistical analysis, artificial intelligence, and ML techniques to thoroughly examine extensive datasets and network traffic, with the primary goal of flagging any deviations or irregularities [ 12 ]. In this study, OPTUNA, an open-source framework for efficient hyperparameter optimization is utilized to enhance the accuracy and productivity of ML approaches for IoT IDS. OPTUNA automates the hyperparameter tuning process, employing various optimization algorithms and pruning techniques to efficiently explore the hyperparameter search space [ 13 ]. By integrating seamlessly with ML libraries, OPTUNA enables the building of optimized models that can accurately detect intrusions while minimizing false positives, ultimately fortifying the security of IoT networks. Moreover, OPTUNA's support for distributed and parallel optimization, as well as its efficient resource utilization, make it particularly well-suited for the resource-constrained environment of IoT network devices. The primary contributions of this paper are listed below: Use Python modules to pre-process data to get from an open-source data repository. To create ML algorithm for the classifying challenge and train them on the pre-processed data. Using an LP classifier, evaluate ML algorithm based on several accurateness measures in order to get the best fit. To address IoT resource constraints, the models are optimized using OPTUNA, ensuring computational efficiency and suitability for real-time, resource-limited environments. The performance evaluation based on proposed OPTUNA framework with other ML models is classified as normal network traffic or attack. 2. Literature Review In the field of IoT security, researchers have investigated novel approaches to improving identification algorithms. These cutting-edge approaches have shown remarkably adept at precisely and quickly identifying security vulnerabilities in IoT environments, allowing for preventative actions to reduce risks before they have a significant negative impact. The study in [ 14 ] claims that people are becoming more conscious of the security threats connected to the extensive use of IoT devices, including as virus attacks, illegal access, and data leaks. In response to these challenges, ML algorithms have risen in importance for ID within the IoT ecosystem, owing to their ability to analyse extensive datasets and identify security breaches effectively. Among the various ML techniques available, Artificial Neural Networks (ANNs) and SVMs have emerged as the favoured options for identifying vulnerabilities in IoT systems. In a study by [ 15 ], various ML techniques, including SVM, ANN, Logistic Regression (LR), DT, NB, KNN and RF were evaluated for their suitability in IDSs using IoT datasets. Experimental comparisons of these algorithms were conducted, considering evaluation parameters. The outcomes demonstrated that the RF method performed better than other algorithms in binary classification for various assault types. The study by [ 16 ] recommended a two-phase approach for network-based identification of anomalies in homes with intelligent systems. Devices were grouped according to network traffic trends in the first step, and anomalous clusters were found in the second stage using an RF classifier. Their approach outperformed other methods in terms of identifying accuracy and efficiency when tested on a real smart home dataset. Furthermore, the ability to detect IoT-based SH HAN assaults was demonstrated by an SVM linear kernel model that used UCC data. In a separate investigation conducted by [ 17 ], an intelligent approach for detecting malicious intrusions in IoT networks was introduced. They utilized a dataset comprising both normal and attack traffic for their analysis. Their findings revealed that the RF with Information Gain and Passive Aggressive Classifier emerged as the top-performing methods in anomaly detection. The authors in [ 18 ] introduced an IDS model tailored for vehicular Ad-hoc Networks (VANETs), utilizing the ToN-IoT dataset as the foundational network dataset. This IDS model comprised several essential components, and they conducted training and testing using the same dataset. In both binary and multi-class classification scenarios, their thorough analysis of numerous ML techniques showed that XGBoost outperformed all other approaches in terms of efficacy. A hybrid deep learning model [ 19 ] combining LSTM and CNN was built to detect zero-day attacks in IoT networks. Real-time zero-day attack data was curated for the training process after identifying the top 12 features via Explainable AI. Time series GAN (TGAN) was employed to generate additional attack samples. By merging this data with the AWID dataset, the hybrid model achieved 93.53% accuracy, surpassing the 84.29% accuracy on the AWID dataset alone. Another study employs XGBoost-based feature selection algorithm with LSTM, GRU, Simple RNN to enhance detection performance on NSL-KDD and UNSW-NB15 datasets [ 20 ]. Results shows substantial improvements in test accuracy, with XGBoost-LSTM achieving 88.13% for binary classification on NSL-KDD and XGB Simple RNN achieved 87.07% for UNSW-NB15. XGB-LSTM performs better than the others on NSL-KDD as 86.93% for multiclass classification, whereas XGB-GRU performs better on UNSW-NB15 as 78.40%. Overall, the proposed IDS framework performs better than existing methods. Researchers work have attempted to achieve a sophisticated IDS by implementing ML in large-scale IoT environments [ 21 ]. Different feature extraction techniques were investigated, involving image filters and transfer learning models like DenseNet and VGG-16, complemented by different ML models such as SVC, RF, KNN and stacked models for classification. The research was performed using the IEEE Data port dataset and a top accuracy rate of 98.3 percent was achieved using the combination of VGG-16 with Stack. The novel model called TabNet-IDS [ 22 ] utilizes attentive mechanisms to automatically select important features from datasets. This model aims to enhance the explainability of the results while effectively training the IDS. It is implemented using the TabNet algorithm within the PyTorch DL framework. The outcomes demonstrate high accuracy on various tabular datasets related to IoT security, with reported accuracies of 97%, 95%, 98% for CIC-IDS2017, CSE-CICIDS2018 and CICDDoS2019 dataset. LSTM-based IDS with Dynamic Access Control (DAC) is introduced in [ 23 ]. It achieves 97.16% validation accuracy in detecting 14 different threats. It demonstrated 98% detection rate and fast 1.2 second response time, making it a highly accurate and efficient IDS for enhancing IoT security. A study proposes an intelligent framework to enhance cybersecurity in Industry 4.0 WSNs using MLP, DT and Autoencoder models for intrusion detection and threat prioritization [ 24 ]. The framework achieves high accuracy of 99.5% for MLP and DT, 91% for Autoencoder and outperforms benchmark models, offering a proactive and effective approach to prevent and mitigate cybersecurity threats by prioritizing and addressing high-risk intrusions. The study [ 25 ] evaluates feature selection and extraction techniques for ML-based ID in IoT networks using the diverse ToN-IoT dataset. Feature extraction yielded better performance with smaller feature sets, whereas feature selection excelled in reducing training and inference times. Table 1 Related word for IDS using ML & DL techniques Authors Name Methodology Used Data set Used Findings Limitations Asaduzzaman et.al. [ 19 ] CNN-LSTM AWID -GAN LSTM-CNN deep learning model detects zero-day attacks in IoT networks with 93.53% accuracy, surpassing baseline results on the AWID dataset. There were only a few real-time attacks carried out. S. M. Kasongo [ 20 ] XGBoost for Feature selection and LSTM, GRU, Simple RNN NSLKDD, UNSW -NB15 Achieves better accuracy for binary classification than multiclass classification Training time is more and performance decreases on minority classes Musleh et.al. [ 21 ] Feature extractors: VGG-16 and DenseNet. RF, KNN, SVM, and different stacked models IEEE Dataport This study examined various feature extractors and ML algorithms on IEEE Dataport dataset. Combining VGG-16 with stacking achieved the highest accuracy Difficulty in distinguishing threats Zegarra et.al. [ 22 ] TabNet CICIDS20 17, 2018, 2019 TabNet-IDS, utilizes attentive mechanisms for automatic feature selection in IoT intrusion detection. Challenge of model explainability Alazab et.al. [ 23 ] LSTM with Dynamic Access Control algorithm CICID S 2017 & BoTIoT LSTM-based IDS with Dynamic Access Control that achieves 97.16% validation accuracy in detecting 14 different threats High implementation cost using Raspberry Pi, lack of testing against adversarial ML attacks Al- Quayed et. al. [ 24 ] Decision Tree, MLP, And Autoencoder, LR WSNDS The framework achieves high accuracy of 99.5% for Decision Tree and MLP, 91% for Autoencoder WSNs' specific specialization in Industry 4.0 Li et. al. [ 25 ] DT, RF, KNN, NB, MLP with feature selection & extraction techniques ToNIoT Feature extraction outperformed feature selection in detection performance Accuracy, F1-score, and runtime need to be enhanced Abdulla & Jameel, [ 26 ] Probe, R2L, U2R and DoS attacks DT, RF and boosting algorithms NSL-KDD, UNSWNB15, And CICIDS2017 Provides an overview of different intrusion detection systems and attacks (Probe, R2L, U2R, and DoS) and analyzes the performance of different algorithms such as DT, RF, and boosting algorithms. Does not use modern datasets, such as Ton-IoT IoTID20, which include features of IoT network traffic. Ding et al., [ 27 ] DeepAK-IoT TON-IoT, Edge- IIoTset, and UNSW-NB15 An alternate deep learning approach for identifying cyberattacks on IoT devices is presented in this research. For TON IoT, the model's accuracy was 90.57%, 94.96%. The DeepAK-IoT model has less accuracy on TON-IoT dataset. Gad et al., [ 18 ] Chi2 Technique, XGBoost ToN-IoT dataset XGBoost and other boosting algorithms outperform conventional ID techniques in terms of false positive rate and accuracy. The evaluation was carried out only on a singular dataset, and only two ML algorithms were examined. The issue of missing values and a class inequity in the ToN-IoT dataset. Iftikhar et al.,[ 17 ] RF, Passive aggressive classifier UNSW-NB15 The study demonstrates that the optimum cross-validation accuracies are provided by the "RF (Information Gain)" and "Passive Aggressive Classifier" components of the suggested approach. Methodologies used are only supervised ML algorithms. Li et al.,[ 16 ] SVM with a linear kernel Real smart home environment dataset Results show with taking into consideration the detection performance and resource consumption. The best performance of any model is achieved by SVM with a linear kernel. XGBoost takes the longest time to generate a detection model and does not cover various types of attacks. It should be tested in complex environments and with different smart home devices Churcher et al., [ 15 ] KNN, ANN, SV, DT, NB, RF and LR Bot-IoT ANN predicts the type of attack more accurately than multi-classification. unable to look at a number of issues, like jamming and fault injection, to confirm that models can work across classes. 3. Dataset Description Network traffic data is collected from IoT devices using network sniffers and stored in a centralized repository. The dataset includes various types of network packets, including benign and malicious traffic, to train and test the IDS. The suggested framework was estimated for the expected structure using the NSL KDD benchmark dataset. This dataset helps researchers compare various ID approaches by acting as a successful standard. NSL-KDD datasets are used because they do not accept redundant data in the training set, which could lead to a bias in the classifier's favour of more frequent records. The dataset's 41 features, which include derived attributes like packet and connection counts as well as basic attributes like protocol type, service, and flags, characterize each instance, which is a network connection. It contains 97,831 benign instances and 333,540 attack instances. NSL-KDD contains around 60–80% of information focuses classified as normal network traffic. The remaining 20–40% of the information talks about different attack types. Following is the attack count in the NSL-KDD dataset with their labels as shown in Fig. 1 . After plotting the attack count graph, separating the labels into Attack and Normal. Figure 2 , the graph depicts 0 representing Normal traffic and 1 representing Attack. 4. Pre-processing using Standard Scalar The magnitude of the data must be normalized in order to avoid inaccurate results caused by input properties of NSL-KDD data that may exist on various scales. Standard Scalar helps normalize the network traffic data in this study. By deducting the mean value (referred as centering) and dividing by standard deviation. To achieve a mean of zero and an acceptable variation of one, the system of standardization adjusts each of the input variables separately, modifying the way it is distributed. Sometimes the characteristics in an information set, vary greatly in their ranges or measured in different units of measurements. The data are scaled to a variance of one, after the mean is reduced to zero using the Standard scaler. However, the presence of data anomalies significantly affects the corresponding empirical mean and standard deviation calculations, narrowing the range of distinctive variables. The Standard Scaler function used by sklearn rests on the idea that variables in the set of data with values, fall into various ranges. They do not contribute equally to the fitted values and learning functionality of the model. This could potentially cause discrimination in the outcomes generated by the model. Normalize attributes by eliminating mean values and scale them to unit variance. To find the average ratings of the sample (x), use the formula Z = (x-u)/s. Here, s is the test samples standard deviation and u is the mean of zero of the reference sample, if with_mean = false, and one if with_std = false. Due to Standardscaler's sensitivity to anomalies, variables might measure differentially from one another when outliers are present. 4. Research Methodology This research work presents a methodology for IDS that uses OPTUNA approaches to discover and categorize potential vulnerabilities and threats in IoT networks. First phase involves gathering the essential data required for constructing the models. In this study NSL KDD datasets are selected for experimentation. The collected data then goes through preprocessing, which includes data cleaning, selection, and normalization. This refined data is divided into training and testing sets to feed into the learning model. The Lazy Classifier used in this study offers a quick and easy method for fitting and assessing several ML models, streamlining the model process of choosing and freeing up time to concentrate on creating the optimal model for our data. Because the OPTUNA framework allows for the adjustment of parameters such as learning rate and loss functions, it has been found to be the most methodological technique. To optimize the performance of these models, the pipeline incorporates OPTUNA, a hyperparameter optimization framework. This step fine-tunes the model parameters to achieve the best possible performance. Once trained and optimized, the model produces outcomes that are then classified into two categories: normal traffic or attack. The proposed OPTUNA based LP models which are trained on the processed data to identify patterns that differentiate normal network behaviour from potential attacks. This model is created and trained using the Python programming language and a number of libraries, such as Scikit-Learn, Matplotlib, Pandas and NumPy. The data from the real-time database is cleaned and then transferred as a CSV file. The Scikit-Learn module provides the functions required to perform the hyperparameter optimizations. The figure.3 depicts the overall suggested model. The ML classifier model used in this study was developed by combining many classifiers into a single supervised LP library. The dataset is divided into train and test datasets based on models and predictions. The LP supervised library is used to evaluate the classification models. By offering a quick and easy method for fitting and assessing several ML models, LC streamlines the model selection procedure and frees up time to concentrate on creating the ideal model for our data. With the use of particular code, LP facilitates the creation of several unique, basic ML models and assists in determining which models might function more accurately without requiring parameter modification. In this study, LP is used to solve prediction-based datasets in order to classify the problem with better network congestion attack prediction from the dataset. The accuracy of the LP classifier can be improved by using the best, easily accessible ML model. According to the OPTUNA hyperparameter model, this can be accomplished by fine-tuning the hyperparameters of the top model. By analyzing network data and spotting unusual patterns suggestive of intrusions, the XGB classifier, SGD classifier, RF classifier, and SVC classifier have selected the best suited model to predict and mitigate a variety of cyberthreats. Additionally, the OPTUNA framework can be used to improve the most appropriate models selected by this XGB classifier of untuned models based on anticipated values. Hyperparameter tuning is a critical step in ML. In this suggested effort, the untuned XGB model was improved using proposed OPTUNA model. This study employs a distinct define-by-run methodology that enables users to modify the ML algorithms' hyperparameters with relative ease. OPTUNA states that optimizing hyperparameters entails either maximizing or limiting an objective function that outputs the function score after receiving a set of hyperparameters as input. OPTUNA is a powerful open-source framework for hyperparameter optimization specially designed for ML models. OPTUNA offers several key advantages: firstly, a user-friendly define-by-run style API; secondly, an effective pruning and sampling mechanism; and thirdly, simple setup procedures. OPTUNA's define-by-run API permits users to dynamically build hyperparameter search spaces through an objective function during runtime, thus offering flexible, real-time optimization without pre-defining all elements. The cost-effectiveness of hyperparameter optimization relies on efficient searching and performance estimation strategies to select and evaluate parameters effectively. OPTUNA offers both independent sampling and relational sampling methods for hyperparameter optimization. While independent sampling, like Tree-Structured Parzen Estimator (TPE), can perform well without using parameter correlations, the effectiveness of each method varies based on the environment and task. OPTUNA can handle various independent sampling methods and relational sampling methods like Covariance Matrix Adaptation Evolution Strategy (CMA-ES). Relational sampling in define-by-run frameworks implementation can be challenging, but OPTUNA can identify trial results indicative of parameter correlations, enabling the use of relational sampling algorithms like CMA-ES and GP-BO as optimization progresses. Specifically, OPTUNA permits customized sampling procedures. Pruning involves monitoring intermediate objective values and terminating trials that do not meet criteria. OPTUNA uses the Asynchronous Successive Halving (ASHA) algorithm, which allows for independent early stopping in a distributed environment, leading to efficient parallel processing and linear scalability. The pruning process is governed by the 'report API' for monitoring and 'should_prune API' for premature termination, ensuring optimal resource utilization. OPTUNA’s last design feature is a simple setup process that handles tasks from heavy experiments to lightweight computations. It offers flexible storage options, excels in lightweight tasks, supports in-depth analysis, and includes a web dashboard for real-time visualization. OPTUNA simplifies storage deployment, integrates seamlessly with container orchestration systems, and is easy to install. It's open-source and scales linearly for distributed computations. OPTUNA workflow for hyperparameter optimization is given below. Design the objective function: Create a function that takes hyperparameters as input and returns a performance metric for your model. Specify the hyperparameter search space: Determine the types and ranges of hyperparameters you want to optimize. Initialize an OPTUNA study: Set up a new study object for your specific optimization task. Execute the optimization process: Use the study's optimization method, providing your objective function and the desired number of trials. Retrieve optimization results: Extract the best-performing hyperparameter set and its corresponding performance metric. Finalize model training: Use the optimal hyperparameters to train your model for deployment or further evaluation. In the suggested study, the loss function was improved and the untuned lazy predict XGB model was optimized. The enhanced loss function was derived from the initial loss function, and the hyperparameters were improved using the OPTUNA framework. In this study, the optimal hyperparameter model is obtained by hyperparameter tweaking specific parameters. To find the optimal hyperparameter, 13 hyperparameters were selected for parameter optimization: ccp_alpha, max_features, min_impurity_decrease, random_state, criterion, min_samples_leaf, max_leaf_nodes, min_weight_fraction_leaf, max_depth, presort,min_impurity_split, min_samples_split and splitter. However, as seen in Table 3 , these 13 hyperparameters were selected for optimization using OPTUNA. The following is a description of the hyperparameters: At each level of the pruning method, ccp_alpha represents the cost difficulty pruning path that produces the genuine alphas and the corresponding total leaf impurity. More of the tree is pruned as alpha climbs, increasing the entire impurities of the leaves. Criterion is a function used to evaluate the degree of quality of a split. The maximum number of layers that any tree can have been denoted by max_depth. max_features is the most features that are taken into account while dividing a node. min_samples_leaf denotes the minimum number of times samples to be sorted into a tree leaf. min_samples_split denotes the minimal number of samples necessary in a node for node dividing to occur. The max_leaf_nodes hyperparameter regulates tree growth by setting a requirement on node separation. The minimum impurity decrease indicates that if splitting the node results in an impurity decrease more than or equal to this value, the node will be split. Min_weight_fraction_leaf is the percentage of input samples that arrive at the leaf node, which tackles the issue of class imbalance. When presort is enabled, the problem will be sorted first, followed by permutation. The random_state component is in charge of randomization during division. It could be a RandomState object or an integer. The default is None. 6. Results and Discussion The performance of the IDS is evaluated using a publicly available IoT network dataset. Classification model is trained using a training set that comprises 80% of the data; the remaining 20% of the data is comprises for model performance testing. This ensures accurate finding of the model's efficacy in detecting intrusions. However, the various classifier model present in the LP classifier library has performed the confusion matrix calculation to determine the diagnosis accuracy based on the prediction whether attack is normal or intrusion. Correct classifications of attack and normal records are written as True Positive (TP) and True Negative (TN), respectively. Whereas False Negative (FN) depicts an attack record that was mistakenly classified as normal, False Positive (FP) depicts a normal record that was mistakenly classified as an attack. According to Table 1, the classifier model is placed on ascending based accuracy in which several classifier models is overfitting. Table.1 Comparison of performance metrics for top models of LP classifier Model Accuracy Balanced Accuracy ROC AUC F1 Score Time taken XGBClassifier 0.96 0.96 0.96 0.96 0.01 SVC 0.95 0.95 0.95 0.95 0.02 SGD Classifier 0.94 0.94 0.94 0.94 0.03 RandomForestClassifier 0.94 0.94 0.94 0.94 0.01 LinearSVC 0.93 0.93 0.93 0.93 0.01 LabelSpreading 0.93 0.93 0.93 0.93 0.10 QuadraticDiscriminantAnalysis 0.93 0.93 0.93 0.93 0.02 Perception 0.93 0.93 0.93 0.93 0.02 PassiveAggressiveClassifier 0.93 0.93 0.93 0.93 0.01 BaggingClassifier 0.93 0.93 0.93 0.93 0.01 LGBMClassifier 0.93 0.93 0.93 0.93 0.01 LabelPropagation 0.93 0.93 0.93 0.93 0.02 KNeighborsClassifier 0.93 0.93 0.93 0.93 0.04 GaussianNB 0.93 0.93 0.93 0.93 0.01 ExtraTreesClassifier 0.93 0.93 0.93 0.93 0.02 ExtraTreeClassifier 0.93 0.93 0.93 0.93 0.01 DecisionTreeClassifier 0.93 0.93 0.93 0.93 0.07 CalibratedClassifierCV 0.93 0.93 0.93 0.93 0.01 AdaBoostClassifier 0.93 0.93 0.93 0.93 0.01 LP simplifies the model selection process and allows us to focus on constructing the optimal model for our data. This research work XGB classifier, SGD classifier, RF classifier and SVC classifier has chosen top four model to predict whether attack is normal or intrusion. Further, XGB of untuned model has chosen best fit model which can be improved using proposed OPTUNA. This study suggests adjusting the hyperparameters of the XGB model in order to maximise its performance, and then training the model using the resulting optimal parameters. In this research work require good hyper-parameter tuning in order to use a classifier to create a better system. The accuracy of the model is improved using the proposed OPTUNA framework for optimizing’s hyperparameters. Figure 4,5,6,7 illustrates the confusion matrix of XGB classifier, SGD classifier, RF classifier and SVC classifier in which TN, FP, FN and TP as a sequence value correspondingly. Based on the values of interception among four different classes in confusion matrix can determined the efficiency of classification ML model. Then, XGB is identified as best untuned ML model and the parameters of XGB classifier is represented with range of parameters and accuracy of the model is improved using the proposed OPTUNA framework for optimizing's hyperparameters. Figure 8 illustrates the confusion matrix of Proposed OPTUNA based XGB classifier in which TN, FP, FN and TP as a sequence value is 95479, 8545, 5472 and 321875 correspondingly. Table 2 illustrates the performance measures using the confusion matrix which consists of actual and predicted classifications information using the classification system. Table. 2 Confusion matrix value for various algorithm Model TP TN FP FN XGB Classifier 320496 95524 9815 5536 SGD Classifier 318496 95315 10436 7124 RF Classifier 314294 95175 12858 9044 SVC 312201 95819 14172 9179 Proposed OPTUNA XGB Classifier 321875 95479 8545 5472 The classifier comparison results for the chosen approach are shown in Table 3. It is clear from the analysis that the suggested OPTUNA XGB technique has the highest accuracy of 0.9675, followed by the classifiers for XGB, SGD, RF, and SVC. Table 3 Comparative analysis of multiple classifiers and their performance metrics Model Accuracy Precision Recall Sensitivity Specificity Proposed OPTUNA XGB 0.9675 0.9741 0.9833 0.9833 0.9179 XGB 0.9644 0.9703 0.9830 0.9830 0.9068 SGD 0.9593 0.9683 0.9781 0.9781 0.9013 RF 0.9492 0.9607 0.9720 0.9720 0.8810 SVC 0.9459 0.9566 0.9714 0.9714 0.8712 In particular, the tuned proposed OPTUNA XGB model has produced a better accuracy performance of 0.9675 when compared to other classification models like XGB, SGD, RF, and SVC, which are 0.9644, 0.9593, 0.9592, and 0.9459, respectively. Figure 9 shows the performance metrics of the classification model used to determine whether an attack is normal or an intrusion. This determined that overall true rate with respect to overall test sample amount for tuned proposed OPTUNA XGB model has better analysis when considered with actual sample and predicted samples of IDS dataset. It was found that the tuned proposed OPTUNA XGB model has a high specificity value of 0.9179 when compared to untuned XGB, SGD, RF, and SVC, respectively, based on the analysis of the scores of all classification models. Therefore, the TP rate and TN rate for tuned proposed OPTUNA XGB model is high which assist in pointing out the exact class categorization to the model. 7. Conclusion The growth of interconnected systems in an ever-evolving technological environment raises the risk of intrusion and illegal access, necessitating strict safeguards to protect sensitive data. IDS have become essential instruments for guaranteeing the security and integrity of digital assets in response to these problems. This study has effectively addressed the critical challenge of intrusion detection within IoT networks by introducing an OPTUNA, a hyperparameter optimization model. The superior performance of the proposed OPTUNA XGB model, evidenced by its heightened accuracy, precision, and computational efficiency, surpasses that of traditional ML models implementations. The proposed OPTUNA XGB model has generated the better accuracy performance as 0.9675 while compared to other classification models like XGB, SGD, RF and SVC. Notably, the model's robust feature interpretation capabilities provide invaluable insights into the critical factors governing intrusion detection in IoT networks, thereby facilitating more informed security strategies. The model's capability to generate rapid responses to potential security breaches, coupled with its interpretability makes it a powerful tool in combating cyber threats within the growing IoT ecosystem. References M. Anwer, S. M. Khan, M. U. Farooq, and Waseemullah, "Attack Detection in IoT using ML," Engineering, Technology & Applied Science Research, vol. 11, no. 3, pp. 7273–7278, Jun. 2021, https://doi.org/10.48084/etasr.4202. T. Alqurashi, "Arabic Sentiment Analysis for Twitter Data: A Systematic Literature Review," Engineering, Technology & Applied Science Research, vol. 13, no. 2, pp. 10292–10300, Apr. 2023, https://doi.org/10.48084/etasr.5662. P. Singh, Z. Elmi, V. Krishna Meriga, J. Pasha, and M. A. Dulebenets, "Internet of Things for sustainable railway transportation: Past, present, and future," Cleaner Logistics and Supply Chain, vol. 4, Jul. 2022, Art. no. 100065, https://doi.org/10.1016/j.clscn.2022.100065. H. Liu and B. Lang, "ML and Deep Learning Methods for Intrusion Detection Systems: A Survey," Applied Sciences, vol. 9, no. 20, Jan. 2019, Art. no. 4396, https://doi.org/10.3390/app9204396. DLTIDS: A dual-layer trust-based intrusion detection system for Blackhole attacks in wireless sensor networks. (2024). Nanotechnology Perceptions, 20(S6). https://doi.org/10.62441/nanontp.v20is6.13 A.Thakkar and R.Lohiya, “A review on ML and deep learning perspectives of IDS for IoT: Recent updates, security issues, and challenges”, Archives of Computational Methods in Engineering, 28(4), 3211–3243,2021,https://doi.org/10.1007/s11831-020-09496-0 S. Khanam, I.B. Ahmedy, M.Y.I.Idris, M.H. Jaward and A.Q.B.M. Sabri, “A survey of security challenges, attacks taxonomy and advanced countermeasures in the internet of things”, IEEE Access, 8, 219709–219743,2020, https://doi.org/10.1109/ACCESS.2020.3037359. A.A.Alsulami, Q. Abu Al-Haija, A.Tayeb and A. Alqahtani, “An intrusion detection and classification system for IoT traffic with improved data engineering”, Applied Sciences, 12(23), 12336. https://doi.org/10.3390/app122312336,2022 N.Islam, F. Farhin, I. Sultana, M.S. Kaiser., M.S.Rahman, M. Mahmud, A.S.M. SanwarHosen, G.H. Cho, “Towards ML based intrusion detection in IoT networks”, Computers, Materials & Continua, 69(2), 2021. https://doi.org/10.32604/cmc.2021.018466 O.A.Khashan, N.M. Khafajah, W.Alomoush, & M. Alshinwan, “Innovative energy-efficient proxy Re-encryption for secure data exchange in Wireless sensor networks”, IEEE Access, 12, 23290–23304,2024, https://doi.org/10.1109/ACCESS. 2024.3360488. O.A.Khashan and N.M.Khafajah, “Efficient hybrid centralized and blockchain-based authentication architecture for heterogeneous IoT systems”, Journal of King Saud University - Computer and Information Sciences, 35(2), 726–739. 2023b,https://doi.org/10.1016/j.jksuci.2023.01.011 S. Gamage and J.Samarabandu, “Deep learning methods in network intrusion detection: A survey and an objective comparison”, Journal of Network and Computer Applications, 169, 102767, 2020, https://doi.org/10.1016/j.jnca.2020.102767 J.P.Lai, Y.L.Lin, H.C. Lin, C.Y.Shih, Y.P.Wang, and P.F. Pai, “Tree-based ML models with optuna in predicting impedance values for circuit analysis”, Micromachines, 14(2), Article 265, 2023. M.N. Bhuiyan, M.M. Rahman, M.M.Billah and D.Saha, “Internet of things (IoT): A review of its enabling technologies in healthcare applications, standards protocols, security, and market opportunities”,IEEE Internet of Things Journal, 8(13), 10474–10498, 2021, https://doi.org/10.1109/JIOT.2021.3062630 A. Churcher, R.Ullah, J. Ahmad, S.Ur Rehman, F.Masood, M.Gogate, F.Alqahtani, B. Nour and W.J.Buchanan, “An experimental analysis of attack classification using ML in IoT networks”,Sensors, 21(2), 446, 2021, https://doi.org/10.3390/s21020446. X.Li, H.Ghodosi, C.Chen, M. ankupellay and I. Lee, “Improving network-based anomaly detection in smart home environment” Sensors, 22(15), 5626, 2022,https://doi.org/10.3390/ s22155626. S.Iftikhar, D.Khan, D.K.Al-Madani, M.A.Alheeti and K.Fatima, K. “An intelligent detection of malicious intrusions in IoT based on ML and deep learning techniques”, Computer Science, 30(3), 90,2022. A.R. Gad, A.A.Nashat and T.M.Barkat, “Intrusion detection system using ML for vehicular ad hoc networks based on ToN-IoT dataset”, IEEE Access, 9, 142206–142217, 2021,https://doi.org/10.1109/ACCESS.2021.3120626. M.Asaduzzaman and M.M.Rahman, “An Adversarial Approach for Intrusion Detection Using Hybrid Deep Learning Model”, In 2022 International Conference on Information Technology Research and Innovation (ICITRI) (pp. 18-23). IEEE,2022. S.M.Kasongo, “A deep learning technique for intrusion detection system using a Recurrent Neural Networks based framework”, Computer Communications, 199, 113-125,2023. M.Dhiaa, F. Alhaidari, Atta-ur-Rahman and R.A.M.Mustafa, “Intrusion Detection System Using Feature Extraction with ML Algorithms in IoT”, Journal of Sensor and Actuator Networks, 12(2), Article 29,2023. D.Zegarra Rodríguez, O.Daniel Okey, S.S. Maidin, E.Umoren Udo and J.H. Kleinschmidt, “Attentive transformer deep learning algorithm for intrusion detection on IoT systems using automatic Xplainable feature selection”, PLOS ONE, 18(10), Article e0286652,2023. M. Alazab, M.Alazab, A. Shalaginov, A.Mesleh, F. Awaysheh, “A Novel IDS with a Dynamic Access Control Algorithm to Detect and Defend Intrusion at IoT Nodes”, Sensors, 24(7), Article 2188,2024. F. Al-Quayed, Z.Ahmad, and M.Humayun, “A situation based predictive approach for cybersecurity intrusion detection and prevention using ML and deep learning algorithms in wireless sensor networks of industry 4.0”, IEEE Access,2024. J.Li, M.S. Othman, H.Chen, Y.Ding, M.Faisal, J.Huang, “Optimizing IoT intrusion detection system: feature selection versus feature extraction in ML”, Journal of Big Data, 11, Article 36,2024. A.R.Abdulla and N.G.M.Jameel, “A review on IoT intrusion detection systems using supervised ML: Techniques, datasets, and algorithms”, UHD Journal of Science and Technology, 7(1), 53–65, 2023.https://doi.org/10.21928/uhdjst.v7n1y2023.pp53-65. W. Ding, M. Abdel-Basset and R.Mohamed, “DeepAKIoT: An effective deep learning model for cyberattack detection in IoT networks”, Information Sciences, 634, 157–171,2023. https://doi.org/10.1016/j.ins.2023.03.052 Additional Declarations The authors declare potential competing interests as follows: The authors declare that they have no competing interests. Cite Share Download PDF Status: Posted Version 1 posted You are reading this latest preprint version Research Square lets you share your work early, gain feedback from the community, and start making changes to your manuscript prior to peer review in a journal. As a division of Research Square Company, we’re committed to making research communication faster, fairer, and more useful. We do this by developing innovative software and high quality services for the global research community. Our growing team is made up of researchers and industry professionals working together to solve the most critical problems facing scientific publishing. Also discoverable on Platform About Our Team In Review Editorial Policies Advisory Board Help Center Resources Author Services Accessibility API Access RSS feed Manage Cookie Preferences © Research Square 2026 | ISSN 2693-5015 (online) Privacy Policy Terms of Service Do Not Sell My Personal Information {"props":{"pageProps":{"initialData":{"identity":"rs-7538012","acceptedTermsAndConditions":true,"allowDirectSubmit":true,"archivedVersions":[],"articleType":"Research Article","associatedPublications":[],"authors":[{"id":510369093,"identity":"897b6257-31f4-4712-aeeb-fd3bf3efba72","order_by":0,"name":"Abubucker Samsudeen Shaffi","email":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAZAAAAAyAQMAAABI0h/eAAAABlBMVEX///8AAABVwtN+AAAACXBIWXMAAA7EAAAOxAGVKw4bAAABWklEQVRIie2RMUvDQBSAXyjklqtZLzSmf+FCIB1a8K9cENIlguCSIeBBoR2sdA34Fxz0H5wEziUibgUd0iVThrplqOJVa2mpUEfBfMPxjnsf7957ADU1fxECujrZMlRBz8YGgCYiAOvgK6GxRwlcbHIAkQFg/bcKULFHMa4GMq/iwO5wVOQVo5b7eE2FiHtYR6OnHKKuz9EF2yzyIvvOWIauJXDHGTOKvWmpFBlgHWdnFLK+z/HDzWaZaeiRJo/8RP2ENKuFUjKavvJUXcOAaMPU5+RkU2krxXzj0XkCqDAXqoqbZFTcLZV22a+09x2FKqXV5CEjAF4LK4Ua45VCkASN7yiO6sW1ZOAkDey1LKWQqX666iVsEKaeh9u92M8DOSvj4zZBo8IsGT0yJultriZmG+h+Np/H3cMJutxqf816/mQ9UUw/F6b/mL+1KvEdoXxvck1NTc1/4AOJ/n3rQCoSawAAAABJRU5ErkJggg==","orcid":"https://orcid.org/0009-0003-2533-0540","institution":"Gulf College","correspondingAuthor":true,"prefix":"","firstName":"Abubucker","middleName":"Samsudeen","lastName":"Shaffi","suffix":""}],"badges":[],"createdAt":"2025-09-04 16:28:35","currentVersionCode":1,"declarations":{"humanSubjects":true,"vertebrateSubjects":true,"conflictsOfInterestStatement":true,"humanSubjectEthicalGuidelines":true,"humanSubjectConsent":true,"humanSubjectClinicalTrial":false,"humanSubjectCaseReport":false,"vertebrateSubjectEthicalGuidelines":true},"doi":"10.21203/rs.3.rs-7538012/v1","doiUrl":"https://doi.org/10.21203/rs.3.rs-7538012/v1","draftVersion":[],"editorialEvents":[],"editorialNote":"","failedWorkflow":false,"files":[{"id":90667965,"identity":"cb722599-dc32-4bc2-9b47-9ff7161e38e2","added_by":"auto","created_at":"2025-09-05 13:06:31","extension":"png","order_by":1,"title":"Figure 1","display":"","copyAsset":false,"role":"figure","size":32491,"visible":true,"origin":"","legend":"\u003cp\u003eAttack Count\u003c/p\u003e","description":"","filename":"1.png","url":"https://assets-eu.researchsquare.com/files/rs-7538012/v1/a44b02520f2effcb5c703715.png"},{"id":90667963,"identity":"4d861901-31c0-46bc-8e0f-c73acd7b276e","added_by":"auto","created_at":"2025-09-05 13:06:31","extension":"png","order_by":2,"title":"Figure 2","display":"","copyAsset":false,"role":"figure","size":10916,"visible":true,"origin":"","legend":"\u003cp\u003eSeparating the labels into Attack and Normal\u003c/p\u003e","description":"","filename":"2.png","url":"https://assets-eu.researchsquare.com/files/rs-7538012/v1/ad881e4d4d02705f201d98fa.png"},{"id":90667967,"identity":"394983f0-c32a-4cc2-9f6d-9830f2380855","added_by":"auto","created_at":"2025-09-05 13:06:31","extension":"png","order_by":3,"title":"Figure 3","display":"","copyAsset":false,"role":"figure","size":58004,"visible":true,"origin":"","legend":"\u003cp\u003eThe Proposed Framework\u003c/p\u003e","description":"","filename":"3.png","url":"https://assets-eu.researchsquare.com/files/rs-7538012/v1/d9143742e20463814cb3a535.png"},{"id":90669016,"identity":"13d3c0d6-3c50-4ae4-9b22-a2940474d584","added_by":"auto","created_at":"2025-09-05 13:14:31","extension":"png","order_by":4,"title":"Figure 4","display":"","copyAsset":false,"role":"figure","size":29403,"visible":true,"origin":"","legend":"\u003cp\u003eConfusion matrix for XGB classifier\u003c/p\u003e","description":"","filename":"4.png","url":"https://assets-eu.researchsquare.com/files/rs-7538012/v1/af4b4abc9acd1af487bf2021.png"},{"id":90669015,"identity":"6a56011d-b612-4dd8-a58a-53a5048ba5e4","added_by":"auto","created_at":"2025-09-05 13:14:31","extension":"png","order_by":5,"title":"Figure 5","display":"","copyAsset":false,"role":"figure","size":25829,"visible":true,"origin":"","legend":"\u003cp\u003eConfusion matrix for SGD classifier\u003c/p\u003e","description":"","filename":"5.png","url":"https://assets-eu.researchsquare.com/files/rs-7538012/v1/48f6722db6092f1731c93969.png"},{"id":90667628,"identity":"f5202656-f518-444e-abdb-a417a79307d8","added_by":"auto","created_at":"2025-09-05 12:58:31","extension":"png","order_by":6,"title":"Figure 6","display":"","copyAsset":false,"role":"figure","size":26844,"visible":true,"origin":"","legend":"\u003cp\u003eConfusion matrix for RF classifier\u003c/p\u003e","description":"","filename":"6.png","url":"https://assets-eu.researchsquare.com/files/rs-7538012/v1/0474202d2e0571dc882f5637.png"},{"id":90667968,"identity":"4cfa53a5-2e32-4780-8166-1cb804bada9f","added_by":"auto","created_at":"2025-09-05 13:06:31","extension":"png","order_by":7,"title":"Figure 7","display":"","copyAsset":false,"role":"figure","size":23400,"visible":true,"origin":"","legend":"\u003cp\u003eConfusion matrix for SVC classifier\u003c/p\u003e","description":"","filename":"7.png","url":"https://assets-eu.researchsquare.com/files/rs-7538012/v1/137183497c561e943a73a1a3.png"},{"id":90667975,"identity":"73e6c60b-5264-4a40-b105-65305860c98e","added_by":"auto","created_at":"2025-09-05 13:06:32","extension":"png","order_by":8,"title":"Figure 8","display":"","copyAsset":false,"role":"figure","size":28011,"visible":true,"origin":"","legend":"\u003cp\u003eConfusion matrix for Proposed OPTUNA based XGB classifier\u003c/p\u003e","description":"","filename":"8.png","url":"https://assets-eu.researchsquare.com/files/rs-7538012/v1/3e57dd0b470d9f975ed419e6.png"},{"id":90667631,"identity":"90881230-f317-4624-8edb-5dbe194cded4","added_by":"auto","created_at":"2025-09-05 12:58:31","extension":"png","order_by":9,"title":"Figure 9","display":"","copyAsset":false,"role":"figure","size":25215,"visible":true,"origin":"","legend":"\u003cp\u003eComparison of performance metrics based on proposed OPTUNA XGB model with various ML model\u003c/p\u003e","description":"","filename":"9.png","url":"https://assets-eu.researchsquare.com/files/rs-7538012/v1/6b93798b467f590d1f0d744c.png"},{"id":90669414,"identity":"aa45eec8-5761-4c4a-9d8e-bcf21e0918ba","added_by":"auto","created_at":"2025-09-05 13:22:31","extension":"pdf","order_by":0,"title":"","display":"","copyAsset":false,"role":"manuscript-pdf","size":899832,"visible":true,"origin":"","legend":"","description":"","filename":"manuscript.pdf","url":"https://assets-eu.researchsquare.com/files/rs-7538012/v1/aee2cb9d-0643-4924-906c-d7af4fdb9233.pdf"}],"financialInterests":"The authors declare potential competing interests as follows: The authors declare that they have no competing interests.","formattedTitle":"\u003cp\u003e\u003cstrong\u003eIntruder Detection System for IOT network Using Hyperparameter Optimization Framework\u003c/strong\u003e\u003c/p\u003e","fulltext":[{"header":"1. Introduction","content":"\u003cp\u003eWith its enormous potential, quick growth, and profound impact, the IoT is a cutting-edge invention. The IoT is a network of devices which exchange information to allow inventive uses. IoT devices differ in size and design from lightweight gadgets to smart objects. Time and money can be saved by automating procedures with IoT. A server frequently receives data collected by cameras, instruments, and other IoT devices for monitoring and analysis. The quality of the data stored on the storage device needs to be maintained to prevent malicious attempts to alter the data, even while other individuals and infrastructure must constantly have access to it [\u003cspan citationid=\"CR1\" class=\"CitationRef\"\u003e1\u003c/span\u003e].\u003c/p\u003e\u003cp\u003eThe main issue with these devices is that security is rarely considered, as the login and password are frequently left unchanged following deployment. Attackers have therefore resorted to IoT devices as their major target, attempting to hack them in order to launch Distributed Denial-of-Service (DDoS) attacks or utilize them as malware networks to steal data [\u003cspan citationid=\"CR2\" class=\"CitationRef\"\u003e2\u003c/span\u003e]. The 105\u0026nbsp;million malicious attacks on IoT devices that occurred in the initial half of 2019 serve as evidence of this. Several verification approaches, design concepts and procedures have been presented to accommodate for the resource limits of IoT strategies [\u003cspan citationid=\"CR3\" class=\"CitationRef\"\u003e3\u003c/span\u003e–\u003cspan citationid=\"CR4\" class=\"CitationRef\"\u003e4\u003c/span\u003e]. IoT networks are typically associated with CC and data centers. The fast acceptance of IoT technology has resulted in an unprecedented increase in the number of linked devices, improving convenience and efficiency across a variety of industries. However, due to their heterogeneity and limited resources, numerous security risks, including intrusion, data breaches, and network attacks, can affect IoT devices. The conventional security methods are frequently insufficient to handle these issues, requiring the creation of enhanced IDS designed specifically for IoT contexts. IDS serve as vital security events for networks, identifying unauthorized access and potential attacks by analysing network activity and internal behaviours [\u003cspan citationid=\"CR5\" class=\"CitationRef\"\u003e5\u003c/span\u003e].\u003c/p\u003e\u003cp\u003eTraditional IDS, designed for standardized and centralized networks, face limitations in adapting to the dynamic and heterogeneous IoT environment. The lack of standardization in IoT security measures, coupled with resource constraints on IoT devices, hinders the effectiveness of traditional ID methods. Additionally, the decentralized nature of IoT architectures complicates security management for traditional systems. Therefore, there is a clear need for innovative ID approaches tailored to the specific challenges of IoT networks [\u003cspan citationid=\"CR6\" class=\"CitationRef\"\u003e6\u003c/span\u003e]. IoT networks are vulnerable to hacker attacks due to weak security credentials, inadequate firmware vulnerability assessments, and infrequent security audits. These vulnerabilities make IoT networks, which rely on network-level communication for efficiency, prime targets for intrusion attacks, particularly within smart systems and networks [\u003cspan citationid=\"CR7\" class=\"CitationRef\"\u003e7\u003c/span\u003e]. ID methods include anomaly-based detection, which involves simulating and analysing behavioural patterns to uncover potentially malicious activities. Additionally, hybrid-based detection systems syndicate signature-based and intrusion-based detection methods [\u003cspan citationid=\"CR8\" class=\"CitationRef\"\u003e8\u003c/span\u003e, \u003cspan citationid=\"CR9\" class=\"CitationRef\"\u003e9\u003c/span\u003e].\u003c/p\u003e\u003cp\u003eMachine Learning (ML) based ID techniques are essential for bolstering IoT device security. They excel in data monitoring and analysis, efficiently processing large volumes of IoT data. Through algorithmic training, they can detect abnormal patterns, flagging potential threats like irregular network traffic, unauthorized access attempts, and unusual sensor readings. Continuous monitoring is essential for real-time risk identification, facilitating rapid security responses and proactive threat prevention. This approach is critical in today’s IoT security landscape to effectively mitigate ever-evolving cyber threats [\u003cspan citationid=\"CR10\" class=\"CitationRef\"\u003e10\u003c/span\u003e]. Moreover, IDS employing behaviour or anomaly detection goes beyond identifying specific attack signatures. Instead, they focus on detecting and analysing patterns of behaviour that are either malicious or deviate from established norms [\u003cspan citationid=\"CR11\" class=\"CitationRef\"\u003e11\u003c/span\u003e]. These advanced systems utilize statistical analysis, artificial intelligence, and ML techniques to thoroughly examine extensive datasets and network traffic, with the primary goal of flagging any deviations or irregularities [\u003cspan citationid=\"CR12\" class=\"CitationRef\"\u003e12\u003c/span\u003e].\u003c/p\u003e\u003cp\u003eIn this study, OPTUNA, an open-source framework for efficient hyperparameter optimization is utilized to enhance the accuracy and productivity of ML approaches for IoT IDS. OPTUNA automates the hyperparameter tuning process, employing various optimization algorithms and pruning techniques to efficiently explore the hyperparameter search space [\u003cspan citationid=\"CR13\" class=\"CitationRef\"\u003e13\u003c/span\u003e]. By integrating seamlessly with ML libraries, OPTUNA enables the building of optimized models that can accurately detect intrusions while minimizing false positives, ultimately fortifying the security of IoT networks. Moreover, OPTUNA's support for distributed and parallel optimization, as well as its efficient resource utilization, make it particularly well-suited for the resource-constrained environment of IoT network devices.\u003c/p\u003e\u003cp\u003eThe primary contributions of this paper are listed below:\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003col\u003e\u003cspan\u003e\u003cli\u003e\u003cp\u003eUse Python modules to pre-process data to get from an open-source data repository.\u003c/p\u003e\u003c/li\u003e\u003c/span\u003e\u003cspan\u003e\u003cli\u003e\u003cp\u003eTo create ML algorithm for the classifying challenge and train them on the pre-processed data.\u003c/p\u003e\u003c/li\u003e\u003c/span\u003e\u003cspan\u003e\u003cli\u003e\u003cp\u003eUsing an LP classifier, evaluate ML algorithm based on several accurateness measures in order to get the best fit.\u003c/p\u003e\u003c/li\u003e\u003c/span\u003e\u003cspan\u003e\u003cli\u003e\u003cp\u003eTo address IoT resource constraints, the models are optimized using OPTUNA, ensuring computational efficiency and suitability for real-time, resource-limited environments.\u003c/p\u003e\u003c/li\u003e\u003c/span\u003e\u003cspan\u003e\u003cli\u003e\u003cp\u003eThe performance evaluation based on proposed OPTUNA framework with other ML models is classified as normal network traffic or attack.\u003c/p\u003e\u003c/li\u003e\u003c/span\u003e\u003c/ol\u003e\u003cp\u003e\u003c/p\u003e\u003cp\u003e\u003c/p\u003e"},{"header":"2. Literature Review","content":"\u003cp\u003eIn the field of IoT security, researchers have investigated novel approaches to improving identification algorithms. These cutting-edge approaches have shown remarkably adept at precisely and quickly identifying security vulnerabilities in IoT environments, allowing for preventative actions to reduce risks before they have a significant negative impact. The study in [\u003cspan citationid=\"CR14\" class=\"CitationRef\"\u003e14\u003c/span\u003e] claims that people are becoming more conscious of the security threats connected to the extensive use of IoT devices, including as virus attacks, illegal access, and data leaks. In response to these challenges, ML algorithms have risen in importance for ID within the IoT ecosystem, owing to their ability to analyse extensive datasets and identify security breaches effectively. Among the various ML techniques available, Artificial Neural Networks (ANNs) and SVMs have emerged as the favoured options for identifying vulnerabilities in IoT systems. In a study by [\u003cspan citationid=\"CR15\" class=\"CitationRef\"\u003e15\u003c/span\u003e], various ML techniques, including SVM, ANN, Logistic Regression (LR), DT, NB, KNN and RF were evaluated for their suitability in IDSs using IoT datasets. Experimental comparisons of these algorithms were conducted, considering evaluation parameters. The outcomes demonstrated that the RF method performed better than other algorithms in binary classification for various assault types. The study by [\u003cspan citationid=\"CR16\" class=\"CitationRef\"\u003e16\u003c/span\u003e] recommended a two-phase approach for network-based identification of anomalies in homes with intelligent systems. Devices were grouped according to network traffic trends in the first step, and anomalous clusters were found in the second stage using an RF classifier. Their approach outperformed other methods in terms of identifying accuracy and efficiency when tested on a real smart home dataset. Furthermore, the ability to detect IoT-based SH HAN assaults was demonstrated by an SVM linear kernel model that used UCC data. In a separate investigation conducted by [\u003cspan citationid=\"CR17\" class=\"CitationRef\"\u003e17\u003c/span\u003e], an intelligent approach for detecting malicious intrusions in IoT networks was introduced. They utilized a dataset comprising both normal and attack traffic for their analysis. Their findings revealed that the RF with Information Gain and Passive Aggressive Classifier emerged as the top-performing methods in anomaly detection. The authors in [\u003cspan citationid=\"CR18\" class=\"CitationRef\"\u003e18\u003c/span\u003e] introduced an IDS model tailored for vehicular Ad-hoc Networks (VANETs), utilizing the ToN-IoT dataset as the foundational network dataset. This IDS model comprised several essential components, and they conducted training and testing using the same dataset. In both binary and multi-class classification scenarios, their thorough analysis of numerous ML techniques showed that XGBoost outperformed all other approaches in terms of efficacy.\u003c/p\u003e\u003cp\u003eA hybrid deep learning model [\u003cspan citationid=\"CR19\" class=\"CitationRef\"\u003e19\u003c/span\u003e] combining LSTM and CNN was built to detect zero-day attacks in IoT networks. Real-time zero-day attack data was curated for the training process after identifying the top 12 features via Explainable AI. Time series GAN (TGAN) was employed to generate additional attack samples. By merging this data with the AWID dataset, the hybrid model achieved 93.53% accuracy, surpassing the 84.29% accuracy on the AWID dataset alone. Another study employs XGBoost-based feature selection algorithm with LSTM, GRU, Simple RNN to enhance detection performance on NSL-KDD and UNSW-NB15 datasets [\u003cspan citationid=\"CR20\" class=\"CitationRef\"\u003e20\u003c/span\u003e]. Results shows substantial improvements in test accuracy, with XGBoost-LSTM achieving 88.13% for binary classification on NSL-KDD and XGB Simple RNN achieved 87.07% for UNSW-NB15. XGB-LSTM performs better than the others on NSL-KDD as 86.93% for multiclass classification, whereas XGB-GRU performs better on UNSW-NB15 as 78.40%. Overall, the proposed IDS framework performs better than existing methods. Researchers work have attempted to achieve a sophisticated IDS by implementing ML in large-scale IoT environments [\u003cspan citationid=\"CR21\" class=\"CitationRef\"\u003e21\u003c/span\u003e]. Different feature extraction techniques were investigated, involving image filters and transfer learning models like DenseNet and VGG-16, complemented by different ML models such as SVC, RF, KNN and stacked models for classification. The research was performed using the IEEE Data port dataset and a top accuracy rate of 98.3 percent was achieved using the combination of VGG-16 with Stack. The novel model called TabNet-IDS [\u003cspan citationid=\"CR22\" class=\"CitationRef\"\u003e22\u003c/span\u003e] utilizes attentive mechanisms to automatically select important features from datasets. This model aims to enhance the explainability of the results while effectively training the IDS. It is implemented using the TabNet algorithm within the PyTorch DL framework. The outcomes demonstrate high accuracy on various tabular datasets related to IoT security, with reported accuracies of 97%, 95%, 98% for CIC-IDS2017, CSE-CICIDS2018 and CICDDoS2019 dataset. LSTM-based IDS with Dynamic Access Control (DAC) is introduced in [\u003cspan citationid=\"CR23\" class=\"CitationRef\"\u003e23\u003c/span\u003e]. It achieves 97.16% validation accuracy in detecting 14 different threats. It demonstrated 98% detection rate and fast 1.2 second response time, making it a highly accurate and efficient IDS for enhancing IoT security. A study proposes an intelligent framework to enhance cybersecurity in Industry 4.0 WSNs using MLP, DT and Autoencoder models for intrusion detection and threat prioritization [\u003cspan citationid=\"CR24\" class=\"CitationRef\"\u003e24\u003c/span\u003e]. The framework achieves high accuracy of 99.5% for MLP and DT, 91% for Autoencoder and outperforms benchmark models, offering a proactive and effective approach to prevent and mitigate cybersecurity threats by prioritizing and addressing high-risk intrusions. The study [\u003cspan citationid=\"CR25\" class=\"CitationRef\"\u003e25\u003c/span\u003e] evaluates feature selection and extraction techniques for ML-based ID in IoT networks using the diverse ToN-IoT dataset. Feature extraction yielded better performance with smaller feature sets, whereas feature selection excelled in reducing training and inference times.\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cdiv class=\"gridtable\"\u003e\u003cdiv align=\"left\" class=\"colspec\" colname=\"c1\" colnum=\"1\"\u003e\u003c/div\u003e\u003cdiv align=\"left\" class=\"colspec\" colname=\"c2\" colnum=\"2\"\u003e\u003c/div\u003e\u003cdiv align=\"left\" class=\"colspec\" colname=\"c3\" colnum=\"3\"\u003e\u003c/div\u003e\u003cdiv align=\"left\" class=\"colspec\" colname=\"c4\" colnum=\"4\"\u003e\u003c/div\u003e\u003cdiv align=\"left\" class=\"colspec\" colname=\"c5\" colnum=\"5\"\u003e\u003c/div\u003e\u003ctable float=\"Yes\" id=\"Tab1\" border=\"1\"\u003e\u003ccaption language=\"En\"\u003e\u003cdiv class=\"CaptionNumber\"\u003eTable 1\u003c/div\u003e\u003cdiv class=\"CaptionContent\"\u003e\u003cp\u003eRelated word for IDS using ML \u0026amp; DL techniques\u003c/p\u003e\u003c/div\u003e\u003c/caption\u003e\u003ccolgroup cols=\"5\"\u003e\u003c/colgroup\u003e\u003cthead\u003e\u003ctr\u003e\u003cth align=\"left\" colname=\"c1\"\u003e\u003cp\u003eAuthors\u003c/p\u003e\u003cp\u003eName\u003c/p\u003e\u003c/th\u003e\u003cth align=\"left\" colname=\"c2\"\u003e\u003cp\u003eMethodology\u003c/p\u003e\u003cp\u003eUsed\u003c/p\u003e\u003c/th\u003e\u003cth align=\"left\" colname=\"c3\"\u003e\u003cp\u003eData set Used\u003c/p\u003e\u003c/th\u003e\u003cth align=\"left\" colname=\"c4\"\u003e\u003cp\u003eFindings\u003c/p\u003e\u003c/th\u003e\u003cth align=\"left\" colname=\"c5\"\u003e\u003cp\u003eLimitations\u003c/p\u003e\u003c/th\u003e\u003c/tr\u003e\u003c/thead\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd align=\"left\" colname=\"c1\"\u003e\u003cp\u003eAsaduzzaman et.al.\u003c/p\u003e\u003cp\u003e[\u003cspan citationid=\"CR19\" class=\"CitationRef\"\u003e19\u003c/span\u003e]\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"left\" colname=\"c2\"\u003e\u003cp\u003eCNN-LSTM\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"left\" colname=\"c3\"\u003e\u003cp\u003eAWID -GAN\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"left\" colname=\"c4\"\u003e\u003cp\u003eLSTM-CNN deep\u003c/p\u003e\u003cp\u003elearning model detects zero-day attacks in IoT networks with 93.53% accuracy, surpassing baseline results on the AWID dataset.\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"left\" colname=\"c5\"\u003e\u003cp\u003eThere were only a few real-time attacks carried out.\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd align=\"left\" colname=\"c1\"\u003e\u003cp\u003eS. M. Kasongo\u003c/p\u003e\u003cp\u003e[\u003cspan citationid=\"CR20\" class=\"CitationRef\"\u003e20\u003c/span\u003e]\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"left\" colname=\"c2\"\u003e\u003cp\u003eXGBoost for\u003c/p\u003e\u003cp\u003eFeature selection and\u003c/p\u003e\u003cp\u003eLSTM, GRU,\u003c/p\u003e\u003cp\u003eSimple RNN\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"left\" colname=\"c3\"\u003e\u003cp\u003eNSLKDD, UNSW -NB15\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"left\" colname=\"c4\"\u003e\u003cp\u003eAchieves better accuracy for binary classification than multiclass classification\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"left\" colname=\"c5\"\u003e\u003cp\u003eTraining time is\u003c/p\u003e\u003cp\u003emore and performance decreases on minority classes\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd align=\"left\" colname=\"c1\"\u003e\u003cp\u003eMusleh et.al.\u003c/p\u003e\u003cp\u003e[\u003cspan citationid=\"CR21\" class=\"CitationRef\"\u003e21\u003c/span\u003e]\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"left\" colname=\"c2\"\u003e\u003cp\u003eFeature extractors: VGG-16 and\u003c/p\u003e\u003cp\u003eDenseNet.\u003c/p\u003e\u003cp\u003eRF, KNN, SVM, and different stacked\u003c/p\u003e\u003cp\u003emodels\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"left\" colname=\"c3\"\u003e\u003cp\u003eIEEE Dataport\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"left\" colname=\"c4\"\u003e\u003cp\u003eThis study examined\u003c/p\u003e\u003cp\u003evarious feature extractors and ML algorithms on IEEE Dataport dataset.\u003c/p\u003e\u003cp\u003eCombining VGG-16 with stacking achieved the highest accuracy\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"left\" colname=\"c5\"\u003e\u003cp\u003eDifficulty in\u003c/p\u003e\u003cp\u003edistinguishing threats\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd align=\"left\" colname=\"c1\"\u003e\u003cp\u003eZegarra et.al. [\u003cspan citationid=\"CR22\" class=\"CitationRef\"\u003e22\u003c/span\u003e]\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"left\" colname=\"c2\"\u003e\u003cp\u003eTabNet\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"left\" colname=\"c3\"\u003e\u003cp\u003eCICIDS20\u003c/p\u003e\u003cp\u003e17, 2018, 2019\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"left\" colname=\"c4\"\u003e\u003cp\u003eTabNet-IDS, utilizes attentive mechanisms for automatic feature selection in IoT intrusion detection.\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"left\" colname=\"c5\"\u003e\u003cp\u003eChallenge of model\u003c/p\u003e\u003cp\u003eexplainability\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd align=\"left\" colname=\"c1\"\u003e\u003cp\u003eAlazab\u003c/p\u003e\u003cp\u003eet.al. [\u003cspan citationid=\"CR23\" class=\"CitationRef\"\u003e23\u003c/span\u003e]\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"left\" colname=\"c2\"\u003e\u003cp\u003eLSTM with\u003c/p\u003e\u003cp\u003eDynamic Access Control\u003c/p\u003e\u003cp\u003ealgorithm\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"left\" colname=\"c3\"\u003e\u003cp\u003eCICID S 2017\u003c/p\u003e\u003cp\u003e\u0026amp; BoTIoT\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"left\" colname=\"c4\"\u003e\u003cp\u003eLSTM-based IDS with Dynamic Access Control that achieves 97.16% validation accuracy in detecting 14 different threats\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"left\" colname=\"c5\"\u003e\u003cp\u003eHigh implementation cost using Raspberry Pi, lack of testing against adversarial ML attacks\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd align=\"left\" colname=\"c1\"\u003e\u003cp\u003eAl- Quayed et. al. [\u003cspan citationid=\"CR24\" class=\"CitationRef\"\u003e24\u003c/span\u003e]\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"left\" colname=\"c2\"\u003e\u003cp\u003eDecision\u003c/p\u003e\u003cp\u003eTree, MLP,\u003c/p\u003e\u003cp\u003eAnd Autoencoder,\u003c/p\u003e\u003cp\u003eLR\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"left\" colname=\"c3\"\u003e\u003cp\u003eWSNDS\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"left\" colname=\"c4\"\u003e\u003cp\u003eThe framework achieves high accuracy of 99.5% for Decision Tree and MLP, 91% for Autoencoder\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"left\" colname=\"c5\"\u003e\u003cp\u003eWSNs' specific specialization in Industry 4.0\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd align=\"left\" colname=\"c1\"\u003e\u003cp\u003eLi et. al. [\u003cspan citationid=\"CR25\" class=\"CitationRef\"\u003e25\u003c/span\u003e]\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"left\" colname=\"c2\"\u003e\u003cp\u003eDT, RF,\u003c/p\u003e\u003cp\u003eKNN, NB,\u003c/p\u003e\u003cp\u003eMLP with\u003c/p\u003e\u003cp\u003efeature\u003c/p\u003e\u003cp\u003eselection \u0026amp;\u003c/p\u003e\u003cp\u003eextraction\u003c/p\u003e\u003cp\u003etechniques\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"left\" colname=\"c3\"\u003e\u003cp\u003eToNIoT\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"left\" colname=\"c4\"\u003e\u003cp\u003eFeature extraction outperformed feature selection in detection performance\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"left\" colname=\"c5\"\u003e\u003cp\u003eAccuracy, F1-score, and runtime need to be enhanced\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd align=\"left\" colname=\"c1\"\u003e\u003cp\u003eAbdulla \u0026amp;\u003c/p\u003e\u003cp\u003eJameel,\u003c/p\u003e\u003cp\u003e[\u003cspan citationid=\"CR26\" class=\"CitationRef\"\u003e26\u003c/span\u003e]\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"left\" colname=\"c2\"\u003e\u003cp\u003eProbe, R2L, U2R and DoS attacks\u003c/p\u003e\u003cp\u003eDT, RF and boosting algorithms\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"left\" colname=\"c3\"\u003e\u003cp\u003eNSL-KDD, UNSWNB15,\u003c/p\u003e\u003cp\u003eAnd CICIDS2017\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"left\" colname=\"c4\"\u003e\u003cp\u003eProvides an overview of different intrusion detection systems and attacks (Probe, R2L, U2R, and DoS) and analyzes the performance of different algorithms such as DT, RF, and boosting algorithms.\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"left\" colname=\"c5\"\u003e\u003cp\u003eDoes not use modern datasets, such as Ton-IoT IoTID20, which include features of IoT\u003c/p\u003e\u003cp\u003enetwork traffic.\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd align=\"left\" colname=\"c1\"\u003e\u003cp\u003eDing et al.,\u003c/p\u003e\u003cp\u003e[\u003cspan citationid=\"CR27\" class=\"CitationRef\"\u003e27\u003c/span\u003e]\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"left\" colname=\"c2\"\u003e\u003cp\u003eDeepAK-IoT\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"left\" colname=\"c3\"\u003e\u003cp\u003eTON-IoT, Edge-\u003c/p\u003e\u003cp\u003eIIoTset, and\u003c/p\u003e\u003cp\u003eUNSW-NB15\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"left\" colname=\"c4\"\u003e\u003cp\u003eAn alternate deep learning approach for identifying cyberattacks on IoT devices is presented in this research. For TON IoT, the model's accuracy was 90.57%, 94.96%.\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"left\" colname=\"c5\"\u003e\u003cp\u003eThe DeepAK-IoT model has less accuracy on TON-IoT dataset.\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd align=\"left\" colname=\"c1\"\u003e\u003cp\u003eGad et al.,\u003c/p\u003e\u003cp\u003e[\u003cspan citationid=\"CR18\" class=\"CitationRef\"\u003e18\u003c/span\u003e]\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"left\" colname=\"c2\"\u003e\u003cp\u003eChi2 Technique, XGBoost\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"left\" colname=\"c3\"\u003e\u003cp\u003eToN-IoT dataset\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"left\" colname=\"c4\"\u003e\u003cp\u003eXGBoost and other boosting algorithms outperform conventional ID techniques in terms of false positive rate and accuracy.\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"left\" colname=\"c5\"\u003e\u003cp\u003eThe evaluation was carried out only on a\u003c/p\u003e\u003cp\u003esingular dataset, and only two ML algorithms were examined. The issue of missing values and a class inequity in the ToN-IoT dataset.\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd align=\"left\" colname=\"c1\"\u003e\u003cp\u003eIftikhar et al.,[\u003cspan citationid=\"CR17\" class=\"CitationRef\"\u003e17\u003c/span\u003e]\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"left\" colname=\"c2\"\u003e\u003cp\u003eRF, Passive aggressive classifier\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"left\" colname=\"c3\"\u003e\u003cp\u003eUNSW-NB15\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"left\" colname=\"c4\"\u003e\u003cp\u003eThe study demonstrates that the optimum cross-validation accuracies are provided by the \"RF (Information Gain)\" and \"Passive Aggressive Classifier\" components of the suggested approach.\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"left\" colname=\"c5\"\u003e\u003cp\u003eMethodologies used are only supervised\u003c/p\u003e\u003cp\u003eML algorithms.\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd align=\"left\" colname=\"c1\"\u003e\u003cp\u003eLi et al.,[\u003cspan citationid=\"CR16\" class=\"CitationRef\"\u003e16\u003c/span\u003e]\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"left\" colname=\"c2\"\u003e\u003cp\u003eSVM with a linear kernel\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"left\" colname=\"c3\"\u003e\u003cp\u003eReal smart home\u003c/p\u003e\u003cp\u003eenvironment\u003c/p\u003e\u003cp\u003edataset\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"left\" colname=\"c4\"\u003e\u003cp\u003eResults show with taking into consideration the detection performance and resource consumption. The best performance of any model is achieved by SVM with a linear kernel.\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"left\" colname=\"c5\"\u003e\u003cp\u003eXGBoost takes the longest time to generate\u003c/p\u003e\u003cp\u003ea detection model and does not cover various types of attacks. It should be tested in complex environments and with different smart home devices\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd align=\"left\" colname=\"c1\"\u003e\u003cp\u003eChurcher et al., [\u003cspan citationid=\"CR15\" class=\"CitationRef\"\u003e15\u003c/span\u003e]\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"left\" colname=\"c2\"\u003e\u003cp\u003eKNN, ANN, SV, DT, NB, RF and LR\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"left\" colname=\"c3\"\u003e\u003cp\u003eBot-IoT\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"left\" colname=\"c4\"\u003e\u003cp\u003eANN predicts the type of attack more accurately than multi-classification.\u003c/p\u003e\u003c/td\u003e\u003ctd align=\"left\" colname=\"c5\"\u003e\u003cp\u003eunable to look at a number of issues, like jamming and fault injection, to confirm that models can work across classes. \u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003c/div\u003e"},{"header":"3. Dataset Description","content":"\u003cp\u003eNetwork traffic data is collected from IoT devices using network sniffers and stored in a centralized repository. The dataset includes various types of network packets, including benign and malicious traffic, to train and test the IDS. The suggested framework was estimated for the expected structure using the NSL KDD benchmark dataset. This dataset helps researchers compare various ID approaches by acting as a successful standard. NSL-KDD datasets are used because they do not accept redundant data in the training set, which could lead to a bias in the classifier's favour of more frequent records. The dataset's 41 features, which include derived attributes like packet and connection counts as well as basic attributes like protocol type, service, and flags, characterize each instance, which is a network connection. It contains 97,831 benign instances and 333,540 attack instances. NSL-KDD contains around 60\u0026ndash;80% of information focuses classified as normal network traffic. The remaining 20\u0026ndash;40% of the information talks about different attack types. Following is the attack count in the NSL-KDD dataset with their labels as shown in Fig.\u0026nbsp;\u003cspan refid=\"Fig1\" class=\"InternalRef\"\u003e1\u003c/span\u003e. After plotting the attack count graph, separating the labels into Attack and Normal. Figure\u0026nbsp;\u003cspan refid=\"Fig2\" class=\"InternalRef\"\u003e2\u003c/span\u003e, the graph depicts 0 representing Normal traffic and 1 representing Attack.\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cp\u003e\u003c/p\u003e"},{"header":"4. Pre-processing using Standard Scalar","content":"\u003cp\u003eThe magnitude of the data must be normalized in order to avoid inaccurate results caused by input properties of NSL-KDD data that may exist on various scales. Standard Scalar helps normalize the network traffic data in this study. By deducting the mean value (referred as centering) and dividing by standard deviation. To achieve a mean of zero and an acceptable variation of one, the system of standardization adjusts each of the input variables separately, modifying the way it is distributed. Sometimes the characteristics in an information set, vary greatly in their ranges or measured in different units of measurements. The data are scaled to a variance of one, after the mean is reduced to zero using the Standard scaler. However, the presence of data anomalies significantly affects the corresponding empirical mean and standard deviation calculations, narrowing the range of distinctive variables. The Standard Scaler function used by sklearn rests on the idea that variables in the set of data with values, fall into various ranges. They do not contribute equally to the fitted values and learning functionality of the model. This could potentially cause discrimination in the outcomes generated by the model.\u003c/p\u003e\u003cp\u003eNormalize attributes by eliminating mean values and scale them to unit variance. To find the average ratings of the sample (x), use the formula Z = (x-u)/s.\u003c/p\u003e\u003cp\u003eHere, s is the test samples standard deviation and u is the mean of zero of the reference sample, if with_mean\u0026thinsp;=\u0026thinsp;false, and one if with_std\u0026thinsp;=\u0026thinsp;false. Due to Standardscaler's sensitivity to anomalies, variables might measure differentially from one another when outliers are present.\u003c/p\u003e"},{"header":"4. Research Methodology","content":"\u003cp\u003eThis research work presents a methodology for IDS that uses OPTUNA approaches to discover and categorize potential vulnerabilities and threats in IoT networks. First phase involves gathering the essential data required for constructing the models. In this study NSL KDD datasets are selected for experimentation. The collected data then goes through preprocessing, which includes data cleaning, selection, and normalization. This refined data is divided into training and testing sets to feed into the learning model. The Lazy Classifier used in this study offers a quick and easy method for fitting and assessing several ML models, streamlining the model process of choosing and freeing up time to concentrate on creating the optimal model for our data. Because the OPTUNA framework allows for the adjustment of parameters such as learning rate and loss functions, it has been found to be the most methodological technique. To optimize the performance of these models, the pipeline incorporates OPTUNA, a hyperparameter optimization framework. This step fine-tunes the model parameters to achieve the best possible performance. Once trained and optimized, the model produces outcomes that are then classified into two categories: normal traffic or attack. The proposed OPTUNA based LP models which are trained on the processed data to identify patterns that differentiate normal network behaviour from potential attacks. This model is created and trained using the Python programming language and a number of libraries, such as Scikit-Learn, Matplotlib, Pandas and NumPy. The data from the real-time database is cleaned and then transferred as a CSV file. The Scikit-Learn module provides the functions required to perform the hyperparameter optimizations. The figure.3 depicts the overall suggested model.\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cp\u003eThe ML classifier model used in this study was developed by combining many classifiers into a single supervised LP library. The dataset is divided into train and test datasets based on models and predictions. The LP supervised library is used to evaluate the classification models. By offering a quick and easy method for fitting and assessing several ML models, LC streamlines the model selection procedure and frees up time to concentrate on creating the ideal model for our data. With the use of particular code, LP facilitates the creation of several unique, basic ML models and assists in determining which models might function more accurately without requiring parameter modification. In this study, LP is used to solve prediction-based datasets in order to classify the problem with better network congestion attack prediction from the dataset. The accuracy of the LP classifier can be improved by using the best, easily accessible ML model. According to the OPTUNA hyperparameter model, this can be accomplished by fine-tuning the hyperparameters of the top model. By analyzing network data and spotting unusual patterns suggestive of intrusions, the XGB classifier, SGD classifier, RF classifier, and SVC classifier have selected the best suited model to predict and mitigate a variety of cyberthreats. Additionally, the OPTUNA framework can be used to improve the most appropriate models selected by this XGB classifier of untuned models based on anticipated values. Hyperparameter tuning is a critical step in ML. In this suggested effort, the untuned XGB model was improved using proposed OPTUNA model. This study employs a distinct define-by-run methodology that enables users to modify the ML algorithms' hyperparameters with relative ease. OPTUNA states that optimizing hyperparameters entails either maximizing or limiting an objective function that outputs the function score after receiving a set of hyperparameters as input.\u003c/p\u003e\u003cp\u003eOPTUNA is a powerful open-source framework for hyperparameter optimization specially designed for ML models. OPTUNA offers several key advantages: firstly, a user-friendly define-by-run style API; secondly, an effective pruning and sampling mechanism; and thirdly, simple setup procedures. OPTUNA's define-by-run API permits users to dynamically build hyperparameter search spaces through an objective function during runtime, thus offering flexible, real-time optimization without pre-defining all elements. The cost-effectiveness of hyperparameter optimization relies on efficient searching and performance estimation strategies to select and evaluate parameters effectively. OPTUNA offers both independent sampling and relational sampling methods for hyperparameter optimization. While independent sampling, like Tree-Structured Parzen Estimator (TPE), can perform well without using parameter correlations, the effectiveness of each method varies based on the environment and task. OPTUNA can handle various independent sampling methods and relational sampling methods like Covariance Matrix Adaptation Evolution Strategy (CMA-ES). Relational sampling in define-by-run frameworks implementation can be challenging, but OPTUNA can identify trial results indicative of parameter correlations, enabling the use of relational sampling algorithms like CMA-ES and GP-BO as optimization progresses. Specifically, OPTUNA permits customized sampling procedures.\u003c/p\u003e\u003cp\u003ePruning involves monitoring intermediate objective values and terminating trials that do not meet criteria. OPTUNA uses the Asynchronous Successive Halving (ASHA) algorithm, which allows for independent early stopping in a distributed environment, leading to efficient parallel processing and linear scalability. The pruning process is governed by the 'report API' for monitoring and 'should_prune API' for premature termination, ensuring optimal resource utilization. OPTUNA\u0026rsquo;s last design feature is a simple setup process that handles tasks from heavy experiments to lightweight computations. It offers flexible storage options, excels in lightweight tasks, supports in-depth analysis, and includes a web dashboard for real-time visualization. OPTUNA simplifies storage deployment, integrates seamlessly with container orchestration systems, and is easy to install. It's open-source and scales linearly for distributed computations. OPTUNA workflow for hyperparameter optimization is given below.\u003c/p\u003e\u003cp\u003eDesign the objective function: Create a function that takes hyperparameters as input and returns a performance metric for your model. Specify the hyperparameter search space: Determine the types and ranges of hyperparameters you want to optimize.\u003c/p\u003e\u003cp\u003eInitialize an OPTUNA study: Set up a new study object for your specific optimization task.\u003c/p\u003e\u003cp\u003e\u003col\u003e\u003cspan\u003e\u003cli\u003e\u003cp\u003eExecute the optimization process: Use the study's optimization method, providing your objective function and the desired number of trials.\u003c/p\u003e\u003c/li\u003e\u003c/span\u003e\u003cspan\u003e\u003cli\u003e\u003cp\u003eRetrieve optimization results: Extract the best-performing hyperparameter set and its corresponding performance metric.\u003c/p\u003e\u003c/li\u003e\u003c/span\u003e\u003cspan\u003e\u003cli\u003e\u003cp\u003eFinalize model training: Use the optimal hyperparameters to train your model for deployment or further evaluation.\u003c/p\u003e\u003c/li\u003e\u003c/span\u003e\u003c/ol\u003e\u003c/p\u003e\u003cp\u003eIn the suggested study, the loss function was improved and the untuned lazy predict XGB model was optimized. The enhanced loss function was derived from the initial loss function, and the hyperparameters were improved using the OPTUNA framework. In this study, the optimal hyperparameter model is obtained by hyperparameter tweaking specific parameters. To find the optimal hyperparameter, 13 hyperparameters were selected for parameter optimization: ccp_alpha, max_features, min_impurity_decrease, random_state, criterion, min_samples_leaf, max_leaf_nodes, min_weight_fraction_leaf, max_depth, presort,min_impurity_split, min_samples_split and splitter. However, as seen in Table \u003cspan refid=\"Tab3\" class=\"InternalRef\"\u003e3\u003c/span\u003e, these 13 hyperparameters were selected for optimization using OPTUNA.\u003c/p\u003e\u003cp\u003eThe following is a description of the hyperparameters:\u003c/p\u003e\u003cp\u003e\u003col\u003e\u003cspan\u003e\u003cli\u003e\u003cp\u003eAt each level of the pruning method, ccp_alpha represents the cost difficulty pruning path that produces the genuine alphas and the corresponding total leaf impurity. More of the tree is pruned as alpha climbs, increasing the entire impurities of the leaves.\u003c/p\u003e\u003c/li\u003e\u003c/span\u003e\u003cspan\u003e\u003cli\u003e\u003cp\u003eCriterion is a function used to evaluate the degree of quality of a split.\u003c/p\u003e\u003c/li\u003e\u003c/span\u003e\u003cspan\u003e\u003cli\u003e\u003cp\u003eThe maximum number of layers that any tree can have been denoted by max_depth.\u003c/p\u003e\u003c/li\u003e\u003c/span\u003e\u003cspan\u003e\u003cli\u003e\u003cp\u003emax_features is the most features that are taken into account while dividing a node.\u003c/p\u003e\u003c/li\u003e\u003c/span\u003e\u003cspan\u003e\u003cli\u003e\u003cp\u003emin_samples_leaf denotes the minimum number of times samples to be sorted into a tree leaf.\u003c/p\u003e\u003c/li\u003e\u003c/span\u003e\u003cspan\u003e\u003cli\u003e\u003cp\u003emin_samples_split denotes the minimal number of samples necessary in a node for node dividing to occur.\u003c/p\u003e\u003c/li\u003e\u003c/span\u003e\u003cspan\u003e\u003cli\u003e\u003cp\u003eThe max_leaf_nodes hyperparameter regulates tree growth by setting a requirement on node separation.\u003c/p\u003e\u003c/li\u003e\u003c/span\u003e\u003cspan\u003e\u003cli\u003e\u003cp\u003eThe minimum impurity decrease indicates that if splitting the node results in an impurity decrease more than or equal to this value, the node will be split.\u003c/p\u003e\u003c/li\u003e\u003c/span\u003e\u003cspan\u003e\u003cli\u003e\u003cp\u003eMin_weight_fraction_leaf is the percentage of input samples that arrive at the leaf node, which tackles the issue of class imbalance. When presort is enabled, the problem will be sorted first, followed by permutation.\u003c/p\u003e\u003c/li\u003e\u003c/span\u003e\u003cspan\u003e\u003cli\u003e\u003cp\u003eThe random_state component is in charge of randomization during division. It could be a RandomState object or an integer. The default is None.\u003c/p\u003e\u003c/li\u003e\u003c/span\u003e\u003c/ol\u003e\u003c/p\u003e"},{"header":"6. Results and Discussion","content":"\u003cp\u003eThe performance of the IDS is evaluated using a publicly available IoT network dataset. Classification model is trained using a training set that comprises 80% of the data; the remaining 20% of the data is comprises for model performance testing. This ensures accurate finding of the model\u0026apos;s efficacy in detecting intrusions. However, the various classifier model present in the LP classifier library has performed the confusion matrix calculation to determine the diagnosis accuracy based on the prediction whether attack is normal or intrusion. Correct classifications of attack and normal records are written as True Positive (TP) and True Negative (TN), respectively. Whereas False Negative (FN) depicts an attack record that was mistakenly classified as normal, False Positive (FP) depicts a normal record that was mistakenly classified as an attack. According to Table 1, the classifier model is placed on ascending based accuracy in which several classifier models is overfitting.\u003c/p\u003e\n\u003cp\u003eTable.1 Comparison of performance metrics for top models of LP classifier\u003c/p\u003e\n\u003ctable border=\"1\" cellspacing=\"0\" cellpadding=\"0\" width=\"617\"\u003e\n \u003ctbody\u003e\n \u003ctr\u003e\n \u003ctd valign=\"top\" style=\"width: 232px;\"\u003e\n \u003cp\u003e\u003cstrong\u003eModel\u003c/strong\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 86px;\"\u003e\n \u003cp\u003e\u003cstrong\u003eAccuracy\u003c/strong\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 86px;\"\u003e\n \u003cp\u003e\u003cstrong\u003eBalanced Accuracy\u003c/strong\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 69px;\"\u003e\n \u003cp\u003e\u003cstrong\u003eROC AUC\u003c/strong\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 72px;\"\u003e\n \u003cp\u003e\u003cstrong\u003eF1 Score\u003c/strong\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 72px;\"\u003e\n \u003cp\u003e\u003cstrong\u003eTime taken\u003c/strong\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd valign=\"top\" style=\"width: 232px;\"\u003e\n \u003cp\u003eXGBClassifier\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 86px;\"\u003e\n \u003cp\u003e0.96\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 86px;\"\u003e\n \u003cp\u003e0.96\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 69px;\"\u003e\n \u003cp\u003e0.96\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 72px;\"\u003e\n \u003cp\u003e0.96\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 72px;\"\u003e\n \u003cp\u003e0.01\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd valign=\"top\" style=\"width: 232px;\"\u003e\n \u003cp\u003eSVC\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 86px;\"\u003e\n \u003cp\u003e0.95\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 86px;\"\u003e\n \u003cp\u003e0.95\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 69px;\"\u003e\n \u003cp\u003e0.95\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 72px;\"\u003e\n \u003cp\u003e0.95\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 72px;\"\u003e\n \u003cp\u003e0.02\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd valign=\"top\" style=\"width: 232px;\"\u003e\n \u003cp\u003eSGD Classifier\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 86px;\"\u003e\n \u003cp\u003e0.94\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 86px;\"\u003e\n \u003cp\u003e0.94\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 69px;\"\u003e\n \u003cp\u003e0.94\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 72px;\"\u003e\n \u003cp\u003e0.94\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 72px;\"\u003e\n \u003cp\u003e0.03\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd valign=\"top\" style=\"width: 232px;\"\u003e\n \u003cp\u003eRandomForestClassifier\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 86px;\"\u003e\n \u003cp\u003e0.94\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 86px;\"\u003e\n \u003cp\u003e0.94\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 69px;\"\u003e\n \u003cp\u003e0.94\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 72px;\"\u003e\n \u003cp\u003e0.94\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 72px;\"\u003e\n \u003cp\u003e0.01\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd valign=\"top\" style=\"width: 232px;\"\u003e\n \u003cp\u003eLinearSVC\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 86px;\"\u003e\n \u003cp\u003e0.93\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 86px;\"\u003e\n \u003cp\u003e0.93\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 69px;\"\u003e\n \u003cp\u003e0.93\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 72px;\"\u003e\n \u003cp\u003e0.93\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 72px;\"\u003e\n \u003cp\u003e0.01\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd valign=\"top\" style=\"width: 232px;\"\u003e\n \u003cp\u003eLabelSpreading\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 86px;\"\u003e\n \u003cp\u003e0.93\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 86px;\"\u003e\n \u003cp\u003e0.93\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 69px;\"\u003e\n \u003cp\u003e0.93\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 72px;\"\u003e\n \u003cp\u003e0.93\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 72px;\"\u003e\n \u003cp\u003e0.10\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd valign=\"top\" style=\"width: 232px;\"\u003e\n \u003cp\u003eQuadraticDiscriminantAnalysis\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 86px;\"\u003e\n \u003cp\u003e0.93\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 86px;\"\u003e\n \u003cp\u003e0.93\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 69px;\"\u003e\n \u003cp\u003e0.93\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 72px;\"\u003e\n \u003cp\u003e0.93\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 72px;\"\u003e\n \u003cp\u003e0.02\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd valign=\"top\" style=\"width: 232px;\"\u003e\n \u003cp\u003ePerception\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 86px;\"\u003e\n \u003cp\u003e0.93\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 86px;\"\u003e\n \u003cp\u003e0.93\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 69px;\"\u003e\n \u003cp\u003e0.93\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 72px;\"\u003e\n \u003cp\u003e0.93\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 72px;\"\u003e\n \u003cp\u003e0.02\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd valign=\"top\" style=\"width: 232px;\"\u003e\n \u003cp\u003ePassiveAggressiveClassifier\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 86px;\"\u003e\n \u003cp\u003e0.93\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 86px;\"\u003e\n \u003cp\u003e0.93\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 69px;\"\u003e\n \u003cp\u003e0.93\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 72px;\"\u003e\n \u003cp\u003e0.93\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 72px;\"\u003e\n \u003cp\u003e0.01\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd valign=\"top\" style=\"width: 232px;\"\u003e\n \u003cp\u003eBaggingClassifier\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 86px;\"\u003e\n \u003cp\u003e0.93\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 86px;\"\u003e\n \u003cp\u003e0.93\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 69px;\"\u003e\n \u003cp\u003e0.93\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 72px;\"\u003e\n \u003cp\u003e0.93\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 72px;\"\u003e\n \u003cp\u003e0.01\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd valign=\"top\" style=\"width: 232px;\"\u003e\n \u003cp\u003eLGBMClassifier\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 86px;\"\u003e\n \u003cp\u003e0.93\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 86px;\"\u003e\n \u003cp\u003e0.93\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 69px;\"\u003e\n \u003cp\u003e0.93\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 72px;\"\u003e\n \u003cp\u003e0.93\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 72px;\"\u003e\n \u003cp\u003e0.01\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd valign=\"top\" style=\"width: 232px;\"\u003e\n \u003cp\u003eLabelPropagation\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 86px;\"\u003e\n \u003cp\u003e0.93\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 86px;\"\u003e\n \u003cp\u003e0.93\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 69px;\"\u003e\n \u003cp\u003e0.93\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 72px;\"\u003e\n \u003cp\u003e0.93\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 72px;\"\u003e\n \u003cp\u003e0.02\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd valign=\"top\" style=\"width: 232px;\"\u003e\n \u003cp\u003eKNeighborsClassifier\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 86px;\"\u003e\n \u003cp\u003e0.93\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 86px;\"\u003e\n \u003cp\u003e0.93\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 69px;\"\u003e\n \u003cp\u003e0.93\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 72px;\"\u003e\n \u003cp\u003e0.93\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 72px;\"\u003e\n \u003cp\u003e0.04\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd valign=\"top\" style=\"width: 232px;\"\u003e\n \u003cp\u003eGaussianNB\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 86px;\"\u003e\n \u003cp\u003e0.93\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 86px;\"\u003e\n \u003cp\u003e0.93\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 69px;\"\u003e\n \u003cp\u003e0.93\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 72px;\"\u003e\n \u003cp\u003e0.93\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 72px;\"\u003e\n \u003cp\u003e0.01\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd valign=\"top\" style=\"width: 232px;\"\u003e\n \u003cp\u003eExtraTreesClassifier\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 86px;\"\u003e\n \u003cp\u003e0.93\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 86px;\"\u003e\n \u003cp\u003e0.93\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 69px;\"\u003e\n \u003cp\u003e0.93\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 72px;\"\u003e\n \u003cp\u003e0.93\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 72px;\"\u003e\n \u003cp\u003e0.02\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd valign=\"top\" style=\"width: 232px;\"\u003e\n \u003cp\u003eExtraTreeClassifier\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 86px;\"\u003e\n \u003cp\u003e0.93\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 86px;\"\u003e\n \u003cp\u003e0.93\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 69px;\"\u003e\n \u003cp\u003e0.93\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 72px;\"\u003e\n \u003cp\u003e0.93\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 72px;\"\u003e\n \u003cp\u003e0.01\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd valign=\"top\" style=\"width: 232px;\"\u003e\n \u003cp\u003eDecisionTreeClassifier\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 86px;\"\u003e\n \u003cp\u003e0.93\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 86px;\"\u003e\n \u003cp\u003e0.93\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 69px;\"\u003e\n \u003cp\u003e0.93\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 72px;\"\u003e\n \u003cp\u003e0.93\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 72px;\"\u003e\n \u003cp\u003e0.07\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd valign=\"top\" style=\"width: 232px;\"\u003e\n \u003cp\u003eCalibratedClassifierCV\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 86px;\"\u003e\n \u003cp\u003e0.93\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 86px;\"\u003e\n \u003cp\u003e0.93\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 69px;\"\u003e\n \u003cp\u003e0.93\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 72px;\"\u003e\n \u003cp\u003e0.93\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 72px;\"\u003e\n \u003cp\u003e0.01\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd valign=\"top\" style=\"width: 232px;\"\u003e\n \u003cp\u003eAdaBoostClassifier\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 86px;\"\u003e\n \u003cp\u003e0.93\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 86px;\"\u003e\n \u003cp\u003e0.93\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 69px;\"\u003e\n \u003cp\u003e0.93\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 72px;\"\u003e\n \u003cp\u003e0.93\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"top\" style=\"width: 72px;\"\u003e\n \u003cp\u003e0.01\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003c/tbody\u003e\n\u003c/table\u003e\n\u003cp\u003eLP simplifies the model selection process and allows us to focus on constructing the optimal model for our data. This research work XGB classifier, SGD classifier, RF classifier and SVC classifier has chosen top four model to predict whether attack is normal or intrusion. Further, XGB of untuned model has chosen best fit model which can be improved using proposed OPTUNA. This study suggests adjusting the hyperparameters of the XGB model in order to maximise its performance, and then training the model using the resulting optimal parameters. In this research work require good hyper-parameter tuning in order to use a classifier to create a better system.\u0026nbsp;\u003c/p\u003e\n\u003cp\u003eThe accuracy of the model is improved using the proposed OPTUNA framework for optimizing\u0026rsquo;s hyperparameters.\u003c/p\u003e\n\u003cp\u003eFigure 4,5,6,7 illustrates the confusion matrix of XGB classifier, SGD classifier, RF classifier and SVC classifier in which TN, FP, FN and TP as a sequence value correspondingly. Based on the values of interception among four different classes in confusion matrix can determined the efficiency of classification ML model.\u003c/p\u003e\n\u003cp\u003eThen, XGB is identified as best untuned ML model and the parameters of XGB classifier is represented with range of parameters and accuracy of the model is improved\u0026nbsp;using the proposed OPTUNA framework for\u0026nbsp;optimizing\u0026apos;s\u0026nbsp;hyperparameters. Figure 8 illustrates the confusion matrix of Proposed OPTUNA based XGB classifier in which TN, FP, FN and TP as a sequence value is 95479, 8545, 5472 and 321875 correspondingly. Table 2 illustrates the performance measures using the confusion matrix which consists of actual and predicted classifications information using the classification system.\u003c/p\u003e\n\u003cp\u003eTable. 2 Confusion matrix value for various algorithm\u003c/p\u003e\n\u003ctable border=\"0\" cellspacing=\"0\" cellpadding=\"0\" width=\"302\"\u003e\n \u003ctbody\u003e\n \u003ctr\u003e\n \u003ctd valign=\"bottom\" style=\"width: 104px;\"\u003e\n \u003cp\u003e\u003cstrong\u003eModel\u003c/strong\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"bottom\" style=\"width: 57px;\"\u003e\n \u003cp\u003e\u003cstrong\u003eTP\u003c/strong\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"bottom\" style=\"width: 48px;\"\u003e\n \u003cp\u003e\u003cstrong\u003eTN\u003c/strong\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"bottom\" style=\"width: 48px;\"\u003e\n \u003cp\u003e\u003cstrong\u003eFP\u003c/strong\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"bottom\" style=\"width: 46px;\"\u003e\n \u003cp\u003e\u003cstrong\u003eFN\u003c/strong\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd valign=\"bottom\" style=\"width: 104px;\"\u003e\n \u003cp\u003eXGB Classifier\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"bottom\" style=\"width: 57px;\"\u003e\n \u003cp\u003e320496\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"bottom\" style=\"width: 48px;\"\u003e\n \u003cp\u003e95524\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"bottom\" style=\"width: 48px;\"\u003e\n \u003cp\u003e9815\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"bottom\" style=\"width: 46px;\"\u003e\n \u003cp\u003e5536\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd valign=\"bottom\" style=\"width: 104px;\"\u003e\n \u003cp\u003eSGD Classifier\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"bottom\" style=\"width: 57px;\"\u003e\n \u003cp\u003e318496\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"bottom\" style=\"width: 48px;\"\u003e\n \u003cp\u003e95315\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"bottom\" style=\"width: 48px;\"\u003e\n \u003cp\u003e10436\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"bottom\" style=\"width: 46px;\"\u003e\n \u003cp\u003e7124\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd valign=\"bottom\" style=\"width: 104px;\"\u003e\n \u003cp\u003eRF Classifier\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"bottom\" style=\"width: 57px;\"\u003e\n \u003cp\u003e314294\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"bottom\" style=\"width: 48px;\"\u003e\n \u003cp\u003e95175\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"bottom\" style=\"width: 48px;\"\u003e\n \u003cp\u003e12858\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"bottom\" style=\"width: 46px;\"\u003e\n \u003cp\u003e9044\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd valign=\"bottom\" style=\"width: 104px;\"\u003e\n \u003cp\u003eSVC\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"bottom\" style=\"width: 57px;\"\u003e\n \u003cp\u003e312201\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"bottom\" style=\"width: 48px;\"\u003e\n \u003cp\u003e95819\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"bottom\" style=\"width: 48px;\"\u003e\n \u003cp\u003e14172\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"bottom\" style=\"width: 46px;\"\u003e\n \u003cp\u003e9179\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd valign=\"bottom\" style=\"width: 104px;\"\u003e\n \u003cp\u003eProposed OPTUNA XGB Classifier\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"bottom\" style=\"width: 57px;\"\u003e\n \u003cp\u003e321875\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"bottom\" style=\"width: 48px;\"\u003e\n \u003cp\u003e95479\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"bottom\" style=\"width: 48px;\"\u003e\n \u003cp\u003e8545\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"bottom\" style=\"width: 46px;\"\u003e\n \u003cp\u003e5472\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003c/tbody\u003e\n\u003c/table\u003e\n\u003cp\u003eThe classifier comparison results for the chosen approach are shown in Table 3. It is clear from the analysis that the suggested OPTUNA XGB technique has the highest accuracy of 0.9675, followed by the classifiers for XGB, SGD, RF, and SVC.\u003c/p\u003e\n\u003cp\u003eTable 3 Comparative analysis of multiple classifiers and their performance metrics\u003c/p\u003e\n\u003ctable border=\"0\" cellspacing=\"0\" cellpadding=\"0\" width=\"287\"\u003e\n \u003ctbody\u003e\n \u003ctr\u003e\n \u003ctd valign=\"top\" style=\"width: 49px;\"\u003e\n \u003cp\u003eModel\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"bottom\" style=\"width: 49px;\"\u003e\n \u003cp\u003e\u003cstrong\u003eAccuracy\u003c/strong\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"bottom\" style=\"width: 48px;\"\u003e\n \u003cp\u003e\u003cstrong\u003ePrecision\u003c/strong\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"bottom\" style=\"width: 37px;\"\u003e\n \u003cp\u003e\u003cstrong\u003eRecall\u003c/strong\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"bottom\" style=\"width: 52px;\"\u003e\n \u003cp\u003e\u003cstrong\u003eSensitivity\u003c/strong\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"bottom\" style=\"width: 52px;\"\u003e\n \u003cp\u003e\u003cstrong\u003eSpecificity\u003c/strong\u003e\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd valign=\"top\" style=\"width: 49px;\"\u003e\n \u003cp\u003eProposed OPTUNA XGB\u0026nbsp;\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"bottom\" style=\"width: 49px;\"\u003e\n \u003cp\u003e0.9675\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"bottom\" style=\"width: 48px;\"\u003e\n \u003cp\u003e0.9741\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"bottom\" style=\"width: 37px;\"\u003e\n \u003cp\u003e0.9833\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"bottom\" style=\"width: 52px;\"\u003e\n \u003cp\u003e0.9833\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"bottom\" style=\"width: 52px;\"\u003e\n \u003cp\u003e0.9179\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd valign=\"top\" style=\"width: 49px;\"\u003e\n \u003cp\u003eXGB\u0026nbsp;\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"bottom\" style=\"width: 49px;\"\u003e\n \u003cp\u003e0.9644\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"bottom\" style=\"width: 48px;\"\u003e\n \u003cp\u003e0.9703\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"bottom\" style=\"width: 37px;\"\u003e\n \u003cp\u003e0.9830\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"bottom\" style=\"width: 52px;\"\u003e\n \u003cp\u003e0.9830\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"bottom\" style=\"width: 52px;\"\u003e\n \u003cp\u003e0.9068\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd valign=\"top\" style=\"width: 49px;\"\u003e\n \u003cp\u003eSGD\u0026nbsp;\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"bottom\" style=\"width: 49px;\"\u003e\n \u003cp\u003e0.9593\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"bottom\" style=\"width: 48px;\"\u003e\n \u003cp\u003e0.9683\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"bottom\" style=\"width: 37px;\"\u003e\n \u003cp\u003e0.9781\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"bottom\" style=\"width: 52px;\"\u003e\n \u003cp\u003e0.9781\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"bottom\" style=\"width: 52px;\"\u003e\n \u003cp\u003e0.9013\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd valign=\"top\" style=\"width: 49px;\"\u003e\n \u003cp\u003eRF\u0026nbsp;\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"bottom\" style=\"width: 49px;\"\u003e\n \u003cp\u003e0.9492\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"bottom\" style=\"width: 48px;\"\u003e\n \u003cp\u003e0.9607\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"bottom\" style=\"width: 37px;\"\u003e\n \u003cp\u003e0.9720\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"bottom\" style=\"width: 52px;\"\u003e\n \u003cp\u003e0.9720\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"bottom\" style=\"width: 52px;\"\u003e\n \u003cp\u003e0.8810\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd valign=\"top\" style=\"width: 49px;\"\u003e\n \u003cp\u003eSVC\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"bottom\" style=\"width: 49px;\"\u003e\n \u003cp\u003e0.9459\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"bottom\" style=\"width: 48px;\"\u003e\n \u003cp\u003e0.9566\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"bottom\" style=\"width: 37px;\"\u003e\n \u003cp\u003e0.9714\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"bottom\" style=\"width: 52px;\"\u003e\n \u003cp\u003e0.9714\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd valign=\"bottom\" style=\"width: 52px;\"\u003e\n \u003cp\u003e0.8712\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003c/tbody\u003e\n\u003c/table\u003e\n\u003cp\u003eIn particular, the tuned proposed OPTUNA XGB model has produced a better accuracy performance of 0.9675 when compared to other classification models like XGB, SGD, RF, and SVC, which are 0.9644, 0.9593, 0.9592, and 0.9459, respectively. Figure 9 shows the performance metrics of the classification model used to determine whether an attack is normal or an intrusion. This determined that overall true rate with respect to overall test sample amount for tuned proposed OPTUNA XGB model has better analysis when considered with actual sample and predicted samples of IDS dataset. It was found that the tuned proposed OPTUNA XGB model has a high specificity value of 0.9179 when compared to untuned XGB, SGD, RF, and SVC, respectively, based on the analysis of the scores of all classification models. \u0026nbsp;Therefore, the TP rate and TN rate for tuned proposed OPTUNA XGB model is high which assist in pointing out the exact class categorization to the model.\u0026nbsp;\u003c/p\u003e"},{"header":"7. Conclusion","content":"\u003cp\u003eThe growth of interconnected systems in an ever-evolving technological environment raises the risk of intrusion and illegal access, necessitating strict safeguards to protect sensitive data. IDS have become essential instruments for guaranteeing the security and integrity of digital assets in response to these problems. This study has effectively addressed the critical challenge of intrusion detection within IoT networks by introducing an OPTUNA, a hyperparameter optimization model. The superior performance of the proposed OPTUNA XGB model, evidenced by its heightened accuracy, precision, and computational efficiency, surpasses that of traditional ML models implementations. The proposed OPTUNA XGB model has generated the better accuracy performance as 0.9675 while compared to other classification models like XGB, SGD, RF and SVC. Notably, the model's robust feature interpretation capabilities provide invaluable insights into the critical factors governing intrusion detection in IoT networks, thereby facilitating more informed security strategies. The model's capability to generate rapid responses to potential security breaches, coupled with its interpretability makes it a powerful tool in combating cyber threats within the growing IoT ecosystem.\u003c/p\u003e"},{"header":"References","content":"\u003col\u003e\n\u003cli\u003eM. Anwer, S. M. Khan, M. U. Farooq, and Waseemullah, \u0026quot;Attack Detection in IoT using ML,\u0026quot; Engineering, Technology \u0026amp; Applied Science Research, vol. 11, no. 3, pp. 7273\u0026ndash;7278, Jun. 2021, https://doi.org/10.48084/etasr.4202. \u003c/li\u003e\n\u003cli\u003eT. Alqurashi, \u0026quot;Arabic Sentiment Analysis for Twitter Data: A Systematic Literature Review,\u0026quot; Engineering, Technology \u0026amp; Applied Science Research, vol. 13, no. 2, pp. 10292\u0026ndash;10300, Apr. 2023, https://doi.org/10.48084/etasr.5662. \u003c/li\u003e\n\u003cli\u003eP. Singh, Z. Elmi, V. Krishna Meriga, J. Pasha, and M. A. Dulebenets, \u0026quot;Internet of Things for sustainable railway transportation: Past, present, and future,\u0026quot; Cleaner Logistics and Supply Chain, vol. 4, Jul. 2022, Art. no. 100065, https://doi.org/10.1016/j.clscn.2022.100065. \u003c/li\u003e\n\u003cli\u003eH. Liu and B. Lang, \u0026quot;ML and Deep Learning Methods for Intrusion Detection Systems: A Survey,\u0026quot; Applied Sciences, vol. 9, no. 20, Jan. 2019, Art. no. 4396, https://doi.org/10.3390/app9204396.\u003c/li\u003e\n\u003cli\u003eDLTIDS: A dual-layer trust-based intrusion detection system for Blackhole attacks in wireless sensor networks. (2024). Nanotechnology Perceptions, 20(S6). https://doi.org/10.62441/nanontp.v20is6.13\u003c/li\u003e\n\u003cli\u003eA.Thakkar and R.Lohiya, \u0026ldquo;A review on ML and deep learning perspectives of IDS for IoT: Recent updates, security issues, and challenges\u0026rdquo;, Archives of Computational Methods in Engineering, 28(4), 3211\u0026ndash;3243,2021,https://doi.org/10.1007/s11831-020-09496-0\u003c/li\u003e\n\u003cli\u003eS. Khanam, I.B. Ahmedy, M.Y.I.Idris, M.H. Jaward and A.Q.B.M. Sabri, \u0026ldquo;A survey of security challenges, attacks taxonomy and advanced countermeasures in the internet of things\u0026rdquo;, IEEE Access, 8, 219709\u0026ndash;219743,2020, https://doi.org/10.1109/ACCESS.2020.3037359.\u003c/li\u003e\n\u003cli\u003eA.A.Alsulami, Q. Abu Al-Haija, A.Tayeb and A. Alqahtani, \u0026ldquo;An intrusion detection and classification system for IoT traffic with improved data engineering\u0026rdquo;, Applied Sciences, 12(23), 12336. https://doi.org/10.3390/app122312336,2022\u003c/li\u003e\n\u003cli\u003eN.Islam, F. Farhin, I. Sultana, M.S. Kaiser., M.S.Rahman, M. Mahmud, A.S.M. SanwarHosen, G.H. Cho, \u0026ldquo;Towards ML based intrusion detection in IoT networks\u0026rdquo;, Computers, Materials \u0026amp; Continua, 69(2), 2021. https://doi.org/10.32604/cmc.2021.018466\u003c/li\u003e\n\u003cli\u003eO.A.Khashan, N.M. Khafajah, W.Alomoush, \u0026amp; M. Alshinwan, \u0026ldquo;Innovative energy-efficient proxy Re-encryption for secure data exchange in Wireless sensor networks\u0026rdquo;, IEEE Access, 12, 23290\u0026ndash;23304,2024, https://doi.org/10.1109/ACCESS. 2024.3360488.\u003c/li\u003e\n\u003cli\u003eO.A.Khashan and N.M.Khafajah, \u0026ldquo;Efficient hybrid centralized and blockchain-based authentication architecture for heterogeneous IoT systems\u0026rdquo;, Journal of King Saud University - Computer and Information Sciences, 35(2), 726\u0026ndash;739. 2023b,https://doi.org/10.1016/j.jksuci.2023.01.011\u003c/li\u003e\n\u003cli\u003eS. Gamage and J.Samarabandu, \u0026ldquo;Deep learning methods in network intrusion detection: A survey and an objective comparison\u0026rdquo;, Journal of Network and Computer Applications, 169, 102767, 2020, https://doi.org/10.1016/j.jnca.2020.102767\u003c/li\u003e\n\u003cli\u003eJ.P.Lai, Y.L.Lin, H.C. Lin, C.Y.Shih, Y.P.Wang, and P.F. Pai, \u0026ldquo;Tree-based ML models with optuna in predicting impedance values for circuit analysis\u0026rdquo;, Micromachines, 14(2), Article 265, 2023.\u003c/li\u003e\n\u003cli\u003eM.N. Bhuiyan, M.M. Rahman, M.M.Billah and D.Saha, \u0026ldquo;Internet of things (IoT): A review of its enabling technologies in healthcare applications, standards protocols, security, and market opportunities\u0026rdquo;,IEEE Internet of Things Journal, 8(13), 10474\u0026ndash;10498, 2021, https://doi.org/10.1109/JIOT.2021.3062630\u003c/li\u003e\n\u003cli\u003eA. Churcher, R.Ullah, J. Ahmad, S.Ur Rehman, F.Masood, M.Gogate, F.Alqahtani, B. Nour and W.J.Buchanan, \u0026ldquo;An experimental analysis of attack classification using ML in IoT networks\u0026rdquo;,Sensors, 21(2), 446, 2021, https://doi.org/10.3390/s21020446.\u003c/li\u003e\n\u003cli\u003eX.Li, H.Ghodosi, C.Chen, M. ankupellay and I. Lee, \u0026ldquo;Improving network-based anomaly detection in smart home environment\u0026rdquo; Sensors, 22(15), 5626, 2022,https://doi.org/10.3390/ s22155626. \u003c/li\u003e\n\u003cli\u003eS.Iftikhar, D.Khan, D.K.Al-Madani, M.A.Alheeti and K.Fatima, K. \u0026ldquo;An intelligent detection of malicious intrusions in IoT based on ML and deep learning techniques\u0026rdquo;, Computer Science, 30(3), 90,2022.\u003c/li\u003e\n\u003cli\u003eA.R. Gad, A.A.Nashat and T.M.Barkat, \u0026ldquo;Intrusion detection system using ML for vehicular ad hoc networks based on ToN-IoT dataset\u0026rdquo;, IEEE Access, 9, 142206\u0026ndash;142217, 2021,https://doi.org/10.1109/ACCESS.2021.3120626.\u003c/li\u003e\n\u003cli\u003eM.Asaduzzaman and M.M.Rahman, \u0026ldquo;An Adversarial Approach for Intrusion Detection Using Hybrid Deep Learning Model\u0026rdquo;, In 2022 International Conference on Information Technology Research and Innovation (ICITRI) (pp. 18-23). IEEE,2022.\u003c/li\u003e\n\u003cli\u003eS.M.Kasongo, \u0026ldquo;A deep learning technique for intrusion detection system using a Recurrent Neural Networks based framework\u0026rdquo;, Computer Communications, 199, 113-125,2023.\u003c/li\u003e\n\u003cli\u003eM.Dhiaa, F. Alhaidari, Atta-ur-Rahman and R.A.M.Mustafa, \u0026ldquo;Intrusion Detection System Using Feature Extraction with ML Algorithms in IoT\u0026rdquo;, Journal of Sensor and Actuator Networks, 12(2), Article 29,2023.\u003c/li\u003e\n\u003cli\u003eD.Zegarra Rodr\u0026iacute;guez, O.Daniel Okey, S.S. Maidin, E.Umoren Udo and J.H. Kleinschmidt, \u0026ldquo;Attentive transformer deep learning algorithm for intrusion detection on IoT systems using automatic Xplainable feature selection\u0026rdquo;, PLOS ONE, 18(10), Article e0286652,2023.\u003c/li\u003e\n\u003cli\u003eM. Alazab, M.Alazab, A. Shalaginov, A.Mesleh, F. Awaysheh, \u0026ldquo;A Novel IDS with a Dynamic Access Control Algorithm to Detect and Defend Intrusion at IoT Nodes\u0026rdquo;, Sensors, 24(7), Article 2188,2024.\u003c/li\u003e\n\u003cli\u003eF. Al-Quayed, Z.Ahmad, and M.Humayun, \u0026ldquo;A situation based predictive approach for cybersecurity intrusion detection and prevention using ML and deep learning algorithms in wireless sensor networks of industry 4.0\u0026rdquo;, IEEE Access,2024.\u003c/li\u003e\n\u003cli\u003eJ.Li, M.S. Othman, H.Chen, Y.Ding, M.Faisal, J.Huang, \u0026ldquo;Optimizing IoT intrusion detection system: feature selection versus feature extraction in ML\u0026rdquo;, Journal of Big Data, 11, Article 36,2024.\u003c/li\u003e\n\u003cli\u003eA.R.Abdulla and N.G.M.Jameel, \u0026ldquo;A review on IoT intrusion detection systems using supervised ML: Techniques, datasets, and algorithms\u0026rdquo;, UHD Journal of Science and Technology, 7(1), 53\u0026ndash;65, 2023.https://doi.org/10.21928/uhdjst.v7n1y2023.pp53-65. \u003c/li\u003e\n\u003cli\u003eW. Ding, M. Abdel-Basset and R.Mohamed, \u0026ldquo;DeepAKIoT: An effective deep learning model for cyberattack detection in IoT networks\u0026rdquo;, Information Sciences, 634, 157\u0026ndash;171,2023. https://doi.org/10.1016/j.ins.2023.03.052\u003c/li\u003e\n\u003c/ol\u003e"}],"fulltextSource":"","fullText":"","funders":[],"hasAdminPriorityOnWorkflow":false,"hasManuscriptDocX":true,"hasOptedInToPreprint":true,"hasPassedJournalQc":"","hasAnyPriority":true,"hideJournal":true,"highlight":"","institution":"Gulf College","isAcceptedByJournal":false,"isAuthorSuppliedPdf":false,"isDeskRejected":"","isHiddenFromSearch":false,"isInQc":false,"isInWorkflow":false,"isPdf":false,"isPdfUpToDate":true,"isWithdrawnOrRetracted":false,"journal":{"display":true,"email":"[email protected]","identity":"researchsquare","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":true,"externalIdentity":"","sideBox":"","snPcode":"","submissionUrl":"/submission","title":"Research Square","twitterHandle":"researchsquare","acdcEnabled":true,"dfaEnabled":false,"editorialSystem":"","reportingPortfolio":"","inReviewEnabled":false,"inReviewRevisionsEnabled":true},"keywords":"IOT, OPTUNA, Hyperparameter Optimization, Intrusion Detection Systems (IDS), Network, Attack","lastPublishedDoi":"10.21203/rs.3.rs-7538012/v1","lastPublishedDoiUrl":"https://doi.org/10.21203/rs.3.rs-7538012/v1","license":{"name":"CC BY 4.0","url":"https://creativecommons.org/licenses/by/4.0/"},"manuscriptAbstract":"\u003cp\u003eThe rapid adoption of the Internet of Things (IoT) due to its ease of use and diversity has prompted serious security concerns about networked devices around the world. This emphasizes the critical necessity for robust Intrusion Detection Systems (IDS) to combat cyber threats. However, the widespread interconnectedness and diversity of IoT devices have posed substantial security challenges, particularly in terms of network infiltration. This study investigates the design and implementation of an IDS for IoT networks utilizing the OPTUNA Hyperparameter Optimization Framework. The proposed IDS seeks to identify and prevent several cyber threats through investigating network traffic and recognizing aberrant patterns that indicate intrusions. This study contributes to the field of IoT security by presenting an effective and extensible ID method that takes advantage of the optimization framework. Additionally, the OPTUNA framework is utilized to optimize classifier performance by fine-tuning hyperparameters and determining the ideal model configuration. These models are evaluated using publicly available NSL-KDD datasets. The results of this study show that OPTUNA hyperparameter optimization can improve classification results significantly. Evaluation using the NSL-KDD dataset, the proposed OPTUNA XGB model has generated the better accuracy performance as 0.9675 while compared to other classification models.\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cp\u003e\u003c/p\u003e","manuscriptTitle":"Intruder Detection System for IOT network Using Hyperparameter Optimization Framework","msid":"","msnumber":"","nonDraftVersions":[{"code":1,"date":"2025-09-05 12:58:26","doi":"10.21203/rs.3.rs-7538012/v1","editorialEvents":[{"type":"communityComments","content":0}],"status":"published","journal":{"display":true,"email":"[email protected]","identity":"researchsquare","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":true,"externalIdentity":"","sideBox":"","snPcode":"","submissionUrl":"/submission","title":"Research Square","twitterHandle":"researchsquare","acdcEnabled":true,"dfaEnabled":false,"editorialSystem":"","reportingPortfolio":"","inReviewEnabled":false,"inReviewRevisionsEnabled":true}}],"origin":"","ownerIdentity":"3fc0768d-d65d-4fa4-bf64-6e618bbc32a8","owner":[],"postedDate":"September 5th, 2025","published":true,"recentEditorialEvents":[],"rejectedJournal":[],"revision":"","amendment":"","status":"posted","subjectAreas":[],"tags":[],"updatedAt":"2025-09-05T12:58:26+00:00","versionOfRecord":[],"versionCreatedAt":"2025-09-05 12:58:26","video":"","vorDoi":"","vorDoiUrl":"","workflowStages":[]},"version":"v1","identity":"rs-7538012","journalConfig":"researchsquare"},"__N_SSP":true},"page":"/article/[identity]/[[...version]]","query":{"redirect":"/article/rs-7538012","identity":"rs-7538012","version":["v1"]},"buildId":"8U1c8b4HqxoKbykW_rLl7","isFallback":false,"isExperimentalCompile":false,"dynamicIds":[84888],"gssp":true,"scriptLoader":[]}