Extracting Optimal Number of Features for Machine Learning Models in Multilayer IoT Attacks

The rapid integration of Internet of Things (IoT) systems in various sectors has escalated security risks due to sophisticated multilayer attacks that compromise multiple security layers and lead to significant data loss, personal information theft, financial losses etc. Existing research on multilayer IoT attacks exhibits gaps in real-world applicability, due to reliance on outdated datasets with a limited focus on adaptive, dynamic approaches to address multilayer vulnerabilities. Additionally, the complete reliance on automated processes without integrating human expertise in feature selection and weighting processes may affect the reliability of detection models. Therefore, this research aims to develop a Semi-Automated Intrusion Detection System (SAIDS) that integrates efficient feature selection, feature weighting, normalisation, visualisation, and human–machine interaction to detect and identify multilayer attacks, enhancing mitigation strategies. The proposed framework managed to extract an optimal set of 13 significant features out of 64 in the Edge-IIoT dataset, which is crucial for the efficient detection and classification of multilayer attacks, and also outperforms the performance of the KNN model compared to other classifiers in binary classification. The KNN algorithm demonstrated an average accuracy exceeding 94% in detecting several multilayer attacks such as UDP, ICMP, HTTP flood, MITM, TCP SYN, XSS, SQL injection, etc.