Feature optimization using a two-tier hybrid optimizer in an Internet of Things network

The growing use of the Internet of Things (IoT) in smart applications necessitates improved security monitoring of IoT components. The security of such components is monitored using intrusion detection systems which run machine learning (ML) algorithms to classify access attempts as anomalous or normal. However, in this case, one of the issues is the large length of the data feature vector that any ML or deep learning technique implemented on resource-constrained intelligent nodes must handle. In this paper, the problem of selecting an optimal-feature set is investigated to reduce the curse of data dimensionality. A two-layered approach is proposed: the first tier makes use of a random forest while the second tier uses a hybrid of gray wolf optimizer (GWO) and the particle swarm optimizer (PSO) with the k-nearest neighbor as the wrapper method. Further, differential weight distribution is made to the local-best and global-best positions in the velocity equation of PSO. A new metric, i.e., the reduced feature to accuracy ratio (RFAR), is introduced for comparing various works. Three data sets, namely, NSLKDD, DS2OS and BoTIoT, are used to evaluate and validate the proposed work. Experiments demonstrate improvements in accuracy up to 99.44%, 99.44% and 99.98% with the length of the optimal-feature vector equal to 9, 4 and 8 for the NSLKDD, DS2OS and BoTIoT data sets, respectively. Furthermore, classification improves for many of the individual classes of attacks: denial-of-service (DoS) (99.75%) and normal (99.52%) for NSLKDD, malicious control (100%) and DoS (68.69%) for DS2OS, and theft (95.65%) for BoTIoT.