Picked from the software, topic, and level of “Class Hybrid IoT Network Intrusion Detection ML #4: Single Model: Random Forest, XGBoost, and Autoencoder”.
At most one email a week. Unfollow anytime with one click.
Transcript
The full narration of this video. The current sentence is highlighted while the video plays; click any sentence to jump there.
Show transcript
Introduction
Here is the final result, three single models. XGBoost is the most accurate in identifying attack types, but only detects 66% of attacks. The autoencoder, which has never seen any example of an attack, actually detects 82%. Let's get started. Hello, welcome to episode four of the IoT network intrusion detection series with Hybrid Machine Learning. There are two intrusion detection philosophies: signature-based, which learns from examples of attacks, and anomaly-based, which learns what normal traffic looks like and flags anything that deviates. Today we are building both.
Step 1: Autoencoder Architecture
Create the model underscore intrusion.py file. The Autoencoder class compresses 122 features into 16 numbers and then reconstructs them back. Because it is only trained on normal traffic, the Autoencoder is good at reconstructing normal traffic. But it fails to reconstruct attacks, resulting in a large reconstruction error.
Step 2: Anomaly Score & IDS Metrics
The train AE function trains the Autoencoder for 20 epochs with loss-min-squared error. The anomaly score function calculates the average reconstruction error for each connection. The binary metric function calculates the detection rate, which is the percentage of attacks that are detected, and the false alarm rate, which is the percentage of normal traffic incorrectly labeled as an attack, the two main metrics in IDS. Create the model underscore single.py file.
Step 3: Training Three Models
Random Forest with 100 trees and XGBoost with 300 trees are trained on oversampled data to recognize 5 classes. The Autoencoder is trained only on normal traffic, and its threshold is set at the 95th percentile of the training normal traffic error. The XGBoost and Autoencoder models are saved for the next episode. Run it! Random Forest achieves a 5-class accuracy of 0.742 and XGBoost 0.778, with very low false alarm rates, around 3%. But XGBoost only detects 65.6% of attacks. The Autoencoder detects 81.6% of attacks, with a false alarm rate of 10%.
Step 4: Confusion Matrix & Reconstruction Error
Let's take a look at the graphs. The XGBoost Confusion Matrix reveals the problem. 93% of R2L and U2R in the test data are classified as normal, because many of them are new types of attacks. The autoencoder error histogram shows normal traffic piling up on the left and attacks on the right of the threshold line. Both models have different strengths, and that's the idea behind a hybrid model.
Done!
Done! We have trained Random Forest, XGBoost, and Autoencoder, and understood the compromise between signature-based and anomaly-based detection. In the next episode, we will combine both into a hybrid system. Currently working on a thesis, dissertation, or research in the field of network security and machine learning? Cerdas Inovasi Digital helps implement intrusion detection systems, from network traffic preprocessing, feature selection, Random Forest and XGBoost, up to Autoencoder for 0DI attacks and monitoring dashboard, as well as opening Python programming courses for electrical engineering and informatics. Want to master the entire series, from intrusion datasets to a hybrid system ready for monitoring? All 6 episodes, complete with step-by-step PDF guides, datasets, and source code, are available to premium tutorial subscribers. Subscribe starting at Rp69.000 per month, save 28% with the 12-month package, or pay once Rp999.000 for lifetime access. Want just one class? Buy a single class with lifetime access. Subscribe now on the premium page cerdasinovasidigital.com. Contact us via WhatsApp, or visit cerdasinovasidigital.com. Thank you for watching, see you in the next episode.
Ask the class material
Type a question or keyword; we find the part of this episode that explains it and jump the video there.
My notes
Notes are saved with the current video time and are only visible to you.
Questions & answers
Stuck on a step? Ask here; the instructor and other learners can answer.
No questions yet.
Your instructor
Cerdas Inovasi Digital Team
Software developers, BIM & 3D engineers, and AI practitioners
53 video classes1,281 episodes
We build software, BIM models, games and AI automations for clients every day, and turn that hands-on work into step-by-step classes: every step is shown on screen and comes with a PDF guide you can keep.
