Table 6.
Detailed Classification Report.
Precision
Recall
F1-Score
Support
Normal
1.00
1.00
1.00
279,968
MITM
1.00
1.00
1.00
67
Uploading
0.90
0.68
0.78
7426
Ransomware
0.90
0.90
0.90
1978
SQL_injection
0.62
0.82
0.71
10,026
DDoS_HTTP
0.95
0.90
0.93
9675
DDoS_TCP
0.97
0.93
0.95
10,117
Password
0.65
0.56
0.60
10,102
Port_Scanning
0.85
1.00
0.92
3979
Vulnerability_scanner
0.99
0.92
0.96
10,023
Backdoor
0.98
0.92
0.95
4783
XSS
0.64
0.88
0.74
2963
Fingerprinting
1.00
0.27
0.43
161
DDoS_UDP
1.00
1.00
1.00
24,332
DDoS_ICMP
0.99
1.00
1.00
13,490
accuracy
0.97
389,090
macro avg
0.90
0.85
0.86
389,090
weighted avg
0.97
0.97
0.97
389,090
The confusion matrix presents an elaborate portrayal of the model’s performance, with
dominant true positive rates across most categories (Figure
13
). It also highlights cross-class
confusion, particularly between “Password” and other forms of malware, revealing subtleties
in the dataset that the model may not fully capture. The normalized confusion matrix, which
depicts the proportion of correct predictions within each class, underscores the model’s
proficiency while also illuminating those classes where precision is paramount (Figure
14
).
Mathematics 2024, 12, 571
21 of 26
Figure 13.
Confusion Matrix.
In synthesizing these results, the fifteen-class classification demonstrates the model’s
substantial capability to accurately identify a range of intrusion types in IoT contexts.
Although certain classes present opportunities for improvement, the overall performance
suggests that the ensemble model is a formidable tool in the sophisticated domain of
cybersecurity threat detection. Future work will seek to enhance the model’s discernment
in those categories that posed challenges, refining its predictive power and bolstering its
operational readiness for deployment in live environments.
Mathematics 2024, 12, 571
22 of 26
|
