IoT cybersecurity: On the use of machine learning approaches for unbalanced datasets

Machine learning can effectively be used to detect cyberattacks in IoT networks by learning patterns from previous attack datasets. Unfortunately, datasets used for training machine learning models to detect cyberattacks are almost always unbalanced. As training methods usually try to minimise the loss function by correctly classifying the instances of the majority class, the minority class instances are more likely to be misclassified. This paper aims to develop an insight into the effectiveness of two different approaches for handling unbalanced datasets – weighted loss function, and synthetic minority oversampling technique (SMOTE) in enhancing the capacity of two machine learning algorithms – artificial neural network (ANN) and light gradient boosting model (LGBM) to correctly classify minority class instances. The results suggest that both SMOTE and weighted loss function enhance the recall rate for minority classes significantly, however, it comes at the cost of slightly reduced precision. Moreover, it is found that LGBM, being an ensemble classifier, has an inherent capacity of learning from unbalanced data and hence, outperforms ANN in detecting minority class instances.