IMPROVING IOT SECURITY: THE IMPACT OF DIMENSIONALITY AND SIZE REDUCTION ON INTRUSION-DETECTION PERFORMANCE

(Received: 16-Mar.-2025, Revised: 23-May-2025 and 24-Jun.-2025 , Accepted: 27-Jun.-2025)

Authors Remah Younisse, Amal Saif, Nailah Al-Madi, Sufyan Almajali, Basel Mahafzah,

Keywords #Dimensionality reduction #Data reduction #Autoencoders #Stratified sampling #Machine learning

Abstract Intrusion detection in the Internet of Things (IoT) environments is essential to guarantee computer-network security. Machine-learning (ML) models are widely used to improve efficient detection systems. Meanwhile, with the increasing complexity and size of intrusion-detection data, analyzing vast datasets using ML models is becoming more challenging and demanding in terms of computational resources. Datasets related to IoT environments usually come in very large sizes. This study investigates the impact of dataset-reduction techniques on machine learning-based Intrusion Detection Systems (IDSs) regarding performance and efficiency. We propose a two-stage framework incorporating deep autoencoder-based feature reduction with stratified sampling to reduce the dimensionality and size of six publicly available IDS datasets, including BoT-IoT, CSE-CIC-IDS2018, and others. Multiple machine-learning models, such as Random Forest, XGBoost, K-Nearest Neighbors, SVM and AdaBoost, were evaluated using default parameters. Our results show that dataset reduction can decrease training time by up to 99% with minimal loss in F1-score, typically less than 1%. It is recognized that excessive size reduction can compromise detection accuracy for minority attack classes. However, employing a stratified sampling method can effectively maintain class distributions. The study highlights significant feature redundancy, particularly high correlation among features, across multiple IoT security-related datasets, motivating the use of dimensionality-reduction techniques. These findings support the feasibility of efficient, scalable IDS implementations for real-world environments, especially in resource-constrained or real-time settings. This work shows considerable redundancy in the datasets which questions the huge amount of these datasets, because, in many cases, the reduced datasets provide almost the same F1-score readings after data reduction. Rasing the alarm to notice the unnecessary massive amount of data used to build robust IDSs.

References

[1] M. B. Younes and A. Boukerche, "A Performance Evaluation of a Context-aware Path RecommendationProtocol for Vehicular Ad-hoc Networks," Proc. of the 2013 IEEE Global Communications Conf. (GLOBE- COM), IEEE, pp. 516–521, Atlanta, USA, 2013.

[2] M. B. Younes, G. R. Alonso and A. Boukerche, "A Distributed Infrastructure-based CongestionAvoidance Protocol for Vehicular Ad Hoc Networks," Proc. of the 2012 IEEE Global Communications Conf. (GLOBECOM), pp. 73–78, Anaheim, USA, 2012.

[3] J. Al-Sawwa, M. Almseidin, M. Alkasassbeh, K. Alemerien and R. Younisse, "Spark-based Multi-verse Optimizer as Wrapper Features Selection Algorithm for Phishing Attack Challenge," Cluster Computing, vol. 27, no. 5, pp. 5799–5814, 2024.

[4] L. A. C. Ahakonye et al., "SCADA Intrusion Detection Scheme Exploiting the Fusion of ModifiedDecision Tree and Chi-square Feature Selection," Internet of Things, vol. 21, p. 100676, 2023.

[5] Y. Han, Y. Zhang and J. Wang, "Semantic-driven Dimension Reduction for Wireless Internet of Things,"Internet of Things, vol. 25, p. 101138, 2024.

[6] F. Ali et al., "An Intelligent Healthcare Monitoring Framework Using Wearable Sensors and SocialNetworking Data," Future Generation Computer Systems, vol. 114, pp. 23–43, 2021.

[7] A. Shiravani, M. H. Sadreddini and H. N. Nahook, "Network Intrusion Detection Using Data DimensionsReduction Techniques," Journal of Big Data, vol. 10, no. 1, p. 27, 2023.

[8] R. Younisse and M. AlKasassbeh, "SGID: A Semi-synthetic Dataset for Injection Attacks in Smart GridSystems," Proc. of the 2024 15th IEEE Int. Conf. on Information and Communication Systems (ICICS), pp. 1–4, Irbid, Jordan, 2024.

[9] A. Glielmo, B. E. Husic, A. Rodriguez, C. Clementi, F. Noé and A. Laio, "Unsupervised LearningMethods for Molecular Simulation Data," Chemical Reviews, vol. 121, no. 16, pp. 9722–9758, 2021.

[10] B. M. S. Hasan and A. M. Abdulazeez, "A Review of Principal Component Analysis Algorithm forDimensionality Reduction," Journal of Soft Computing and Data Mining, vol. 2, no. 1, pp. 20–30, 2021.

[11] S. Li, N. Marsaglia et al., "Data Reduction Techniques for Simulation, Visualization and Data Analysis,"Computer Graphics Forum, vol. 37, pp. 422–447, Wiley Online Library, 2018.

[12] M. Dumelle, T. Kincaid, A. R. Olsen and M. Weber, "Spsurvey: Spatial sampling design and analysis inR," Journal of Statistical Software, vol. 105, no. 3, pp. 1–29, 2023.

[13] G. Sharma, "Pros and Cons of Different Sampling Techniques," International Journal of AppliedResearch, vol. 3, no. 7, pp. 749–752, 2017.

[14] Z. Ashi, L. Aburashed, M. Al-Qudah and A. Qusef, "Network Intrusion Detection Systems UsingSupervised Machine Learning Classification and Dimensionality Reduction Techniques: A Systematic Review," Jordanian J. of Computers and Inform. Technol. (JJCIT), vol. 7, no. 4, pp. 373 – 390, 2021.

[15] N. Saran and N. Kesswani, "Intrusion Detection System for Internet of Medical Things Using GRU withAttention Mechanism-based Hybrid Deep Learning," Jordanian Journal of Computers and Information Technology (JJCIT), vol. 11, no. 2, pp. 136-150, 2015.

[16] Y. Xiao, C. Xing, T. Zhang and Z. Zhao, "An Intrusion Detection Model Based on Feature Reduction andConvolutional Neural Networks," IEEE Access, vol. 7, pp. 42210–42219, 2019.

[17] F. Salo, A. B. Nassif and A. Essex, "Dimensionality Reduction with IG-PCA and Ensemble Classifier forNetwork Intrusion Detection," Computer Networks, vol. 148, pp. 164–175, 2019.

[18] R. Abdulhammed et al., "Features Dimensionality Reduction Approaches for Machine Learning BasedNetwork Intrusion Detection," Electronics, vol. 8, no. 3, p. 322, 2019.

[19] S. Ryu et al., "Convolutional Autoencoder Based Feature Extraction and Clustering for Customer LoadAnalysis," IEEE Trans. on Power Systems, vol. 35, no. 2, pp. 1048–1060, 2019.

[20] G. T. Reddy et al., "Analysis of Dimensionality Reduction Techniques on Big Data," IEEE Access, vol.8, pp. 54776–54788, 2020.

[21] K. K. Pandey and D. Shukla, "Stratified Linear Systematic Sampling Based Clustering Approach forDetection of Financial Risk Group by Mining of Big Data," Int. J. of System Assurance Engineering and Management, vol. 13, pp. 1239–1253, 2021.

[22] K. Zhang et al., "History Matching of Naturally Fractured Reservoirs Using a Deep Sparse Autoencoder,"SPE Journal, vol. 26, no. 4, pp. 1700– 1721, 2021.

[23] B. Manjunatha et al., "A Network Intrusion Detection Framework on Sparse Deep DenoisingAutoencoder for Dimensionality Reduction," Soft Computing, vol. 28, no. 5, pp. 4503–4517, 2024.

[24] F. Nabi and X. Zhou, "Enhancing Intrusion Detection Systems through Dimensionality Reduction: AComparative Study of Machine Learning Techniques for Cyber Security," Cyber Security and Applications, vol. 2, p. 100033, 2024.

[25] K. K. Pandey and D. Shukla, "Stratified Sampling-based Data Reduction and Categorization Model forBig Data Mining," Proc. of Communication and Intelligent Systems (ICCIS 2019), pp. 107–122, Springer, 2020.

[26] X. Zhao, J. Liang and C. Dang, "A Stratified Sampling Based Clustering Algorithm for Large-scale Data,"Knowledge-based Systems, vol. 163, pp. 416–428, 2019.

[27] Y. Yang, J. Cai, H. Yang, Y. Li and X. Zhao, "ISBFK-means: A New Clustering Algorithm Based onInfluence Space," Expert Systems with Applications, vol. 201, p. 117018, 2022.

[28] L. Cao and H. Shen, "CSS: Handling Imbalanced Data by Improved Clustering with Stratified Sampling,"Concurrency and Computation: Practice and Experience, vol. 34, no. 2, p. e6071, 2022.

[29] A. Zoubir and B. Missaoui, "Graph Neural Networks with Scattering Transform for Network AnomalyDetection," Engineering Applications of Artificial Intelligence, vol. 150, p. 110546, 2025.

[30] A. Zoubir and B. Missaoui, "GeoScatt-GNN: A Geometric Scattering Transform-based Graph NeuralNetwork Model for Ames Mutagenicity Prediction," arXiv preprint, arXiv: 2411.15331, 2024.

[31] M. Alqarqaz, M. Bani Younes and R. Qaddoura, "An Object Classification Approach for AutonomousVehicles Using Machine Learning Techniques," World Electric Vehicle J., vol. 14, no. 2, p. 41, 2023.

[32] Y. Mirsky, T. Doitshman, Y. Elovici and A. Shabtai, "Kitsune: An Ensemble of Autoencoders for OnlineNetwork Intrusion Detection," arXiv preprint, arXiv: 1802.09089, 2018.

[33] M. Al-Kasassbeh et al., "Towards Generating Realistic SNMP-MIB Dataset for Network AnomalyDetection," Int. J. of Computer Science and Information Security, vol. 14, no. 9, p. 1162, 2016.

[34] UNB, "CSE-CIC-IDS2018 on AWS," [Online], Available: http://www.unb.ca/cic/datasets/ids-2018.html, Accessed on Apr. 25, 2023, 2018.

[35] N. Koroniotis et al., "Towards the Development of Realistic Botnet Dataset in the Internet of Things forNetwork Forensic Analytics: Bot-IoT Dataset," Future Generation Computer Systems, vol. 100, pp. 779–796, 2019.

[36] T. Das et al., "UNR-IDD: Intrusion Detection Dataset Using Network Port Statistics," Proc. of the 2023IEEE 20th Consumer Comm. & Networking Conf. (CCNC), pp. 497–500, Las Vegas, USA, 2023.

[37] Kaggle, "Credit Card Fraud Detection," [Online], Available: www.kaggle.com/datasets/mlg-ulb/creditcardfraud, Accessed: June 1, 2023.

[38] Y. N. Kunang et al., "Automatic Features Extraction Using Autoencoder in Intrusion Detection System,"Proc. of the 2018 Int. Conf. on Electrical Engineering and Computer Science (ICECOS), pp. 219–224, Pangkal, Indonesia, 2018.

[39] Z. Salah et al., "Optimizing Intrusion Detection in 5G Networks Using Dimensionality ReductionTechniques," Int. J. of Electrical & Computer Engineering, vol. 14, no. 5, pp. 2088-8708, 2024.

[40] M. H. Behiry and M. Aly, "Cyberattack Detection in Wireless Sensor Networks Using a Hybrid FeatureReduction Technique with AI and Machine Learning Methods," J. of Big Data, vol. 11, no. 1, 2024.

[41] M. A. Hossain and M. S. Islam, "Enhancing DDoS Attack Detection with Hybrid Feature Selection andEnsemble-based Classifier: A Promising Solution for Robust Cybersecurity," Measurement: Sensors, vol. 32, p. 101037, 2024.

[42] R. Vallabhaneni et al., "Feature Selection Using COA with Modified Feedforward Neural Network forPrediction of Attacks in Cyber-security," Proc. of ICDCOT, pp. 1–6, DOI: 10.1109/ICDCOT61034, 2024.10516044, 2024.

Abstract: Intrusion detection in the Internet of Things (IoT) environments is essential to guarantee computer-network security. Machine-learning (ML) models are widely used to improve efficient detection systems. Meanwhile, with the increasing complexity and size of intrusion-detection data, analyzing vast datasets using ML models is becoming more challenging and demanding in terms of computational resources. Datasets related to IoT environments usually come in very large sizes. This study investigates the impact of dataset-reduction techniques on machine learning-based Intrusion Detection Systems (IDSs) regarding performance and efficiency. We propose a two-stage framework incorporating deep autoencoder-based feature reduction with stratified sampling to reduce the dimensionality and size of six publicly available IDS datasets, including BoT-IoT, CSE-CIC-IDS2018, and others. Multiple machine-learning models, such as Random Forest, XGBoost, K-Nearest Neighbors, SVM and AdaBoost, were evaluated using default parameters. Our results show that dataset reduction can decrease training time by up to 99% with minimal loss in F1-score, typically less than 1%. It is recognized that excessive size reduction can compromise detection accuracy for minority attack classes. However, employing a stratified sampling method can effectively maintain class distributions. The study highlights significant feature redundancy, particularly high correlation among features, across multiple IoT security-related datasets, motivating the use of dimensionality-reduction techniques. These findings support the feasibility of efficient, scalable IDS implementations for real-world environments, especially in resource-constrained or real-time settings. This work shows considerable redundancy in the datasets which questions the huge amount of these datasets, because, in many cases, the reduced datasets provide almost the same F1-score readings after data reduction. Rasing the alarm to notice the unnecessary massive amount of data used to build robust IDSs.
URL: https://jjcit.org/paper/268

,abstract={Intrusion detection in the Internet of Things (IoT) environments is essential to guarantee computer-network security. Machine-learning (ML) models are widely used to improve efficient detection systems. Meanwhile, with the increasing complexity and size of intrusion-detection data, analyzing vast datasets using ML models is becoming more challenging and demanding in terms of computational resources. Datasets related to IoT environments usually come in very large sizes. This study investigates the impact of dataset-reduction techniques on machine learning-based Intrusion Detection Systems (IDSs) regarding performance and efficiency. We propose a two-stage framework incorporating deep autoencoder-based feature reduction with stratified sampling to reduce the dimensionality and size of six publicly available IDS datasets, including BoT-IoT, CSE-CIC-IDS2018, and others. Multiple machine-learning models, such as Random Forest, XGBoost, K-Nearest Neighbors, SVM and AdaBoost, were evaluated using default parameters. Our results show that dataset reduction can decrease training time by up to 99% with minimal loss in F1-score, typically less than 1%. It is recognized that excessive size reduction can compromise detection accuracy for minority attack classes. However, employing a stratified sampling method can effectively maintain class distributions. The study highlights significant feature redundancy, particularly high correlation among features, across multiple IoT security-related datasets, motivating the use of dimensionality-reduction techniques. These findings support the feasibility of efficient, scalable IDS implementations for real-world environments, especially in resource-constrained or real-time settings. This work shows considerable redundancy in the datasets which questions the huge amount of these datasets, because, in many cases, the reduced datasets provide almost the same F1-score readings after data reduction. Rasing the alarm to notice the unnecessary massive amount of data used to build robust IDSs.},
keywords={Dimensionality reduction,Data reduction,Autoencoders,Stratified sampling,Machine learning},
ISSN={2413-9351},
month={}}

AB - Intrusion detection in the Internet of Things (IoT) environments is essential to guarantee computer-network security. Machine-learning (ML) models are widely used to improve efficient detection systems. Meanwhile, with the increasing complexity and size of intrusion-detection data, analyzing vast datasets using ML models is becoming more challenging and demanding in terms of computational resources. Datasets related to IoT environments usually come in very large sizes. This study investigates the impact of dataset-reduction techniques on machine learning-based Intrusion Detection Systems (IDSs) regarding performance and efficiency. We propose a two-stage framework incorporating deep autoencoder-based feature reduction with stratified sampling to reduce the dimensionality and size of six publicly available IDS datasets, including BoT-IoT, CSE-CIC-IDS2018, and others. Multiple machine-learning models, such as Random Forest, XGBoost, K-Nearest Neighbors, SVM and AdaBoost, were evaluated using default parameters. Our results show that dataset reduction can decrease training time by up to 99% with minimal loss in F1-score, typically less than 1%. It is recognized that excessive size reduction can compromise detection accuracy for minority attack classes. However, employing a stratified sampling method can effectively maintain class distributions. The study highlights significant feature redundancy, particularly high correlation among features, across multiple IoT security-related datasets, motivating the use of dimensionality-reduction techniques. These findings support the feasibility of efficient, scalable IDS implementations for real-world environments, especially in resource-constrained or real-time settings. This work shows considerable redundancy in the datasets which questions the huge amount of these datasets, because, in many cases, the reduced datasets provide almost the same F1-score readings after data reduction. Rasing the alarm to notice the unnecessary massive amount of data used to build robust IDSs.

Download Full Text