XGBOOST'UN ÇOK SINIFLI IOT SALDIRI TESPİTİNDEKİ PERFORMANSININ KAYIP FONKSİYON OPTİMİZASYONU İLE İYİLEŞTİRİLMESİ

Abstract

Nesnelerin İnterneti'nin (IoT) hızlı büyümesi, IoT cihazlarının bağlı olduğu ağları siber saldırılara karşı giderek daha savunmasız hale getirmektedir. Bu tehdit, IoT ağları için güçlü saldırı tespit sistemlerinin önemini arttırmaktadır. Bu çalışmada optimize edilmiş kayıp fonksiyonuna sahip yeni bir XGBoost tabanlı sınıflandırma modeli öneriyoruz. Ayrıca, çok sınıflı kayıp fonksiyonu mlogloss'u en aza indirmek için bir uygunluk fonksiyonu tasarlandı ve bu fonksiyonu minimize Optuna ile hiperparametre optimizasyonu uygulandı. Önerilen modelin etkinliğini değerlendirmek için, IoT ortamlarındaki çok çeşitli saldırıları etkili bir şekilde belirlemek üzere kapsamlı CICIoT2023 veri kümesi kullanıldı. Optimal hiperparametrelerle yapılandırılan önerilen model, %99,39 hassasiyet, %99,41 geri çağırma, %99,39 F1 puanı ve %99,33 doğrulukla dikkate değer sınıflandırma sonuçları elde etti. Sonuçlar, önerilen modelin karmaşık IoT ağ trafiğini analiz etmek için güçlü ve uygulanabilir bir alternatif olduğunu göstermektedir. Çok sınıflı senaryolarda kayıp fonksiyonunun optimize edilmesi, modelin daha dengeli ve güvenilir tahminler üretmesini sağlar. Ek olarak, XGBoost'un Optuna ile entegre edilmesi, IoT güvenlik uygulamaları için etkili bir strateji sunmaktadır. Sonuç olarak, önerilen yaklaşım, IoT trafiğindeki çeşitli saldırı türleri arasında etkili bir ayrım yapmanın yanı sıra, gelecekteki siber güvenlik modelleri için göreve özgü kayıp fonksiyonu optimizasyon stratejilerinin potansiyel faydalarını da vurgulamaktadır.

Ethical Statement

Authors declare that all research and writing facilities complies with the ethical standarts of the journal.

IMPROVING THE PERFORMANCE OF XGBOOST IN MULTI-CLASS IOT ATTACK DETECTION WITH LOSS FUNCTION OPTIMIZATION

Abstract

The rapid growth of Internet of Things (IoT) makes the networks to which IoT devices are connected increasingly vulnerable to cyberattacks. This threat increases the importance of robust intrusion detection systems for IoT networks. We propose a novel XGBoost-based classification model with an optimized loss function. Furthermore, a fitness function was designed to minimize the multi-class loss function mlogloss and applied hyperparameter optimization with Optuna in task. To evaluate the effectiveness of the proposed model, we used the comprehensive CICIoT2023 dataset to effectively identify a wide variety of attacks in IoT environments. The proposed model configured with optimal hyperparameters achieved remarkable classification results with 99.39% precision, 99.41% recall, 99.39% F1-score, and 99.33% accuracy. The results demonstrate that the proposed model is a robust and feasible alternative for analyzing complex IoT network traffic. Optimizing the loss function in multi-class scenarios allows the model to produce more balanced and reliable predictions. Additionally, integrating XGBoost with Optuna provides an effective strategy for IoT security applications. Consequently, the proposed approach not only effectively distinguishes between various types of attacks in IoT traffic but also highlights the potential benefits of task-specific loss function optimization strategies for future cybersecurity models.

Keywords

• Hyperparameter Optimization
• IoT Attack Detection
• Mlogloss Minimization
• Optuna
• XGBoost

Ethical Statement

Authors declare that all research and writing facilities complies with the ethical standarts of the journal.

References

1. L. Atzori, A. Iera, and G. Morabito, “The Internet of Things: A survey,” Computer Networks, vol. 54, no. 15, pp. 2787–2805, Oct. 2010, doi: 10.1016/j.comnet.2010.05.010.
2. R. Roman, J. Zhou, and J. Lopez, “On the features and challenges of security and privacy in distributed internet of things,” Computer Networks, vol. 57, no. 10, pp. 2266–2279, Jul. 2013, doi: 10.1016/j.comnet.2012.12.018.
3. I. Andrea, C. Chrysostomou, and G. Hadjichristofi, “Internet of Things: Security vulnerabilities and challenges,” in 2015 IEEE Symposium on Computers and Communication (ISCC), IEEE, Jul. 2015, pp. 180–187. doi: 10.1109/ISCC.2015.7405513.
4. K. A. Scarfone and P. M. Mell, “Guide to Intrusion Detection and Prevention Systems (IDPS),” Gaithersburg, MD, 2007. doi: 10.6028/NIST.SP.800-94.
5. E. Anthi, L. Williams, M. Slowinska, G. Theodorakopoulos, and P. Burnap, “A Supervised Intrusion Detection System for Smart Home IoT Devices,” IEEE Internet Things J., vol. 6, no. 5, pp. 9042–9053, Oct. 2019, doi: 10.1109/JIOT.2019.2926365.
6. B. Alotaibi and K. Elleithy, “A majority voting technique for Wireless Intrusion Detection Systems,” in 2016 IEEE Long Island Systems, Applications and Technology Conference (LISAT), IEEE, Apr. 2016, pp. 1–6. doi: 10.1109/LISAT.2016.7494133.
7. M. AL-Hawawreh, N. Moustafa, and E. Sitnikova, “Identification of malicious activities in industrial internet of things based on deep learning models,” Journal of Information Security and Applications, vol. 41, pp. 1–11, Aug. 2018, doi: 10.1016/j.jisa.2018.05.002.
8. R. Doshi, N. Apthorpe, and N. Feamster, “Machine Learning DDoS Detection for Consumer Internet of Things Devices,” in 2018 IEEE Security and Privacy Workshops (SPW), IEEE, May 2018, pp. 29–35. doi: 10.1109/SPW.2018.00013.

9. P. Devan and N. Khare, “An efficient XGBoost–DNN-based classification model for network intrusion detection system,” Neural Comput. Appl., vol. 32, no. 16, pp. 12499–12514, Aug. 2020, doi: 10.1007/s00521-020-04708-x.
10. K. A. Binsaeed and A. M. Hafez, “Enhancing Intrusion Detection Systems with XGBoost Feature Selection and Deep Learning Approaches,” International Journal of Advanced Computer Science and Applications, vol. 14, no. 5, 2023, doi: 10.14569/IJACSA.2023.01405112.
11. J. B. Awotunde et al., “An Ensemble Tree-Based Model for Intrusion Detection in Industrial Internet of Things Networks,” Applied Sciences, vol. 13, no. 4, p. 2479, Feb. 2023, doi: 10.3390/app13042479.
12. T.-T.-H. Le, Y. E. Oktian, and H. Kim, “XGBoost for Imbalanced Multiclass Classification-Based Industrial Internet of Things Intrusion Detection Systems,” Sustainability, vol. 14, no. 14, p. 8707, Jul. 2022, doi: 10.3390/su14148707.
13. S. Bajpai, K. Sharma, and B. K. Chaurasia, “A Hybrid Meta-heuristics Algorithm: XGBoost-Based Approach for IDS in IoT,” SN Comput. Sci., vol. 5, no. 5, p. 537, May 2024, doi: 10.1007/s42979-024-02913-2.
14. K. A. Awan, I. U. Din, A. Almogren, B.-S. Kim, and M. Guizani, “Enhancing IoT Security With Trust Management Using Ensemble XGBoost and AdaBoost Techniques,” IEEE Access, vol. 12, pp. 116609–116621, 2024, doi: 10.1109/ACCESS.2024.3413600.
15. H. Nandanwar and R. Katarya, “Optimized intrusion detection and secure data management in IoT networks using GAO-Xgboost and ECC-integrated blockchain framework,” Knowl. Inf. Syst., vol. 67, no. 10, pp. 9531–9586, Oct. 2025, doi: 10.1007/s10115-025-02513-3.
16. C. Hazman, A. Guezzaz, S. Benkirane, and M. Azrour, “A smart model integrating LSTM and XGBoost for improving IoT-enabled smart cities security,” Cluster Comput., vol. 28, no. 1, p. 70, Feb. 2025, doi: 10.1007/s10586-024-04780-1.
17. F. H. Zawaideh, G. Al-Asad, G. Swaneh, S. Batainah, and H. Bakkar, “Intrusion Detection System for (IoT) Networks Using Convolutional Neural Network (CNN) and XGboost Algorithm.”
18. G. Tuteja, A. R. Singh, G. R. Kumar, and M. H. Fallaah, “XGBoost-Based Anomaly Detection in IoT Networks Using the RT-IoT2022 Dataset,” in 2025 4th OPJU International Technology Conference (OTCON) on Smart Computing for Innovation and Advancement in Industry 5.0, IEEE, Apr. 2025, pp. 1–6. doi: 10.1109/OTCON65728.2025.11070793.
19. Y. Hosain and M. Çakmak, “XAI-XGBoost: an innovative explainable intrusion detection approach for securing internet of medical things systems,” Sci. Rep., vol. 15, no. 1, p. 22278, Jul. 2025, doi: 10.1038/s41598-025-07790-0.
20. J. Al Faysal et al., “XGB-RF: A Hybrid Machine Learning Approach for IoT Intrusion Detection,” Telecom, vol. 3, no. 1, pp. 52–69, Jan. 2022, doi: 10.3390/telecom3010003.
21. N. Alsabilah and D. B. Rawat, “Joint Rough Set Theory and XGBoost-Based Learning for Network Intrusion Detection System,” IEEE Internet Things J., vol. 12, no. 7, pp. 7930–7937, Apr. 2025, doi: 10.1109/JIOT.2025.3528452.
22. S. S. Dhaliwal, A.-A. Nahid, and R. Abbas, “Effective Intrusion Detection System Using XGBoost,” Information, vol. 9, no. 7, p. 149, Jun. 2018, doi: 10.3390/info9070149.
23. M. A. O. Ahmed, Y. AbdelSatar, R. Alotaibi, and O. Reyad, “Enhancing Internet of Things security using performance gradient boosting for network intrusion detection systems,” Alexandria Engineering Journal, vol. 116, pp. 472–482, Mar. 2025, doi: 10.1016/j.aej.2024.12.106.
24. M. A. A. da Cruz, L. R. Abbade, P. Lorenz, S. B. Mafra, and J. J. P. C. Rodrigues, “Detecting Compromised IoT Devices Through XGBoost,” IEEE Transactions on Intelligent Transportation Systems, vol. 24, no. 12, pp. 15392–15399, Dec. 2023, doi: 10.1109/TITS.2022.3187252.
25. N. V. Sarı, M. Acı, and Ç. İ. Acı, “Windows Malware Detection via Enhanced Graph Representations with Node2Vec and Graph Attention Network,” Applied Sciences, vol. 15, no. 9, p. 4775, Apr. 2025, doi: 10.3390/app15094775.
26. K. G, D. S. C.A, and N. Kumar R, “Enhanced DNS Cybersecurity: Optimization of XGBoost Using Automated Hyperparameter Tuning via Optuna,” in 2024 4th International Conference on Mobile Networks and Wireless Communications (ICMNWC), IEEE, Dec. 2024, pp. 1–7. doi: 10.1109/ICMNWC63764.2024.10872404.
27. Y. Zhou, A. K. Maurya, Y. Deng, M. P. Fletcher, C. Ren, and A. Taylor, “BiomarkerML: A cloud-based proteomics ML workflow for biomarker discovery,” Oct. 17, 2025. doi: 10.1101/2025.10.16.682839.
28. A. Roustazadeh, F. Male, B. Ghanbarian, M. B. Shadmand, V. Taslimitehrani, and L. W. Lake, “Machine Learning-Based Estimation of Oil Recovery Factor Using XGBoost: Insights from Classification and Data-Driven Analyses,” InterPore Journal, vol. 2, no. 3, pp. IPJ250825-4, Aug. 2025, doi: 10.69631/ipj.v2i3nr53.
29. K. Shi, R. Shi, T. Fu, Z. Lu, and J. Zhang, “A Novel Identification Approach Using RFECV–Optuna–XGBoost for Assessing Surrounding Rock Grade of Tunnel Boring Machine Based on Tunneling Parameters,” Applied Sciences, vol. 14, no. 6, p. 2347, Mar. 2024, doi: 10.3390/app14062347.
30. C. G. L. Pringandana and K. Kusnawi, “A Comparative Analysis of Hyperparameter-Tuned XGBoost and LightGBM for Multiclass Rainfall Classification in Jakarta,” Jurnal Teknik Informatika (Jutif), vol. 6, no. 4, pp. 2467–2483, Aug. 2025, doi: 10.52436/1.jutif.2025.6.4.4965.
31. E. C. P. Neto, S. Dadkhah, R. Ferreira, A. Zohourian, R. Lu, and A. A. Ghorbani, “CICIoT2023: A Real-Time Dataset and Benchmark for Large-Scale Attacks in IoT Environment,” Sensors, vol. 23, no. 13, p. 5941, Jun. 2023, doi: 10.3390/s23135941.
32. T. Chen and C. Guestrin, “XGBoost: A Scalable Tree Boosting System,” in Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, New York, NY, USA: ACM, Aug. 2016, pp. 785–794. doi: 10.1145/2939672.2939785.
33. T. Akiba, S. Sano, T. Yanase, T. Ohta, and M. Koyama, “Optuna: A Next-generation Hyperparameter Optimization Framework,” in Proceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, New York, NY, USA: ACM, Jul. 2019, pp. 2623–2631. doi: 10.1145/3292500.3330701.
34. J. Bergstra, R. Bardenet, Y. Bengio, and B. Kégl, “Algorithms for Hyper-Parameter Optimization,” in Advances in Neural Information Processing Systems, J. Shawe-Taylor, R. Zemel, P. Bartlett, F. Pereira, and K. Q. Weinberger, Eds., Curran Associates, Inc., 2011. [Online]. Available: https://proceedings.neurips.cc/paper_files/paper/2011/file/86e8f7ab32cfd12577bc2619bc635690-Paper.pdf
35. Y. K. Beshah, S. L. Abebe, and H. M. Melaku, “Drift Adaptive Online DDoS Attack Detection Framework for IoT System,” Electronics (Basel)., vol. 13, no. 6, p. 1004, Mar. 2024, doi: 10.3390/electronics13061004.
36. L. Yang, D. M. Manias, and A. Shami, “PWPAE: An Ensemble Framework for Concept Drift Adaptation in IoT Data Streams,” in 2021 IEEE Global Communications Conference (GLOBECOM), IEEE, Dec. 2021, pp. 01–06. doi: 10.1109/GLOBECOM46510.2021.9685338.
37. K. Roshan and A. Zafar, “Ensemble adaptive online machine learning in data stream: a case study in cyber intrusion detection system,” International Journal of Information Technology, vol. 16, no. 8, pp. 5099–5112, Dec. 2024, doi: 10.1007/s41870-024-01727-y.
38. H. M. Gomes, J. Read, and A. Bifet, “Streaming Random Patches for Evolving Data Stream Classification,” in 2019 IEEE International Conference on Data Mining (ICDM), IEEE, Nov. 2019, pp. 240–249. doi: 10.1109/ICDM.2019.00034.
39. H. M. Gomes et al., “Adaptive random forests for evolving data stream classification,” Mach. Learn., vol. 106, no. 9–10, pp. 1469–1495, Oct. 2017, doi: 10.1007/s10994-017-5642-8.