NobleBlocks

Research indexJournal article

Optimizing Machine Learning Models for Anomaly-based IDS using Intercorrelation Threshold

Adi, Sugiharto, Hakim and 2 others

JOIV International Journal on Informatics Visualization30 Nov 2025Open access

NobleIDark:/48914/w1/20260525/2FDC2AFDDOI10.62527/joiv.9.6.3355

Free to read at the publisher

You can read the abstract here, or the full text at the publisher.

Read at the publisher

Abstract

This study aims to improve the performance of attack detection on the Bot-IoT dataset that faces class imbalance. The method used involves developing a feature selection model based on the Pearson correlation coefficient between features, with an adaptive threshold applied. The datasets used consist of two types: D1, with the 10 best features, and D2, with all features. The oversampling technique is applied to the minority class, followed by calculating feature correlations to determine the best feature using a threshold based on the average of the highest and lowest correlations. The feature selection process is carried out iteratively, with performance testing across several machine learning algorithms, including KNN, Random Forest, Logistic Regression, and SVM. The results show that the proposed feature selection method can improve the performance of the minority class without sacrificing the majority class's performance. On the D1 dataset, the Random Forest algorithm achieved 96% accuracy, while KNN achieved 93%. On the D2 dataset, KNN achieved balanced performance, with average precision, recall, and F1-score of 0.99 for both classes, while Random Forest achieved lower results on the minority class. The implications of this study indicate that correlation-based feature selection can improve attack detection performance on datasets with high class imbalance, and it can be implemented in future studies to address similar problems in IoT-based intrusion detection systems.

Discussion

Topics

More

Suggest a correction or report