Comparative evaluation of machine learning models for intrusion detection in WSNs using the IDSAI dataset
10.11591/ijai.v14.i6.pp4913-4922
Mansour Lmkaiti
,
Houda Moudni
,
Hicham Mouncif
This paper provides comparative assessment of three lightweight machine learning (ML) models (logistic regression (LR), random forest (RF), and gradient boosting (GB)), which are employed to detect intrusions in wireless sensor networks (WSNs) using the IDSAI dataset. The goal is to determine the most effective and deployable classifier within the constraints of WSN resources. In order to prevent data leakage and report accuracy, precision, recall, F1-score, and receiver operating characteristic-area under the curve (ROC-AUC) with mean±SD, we implement stratified 5-fold cross validation with in fold preprocessing. The results indicate that RF provides the most optimal generalization and overall performance (accuracy 0.9994 ± 0.0001, precision 0.9995±0.0001, recall 0.9994±0.0001, F1-score 0.9994±0.0001, ROC–AUC 0.9998 ± 0.0000). RF is closely followed by GB (accuracy 0.9990±0.0001, precision 0.9995±0.0001, recall 0.9985±0.0001, F1-score 0.9990 ± 0.0001, ROC-AUC ≈ 1.0000). LR demonstrates limitations in linearly overlapping classes, as evidenced by its high precision but reduced recall (accuracy 0.9167±0.0010, precision 0.9829±0.0002, recall 0.8481±0.0018, F1-score 0.9105 ± 0.0011, ROC–AUC 0.9707 ± 0.0001). In order to evaluate deployability, we characterize the inference throughput on a modest PC: LR ∼ 6.5 × 105 samples/s, GB ∼ 2.2 × 105 samples/s, and RF ∼ 1.3 × 105 samples/s, indicating a tiered intrusion detection system (IDS) (LR at sensors, RF at cluster-heads, and GB at the gateway). We also address the potential dangers of overfitting that may arise from the cleanliness of the dataset and provide a roadmap for future validation on a more diverse set of traffic. The research establishes a baseline for lightweight IDS in actual WSNs that is deployable and reproducible.
