Evaluating Ensemble Versus Non-Ensemble Machine Learning Performance with Preprocessing Techniques for IoT Intrusion Detection on CICIoT2023 - Febrian Sabila Firdaus; Puspanda Hatta; Basori Basori (Jurnal Teknik Informatika (Jutif), 2026)
The rapid expansion of the Internet of Things (IoT) introduces significant security vulnerabilities, exposing networks to sophisticated attacks. Developing effective Intrusion Detection Systems (IDS) is critical, yet many machine learning benchmarks rely on outdated datasets. This study provides a comprehensive comparative evaluation of ensemble and non-ensemble machine learning models for multiclass attack classification using the modern and complex CICIoT2023 dataset. The methodology involves robust preprocessing, including random undersampling to address extreme class imbalance and a hybrid feature selection approach combining Mutual Information (MI) and Random Forest Feature Importance (RFFI). Models, including Naive Bayes, Logistic Regression, SVM, Random Forest, and XGBoost, were evaluated using stratified 5-fold cross-validation (K=5) with default hyperparameters. The results demonstrate that ensemble models consistently and significantly outperform non-ensemble models. XGBoost achieved the highest and most stable performance, yielding a mean F1-score of 0.8889 ± 0.0008 across the K-folds, and a final macro F1-score of 0.8891 on the test set. This research confirms the superiority of ensemble methods for complex IoT traffic and quantitatively highlights the critical role of preprocessing. Notably, scaling was proven essential for non-ensemble models, drastically improving Logistic Regression's F1-score from an unstable 0.6280 to 0.7691.