<![CDATA[Purpose – The majority of research on intrusion detection systems (IDS) still uses outdated datasets that don't accurately reflect contemporary IoT threats, ignoring issues with class imbalance and effective hyperparameter tuning. Using the CICIoT2023 dataset, this work builds a machine learning-based intrusion detection pipeline that can classify 27 IoT attack classes in a multiclass environment. Design/Methods/Approach – The pipeline includes data preprocessing, Random Forest Feature Importance to select the top 20 features from 40 numerical features, MinMaxScaler normalization, SMOTE to handle class imbalance, and Optuna Tree-structured Parzen Estimator (TPE) to optimize XGBoost hyperparameters over 50 trials with three-fold stratified cross-validation. Findings – On 9,992 test samples, XGBoost optimized with Optuna outperformed default XGBoost (F1: 98.97%), Random Forest (F1: 98.98%), and KNN (F1: 94.81%), achieving 99.07% accuracy and F1-Score. With a Best Cross-Validation F1 of 99.88%, Optuna determined the ideal configuration. SMOTE was shown to have the most F1 contribution (0.27%) in the ablation study. Research Implications/Limitations – This study is constrained to a 50,000-sample subset from the full 46 million CICIoT2023 records and has not been validated on other IoT datasets. The pipeline was evaluated solely in a modeling environment and has not been deployed on physical IoT devices, meaning performance under actual hardware constraints remains to be verified. Originality/Value – This study proposes an integrated pipeline with a leakage-free final test set combining XGBoost, Optuna TPE, Random Forest Importance-based feature selection, and SMOTE on CICIoT2023, contributing a potentially more computationally efficient IDS alternative compared to deep learning architectures with multiclass classification across 27 contemporary IoT attack types.]]>
Copyrights © 2026
