Citation

Teoh, R. N. and Tan, S. C. (2025) Impact of Network Identifier Attribute on Machine Learning-Based Threat Detection and Classification in SDN-Based IoT Architecture. Lecture Notes in Computer Science, 16066. pp. 173-186. ISSN 0302-9743

Full text not available from this repository.

Abstract

The generalizability of Machine Learning (ML) classifiers in threat detection and classification (TD-TC) is crucial, particularly in Software-Defined Network (SDN)-based Internet of Things (IoT) architectures, where dynamic network management and centralized control introduce unique security challenges. However, there is an ongoing debate regarding the role of Network Identifier Attributes (NIAs) in training and evaluating ML models using publicly available datasets comprising network behaviors. Therefore, this study investigates the influence of NIAs on model generalization by examining learning curves with cross-validation. The results show that Timestamp and Flow ID lead to memorization in classifier models when using the IoTID20 dataset. However, removing all NIAs still resulted in a relatively high classifier accuracy, with Decision Tree (DT) achieving 96.63% and Random Forest (RF) achieving 96.09%. Notably, no clear signs of memorization were observed with the remaining NIAs in the IoTID20 dataset or with all NIAs in the InSDN dataset, suggesting that these attributes may not contribute to memorization. These findings suggest that while some NIAs may be excluded without sacrificing model performance, further investigation is necessary to explore their impact on feature selection and generalization across different datasets.

Item Type:	Article
Subjects:	Q Science > QA Mathematics > QA71-90 Instruments and machines
Divisions:	Faculty of Computing and Informatics (FCI)
Depositing User:	Ms Suzilawati Abu Samah
Date Deposited:	10 Feb 2026 07:09
Last Modified:	10 Feb 2026 07:09
URII:	http://shdl.mmu.edu.my/id/eprint/15311

Downloads

Edit (login required)