IoT Cyberattack Detection System

ML-based system that detects and classifies cyberattacks in IoT network traffic using Random Forest and MLP Neural Network.

Problem Statement

IoT devices generate massive network traffic and are frequent targets of cyberattacks. This system analyzes network traffic data and classifies it into 8 categories — Normal traffic and 7 attack types — helping identify threats in real time.

Tech Stack

• Python, scikit-learn, pandas, numpy
• matplotlib, seaborn (visualization)
• Tkinter (desktop GUI)

Models Used

Model	Description
Random Forest	Ensemble of 10 decision trees, handles non-linear patterns
MLP Neural Network	Multi-layer perceptron, deep learning approach for complex pattern recognition

ML Pipeline

1. Data Upload — Load CSV dataset via file dialog
2. Preprocessing — Label encoding for categorical features, imputation for missing values, StandardScaler normalization
3. Feature Selection — PCA reducing to 10 principal components
4. Training — 80/20 train-test split, both models trained independently
5. Evaluation — Accuracy, Precision, Recall, F1 score + Confusion Matrix heatmap
6. Prediction — Upload new test CSV, get attack/normal classification output

Results

Model	Accuracy	Precision	Recall	F1 Score
Random Forest	99.48%	99.48%	99.48%	99.48%
MLP Neural Network	99.45%	99.45%	99.45%	99.45%

Results obtained on UNSW-NB15 dataset with 357,952 samples. Run the application to reproduce.

Attack Classes Detected

Normal, anomalous(DoSattack), anomalous(dataProbing), anomalous(malitiousControl), anomalous(malitiousOperation), anomalous(scan), anomalous(spying), anomalous(wrongSetUp)

How to Run

Prerequisites

• Python 3.8+
• Install dependencies:

pip install -r requirements.txt

Run the application

python IOTCyberAttackDetection.py

Steps

1. Click 1. Upload IoT Dataset → select your .csv file
2. Click 2. Preprocess Dataset → cleans and scales the data
3. Click 3. Feature Selection (PCA) → applies PCA
4. Click 4a/4b Run Models → trains model and shows results
5. Click 5. Predict from Test Data → upload test CSV to classify new traffic

Screenshots

Dataset

This project uses IoT network traffic data. Dataset not included in repo due to size.

• Recommended: UNSW-NB15 Dataset
• Or: CIC-IoT Dataset

Future Improvements

• Convert to web app (FastAPI + React) for browser-based access
• Add real-time network traffic monitoring
• Integrate SHAP for model explainability
• Expand to more attack categories

Author

CH Veeramani Swarup — GitHub | LinkedIn