Previous research on behaviour-based attack detection on networks of IoT
devices has resulted in machine learning models whose ability to adapt to
unseen data is limited, and often not demonstrated. In this paper we present an
approach for modelling IoT network attacks that focuses on generalizability,
yet also leads to better detection and performance. First, we present an
improved rolling window approach for feature extraction, and introduce a
multi-step feature selection process that reduces overfitting. Second, we build
and test models using isolated train and test datasets, thereby avoiding common
data leaks that have limited the generalizability of previous models. Third, we
rigorously evaluate our methodology using a diverse portfolio of machine
learning models, evaluation metrics and datasets. Finally, we build confidence
in the models by using explainable AI techniques, allowing us to identify the
features that underlie accurate detection of attacks.

通过改进的滚动窗口方法和多步特征选择过程建立和测试使用隔离的训练和测试数据集的机器学习模型，从而避免了先前模型的通用性限制，提高了对行为基础攻击检测和 IoT 网络攻击的准确性。