Our proposed attack detection and alarming system for IoT facilities adopts a four-module architecture, viz:

(a) The feature scaling and selection module: This module adopts the novel Single Threshold Boxplot Outlier Based Feature scaling method (STBO) to reduce the number of attributes in order to select the best and most useful feature for the proposed RF-CBC model at the pre-processing stage of the attack detection and reporting processes.

(b) The profiling and classification module: This module accepts useful URL information and builds a user profile online and in real time in order to determine their different access credentials using random forest techniques. These are stored in a data mart/database created, leading to the creation of different clusters of users based on the profile of their access credentials.

(c) The decision module: This module is designed to use the correlation statistic to analyze the user’s browsing pattern alongside their access credentials and the attack information in order to arrive at a decision for detecting the anomaly. This is achieved by computing the correlation between the current user’s URL information and the historical browsing information in the clusters stored in the data mart.

(d) The update module: The update module is designed to fine-tune the update of the anomaly detection system; here, all raw URL requests and normalized data together with the intrusion detection result are stored in the database for further analysis in a feedback mechanism. This is to improve the robustness and reliability of the RF-CBC model as well as to facilitate further analysis by security experts.

In this study, a click log history of 15,374 anonymous users of the University of Medical Sciences (UNIMED) official website, who signed into their accounts over a period of 12 months from 12 May, 2023 to 3rd April, 2024, was selected randomly. The selected click log is made up of about 30,572 anonymous visitors to the UNIMED website server’s URL address database. Figure 1 shows a sample of extracted users’ browsing history’s HTTP from the UNIMED official website located at http://unimed.edu.ng .

We carried out a number of pre-processing operations on the raw user’s URL address database extracted by cleansing it, in order to eliminate irrelevant or noisy entries. After this, we developed a data mart of the log data and partitioned it into sessions [25] . After the session identification stage, we then applied the proposed Single Threshold Boxplot outlier-based feature scaling and feature selection algorithm to select the best feature for the proposed RF-CBC model. The proposed Random Forest algorithm was then used to group users into clusters based on similarities in their access.

Credentials, browsing HTTP logs, and attack information, while the correlation-based Clusters algorithm was used for the final decision as to whether a user is an attacker or a normal user based on their access credentials and similarities in their search behaviour to that of the identified clusters and the attack information, the result of which is used to update the data mart for further analysis. The overall architecture of the entire RF-CBC attack detection and reporting system is shown in Figure 2 .

Some of the problems with many machine learning algorithms are scalability and computational complexity. Noisy data and low-dimensional attributes, caused by too many features and instances, usually result in prediction or classification errors. To overcome these challenges, this work proposes a novel feature selection technique called the Single Threshold Boxplot Outlier Based Feature Scaling method (STBO) to scale down the number of attributes and select the best features for the proposed attack detection processes . In recent times, researchers in machine learning have proposed a number of feature selection techniques, such as Gini-index, χ² statistics, information gain, Wrapper method, and correlation technique, etc., . Some of these performed well on their data sets. Some of these techniques have been studied, and the pros and cons of each method have been thoroughly understood before proposing the current STBO technique.

In this work, the click log history of anonymous visitors to the UNIMED official website was selected as described in Section 3.2. The terms that occur in the documents are presented as parameters, features, attributes, tuples, or variables. After session identification, the term count was taken. Table 1 shows the term document matrix over all documents with the total term count. Figure 3 shows the statistics of the occurrence of each attribute in the different documents extracted.

This section presents the demonstration of the present STBO feature selection techniques using our collected data sets from the UNIMED official website, as shown in Table 1 . We applied the STBO feature scaling algorithm to eliminate irrelevant attributes and retain only relevant attributes that fall above the lower bound for our attack detection system. We compute the total term count for all the selected attributes and then sort them in descending order of their TTC, as shown in Table 2 . We compute Q₁, Q₂, Q₃, the IQR, the lower and the upper bound. We then minimize the number of attributes by selecting attributes that fall above the lower bound from the data set extracted. This is done in order to increase the accuracy and efficiency of our RF-CBC machine learning algorithm. Given our data set according to Table 1 and the sorted attributes according to their TTC, as shown in Table 2 .

$\begin{array}{c}\text{Compute the Lower Bound}\left(\text{LB}\right)=Q_1-1.5\ast \text{IQR}\\ =450-1.5\ast 111\\ =450-166.5\\ =283.5\end{array}$

Any attributes TCT that fall below the lower bound of 283 are treated as outliers and eliminated.

This section presents the evaluation of our proposed STBO feature selection technique in two different ways. First, we carried out feature selection on the extracted historical browsing pattern data from the University of Medical Sciences (UNIMED) website, using two baseline techniques which include Information Gain (IG), CFS, and the proposed STBO. Table 3 shows the number of features selected by each technique. The experimental results show that the IG and the present STBO selected fewer features, with STBO selecting fewer features in comparison with the baseline methods studied.

To further evaluate the accuracy and effectiveness of the present method, we tested the degree of accuracy of our RF-CBC algorithm with the STBO, IG, and CSF feature selection algorithms. The accuracy of the RF-CBC was determined using the expression:

$\text{Ac}=\frac{\text{TN}+\text{TP}}{\text{TP}+\text{TN}+\text{FP}+\text{FN}}$

where:

AC = Accuracy: This measures the proportion of correctly detected attacks and normal instances.

TP = True Positive: This is the number of correctly detected attack instances,

TN = True Negative: This is the number of correctly detected normal instances,

FP = False Positive: This is the number of incorrectly detected attack instances, and

FN = False Negative: This is the number of incorrectly detected normal instances.

The result of the experiment, as shown in Figure 4 , indicates that the proposed RF-CBC performed well, with the STBO technique significantly improving the accuracy of the RF-CBC algorithms in comparison with the IG and the CFS techniques at different levels of predictions and under the same experimental settings.

Random forest is an ensemble decision tree in which each tree depends on a collection of random variables. It is a supervised machine learning algorithm widely used in classification and regression problems. Random forest builds decision trees using different samples, then takes the majority votes of the trees for classification or averaging in the case of regression. Leo Breiman was believed to have first come up with the idea of random forest [28] .

Given an n-dimensional random vector $X={\left(X_1,X_2,X_3,\cdots ,X_n\right)}^{\text{T}}$ where $X_1,X_2,X_3,\cdots ,X_n$ represent the real valued input with Y representing the predictive class (voting) [29] .

Given an unknown Joint distribution $P_{xy}\left(X,Y\right)$

$F\left(x\right)$ is a function to predict Y, which is determined by a loss function $L\left(Y,F\left(X\right)\right)$, the loss function is defined to minimize the expected value of loss, which is denoted by Equation (1). [29] .

$E_{xy}\left(L\left(Y,f\left(x\right)\right)\right)$ (1)

The subscript here denotes expectation with respect to joint distribution of X and Y

$L\left(Y,f\left(x\right)\right)$ measures how close $f\left(x\right)$ is to Y, we choose zero-one-loss for classification, we have

$L\left(Y,f\left(x\right)\right)=L\left(Y\ne f\left(x\right)\right)=\{\begin{array}{l}0,\text{if}y=f\left(x\right)\\ 1,\text{otherwise}\end{array}$ (2)

If the set of possibilities value of Y is denoted by $\mathcal{Y}$, to maximise $E_{xy}\left(L\left(Y,f\left(x\right)\right)\right)$ for zero-one-loss we have

$f\left(x\right)=\frac{\arg \max n\left(Y=y|X=x\right)}{Y\in \mathcal{Y}}$ (3)

This is also known as Bayes’ rule.

In classification $f\left(x\right)$ represent the most frequently predicted class popularly known as (“votting”) where $h_i\left(x\right),\cdots ,h_j\left(x\right)$ is the “base learning” combination that gives the “ensemble” prediction $f\left(x\right)$ [29] .

$f\left(x\right)=\frac{\arg \max }{Y\in \mathcal{Y}}{\displaystyle {\sum }_{j=1}^{j}I\left(y=h_j^{\left(x\right)}\right)}{}_{}$ (4)

In Random forest, the J_th based learner denotes a tree represented by $h_j\left(x,{\theta }_j\right)$ where ${\theta }_j$ denotes collection of random variables and ${\theta }_j$’s are independent where $j=1,\cdots ,j$. The random forest algorithm is used to classify each client into their different users’ categories based on their access credentials. Based on majority votes, these are stored in a data mart/database created, leading to the creation of different clusters of users based on the profile of their access credentials.

In the early days of data mining/machine learning, humans adopted manual labeling of data. However, with the increase in the volume of data available these days, manual labeling of data has become difficult, tedious, and expensive. Hence, there is a need for automatic labeling. Clustering can be described as a method of grouping a set of data objects into different classes of similar objects [30] . Available literature shows that there are a number of clustering methods for machine learning, which include: K-modes, K-means, K-median, genetic K-means, intelligent K-means, etc. [31]

This present work adopts the K-modes clustering techniques. The K-Modes is a non-parametric algorithm capable of handling categorical data and optimizing a matching metric. The loss function (L_o) is used without explicitly applying any distance metric. Here, similar trees are categorized into the same cluster based on majority voting. We select K-initial modes, then form k clusters by assigning all the data points to the cluster with the nearest mode (vote) using the matching metrics. We later recompute the modes of the clusters until the convergence criteria are met.

The correlation statistic technique is used to analyze the users’ browsing patterns alongside their access credentials and the attack information to arrive at a decision for detecting the anomaly. This is achieved by computing the correlation between the client’s URL information and the historical browsing information in the clusters stored in the data mart.

A review of different distance measurement techniques shows that a good number of the existing techniques are marred with various challenges ranging from inaccuracy, susceptibility to noisy data, computational complexity, to scalability challenges, etc.

The present correlation Distance measurement technique is capable of overcoming these challenges while providing scalable, efficient, accurate, and simple distance measurement for any machine learning algorithm.

The correlation distance measurement technique is used to measure the relation and association between phenomena. The correlation relationship between two tuples X and Y can be expressed using Equation (5) below [29] .

$r\left(x,y\right)=\frac{{{\displaystyle \sum }}_{i=1}^n\left(x_i-\bar{x}\right)\left(y_i-\bar{y}\right)}{\sqrt{{{\displaystyle \sum }}_{i=1}^n{\left(x_i-\bar{x}\right)}^2{{\displaystyle \sum }}_{i=1}^n{\left(y_i-\bar{y}\right)}^2}}$ (5)

where $\bar{x}$ is the mean of Tuple, and $\bar{y}$ is the mean of tuple y.

X = Training tuple

Y = test Tuple

Correlation can have a value of 1, 0 or −1

If the correlation is 1, then this implies that there is a perfect positive correlation between variable X and Y

If the correlation is 0, that implies no correlation (the value of X and Y, don’t seem linked at all)

If the correlation is −1, that implies there is a perfect negative correlation [32] .

The random forest enabled Correlation based clustering (RF-CBC) algorithm listing is shown in Algorithm Listing 2 .

Algorithm Listing 2. The random forest enabled Correlation based clustering (RF-CBC) algorithm.

The correlation between user X₁ and user x₅ can now be computed as follows:

$r\left(x,y\right)=\frac{{{\displaystyle \sum }}_{i=1}^n\left(x_i-\bar{x}\right)\left(y_i-\bar{y}\right)}{\sqrt{{{\displaystyle \sum }}_{i=1}^n{\left(x_i-\bar{x}\right)}^2{{\displaystyle \sum }}_{i=1}^n{\left(y_i-\bar{y}\right)}^2}}$

$X_1=\left(1,1,1,2,6\right)$, $X_5=\left(4,4,2,6,12\right)$

The correlation between user X₅ and user X₁ is −1; this indicates that there is no relationship between user X₁ and user X₅. The process is repeated between the unknown user X₅ and every other user. If the correlation is 1, then we categorize user X₁ into the cluster of user Y₁ or any other matching cluster. However, if the correlation matches that of the attacker’s cluster or if the correlation is −1 throughout, then user X₁ is suspected to be an attacker and is therefore reported as an attacker.

As part of our experiment, we carried out a performance evaluation of our system through performance comparison of the present system with some baseline methods, which are the traditional random forest, the traditional clustering method, the Naïve Bayes, and the Artificial Neural Network techniques on the same datasets and environment. An experimental online attack detection and reporting system was developed to implement the RF-CBC model. In the developed attack detection system, the users enter their basic information, which is used to build their profile and credentials online and in real time. The attack detection report is triggered when the system observes abnormalities in the users’ browsing patterns. The source code for the developed application is available on request. The proposed system can be implemented online by uploading the present application to a web server, which can be invoked anytime online on any web browser.

In order to evaluate our RF-CBC model, we used the extracted historical browsing history of the UNIMED website dataset. The click log history of 15,374 anonymous users of the UNIMED official website, who signed into their accounts over a period of 12 months from 12th May, 2023 to 30th April, 2024, was randomly selected, which is made up of about 30,572 sessions/SQL queries. The selected records were divided into five parts, four of which were used as training sets and the remaining part was used as the testing set. The class/clusters of the training part were considered known while those of the testing part were considered unknown; the training part is used to infer the unknown part.

The software developed was used to run both the proposed RF-CBC and the baseline methods, which include: the Traditional Random Forest (TRF), the Naïve Bayesian (NBY), the Artificial Neural Network (ANN), and the Traditional Clustering (TCL) methods, for about sixty times. The results are used as a dataset for evaluation purposes. We calculate the Accuracy (ACC), True Positive (TP), True Negative (TN), False Positive (FP), False Negative (FN), Precision (P), and Recall (R).

where:

AC = Accuracy: This measures the proportion of correctly detected attacks and normal instances.

TP = True Positive: This is the number of correctly detected attack instances,

TN = True Negative: This is the number of correctly detected normal instances,

FP = False Positive: This is the number of incorrectly detected attack instances, and

FN = False Negative: This is the number of incorrectly detected normal instances.

We used the F1-Measure technique as presented in a confusion matrix shown in Table 6 .

As presented in the confusion matrix shown in Table 6 , to evaluate the detection quality of the RF-CBC model, where F-Measure is the harmonic mean of precision and recall, i.e.

$F=2\cdot \frac{\text{Precision}\cdot \text{recall}}{\text{Precision}+\text{recall}}$

This is referred to as the F1- measure, since recall and precision are weighted.

Precision is the number of correct predictions divided by the number of all returned predictions, i.e.

$\text{Precision}\left(P\right)=\frac{\text{TP}}{\text{TP}+\text{FP}}$

Recall is the number of correct predictions divided by the number of all known interest supposed to be discovered, i.e.

$\text{Recall}\left(R\right)=\frac{\text{TP}}{\text{TP}+\text{FN}}$ [17] [30] .

Table 7 shows our experimental results on the UNIMED browsing history database with ACC, TP, TN, FP, TP, Precision, and Recall. Figure 5 shows the result of our conducted experiment in F1-Measure using our browsing history click logs database.

We recorded the results for both the TP, FP, TN, TF. We computed the Precision, the Recall, and the F1-Measure and compared the precision rate as shown in Table 7 . Table 6 shows the number of documents failing in each category using the confusion matrix. Our experimental result is shown in Figure 5 . The result shows the excellent performance of the present RF-CBC model over the baseline methods studied. We established that the different algorithms studied generally have a peak point, though with significant differences in performance. The F1-measure value initially increases for each algorithm studied before their respective peak points, then gradually goes down after the peak point, meaning that the precision is nearly stable and recall increases before the peak, after which the precision decreases and recall is almost stable. Figure 5 shows the F1-Measure of the proposed RF-CBC, the TRF, NBY, ANN, and the TCL algorithms at different lengths of prediction/detection using the UNIMED official website users’ click log dataset. The result shows the superiority of the present RF-CBC model over the baseline methods studied. The experimental result shows that the TRF, NBY, ANN, and TCL techniques recorded lower F1-Measure when run on our dataset, as shown in Figure 5 ; they performed poorly compared with the RF-CBC algorithm. The RF-CBC algorithm has the highest F1-Measure when used on our dataset. The experiment was carried out for over 60 different lengths of prediction using the same datasets and experimental settings. The Naïve Bayesian, the traditional Random Forest, and the traditional clustering algorithms perform a little better at short lengths of prediction below 15, but poorly at longer and worst at lengths of prediction longer than 25; this therefore results in a limited number of positive detections. However, the ANN performs a bit better than the TRF, NBY, and TCL techniques, but also only at shorter lengths and poorly at longer lengths of prediction and worst at lengths above 25, thereby resulting in a few positive detections. The proposed RF-CBC has over 80 F1-Measures for lengths of prediction between 1 and 20, after which it maintains about 75% F1-Measure at longer lengths of prediction as shown in Figure 5 . The experimental result shows that the RF-CBC demonstrates higher potential in detecting and reporting abnormalities on our experimental website; hence, it remains the clear winner in this case.

Furthermore, we authenticate the potential of the present RF-CBC model over the baseline method by comparing their respective execution speeds in seconds. We recorded the run time of each algorithm at different prediction lengths using our experimental datasets and under the same experimental settings. The experimental results indicate that the RF-CBC has the lowest run time and executes faster than the baseline methods studied in all cases.

Though the NBY and the ANN also show low runtime compared to the TRF and the TCL technique, generally, the baseline methods’ runtime increases rapidly as the prediction length increases, as shown in Figure 6 . The proposed RF-CBC recorded a lower runtime at all lengths; therefore, it achieves better results with large datasets and longer prediction lengths. The outstanding performance of our system may be due to the adoption of multiple techniques for the detection and reporting of intruders on the experimental website, such as the introduction of the STBO feature selection technique to select the best features that eliminate noisy data, user clustering based on their different credentials and types of allowed operation by the different categories of users on the website, the use of correlation distance measurement technique, etc. All these factors have made the RF-CBC the most appropriate method for this study.

Finally, the RF-CBC model shows potential for detecting and reporting many forms of attack on any IoT device. The model is specifically suitable for domains with large volumes of data and any number of relevant attributes. The RF-CBC also shows the capability to overcome some of the challenges of many existing attack detection systems, such as noisy data, scalability, poor distance measurement functions, and computational complexity. Therefore, it establishes a flexible, scalable, transparent, accurate, faster, computationally efficient, easy to understand, and easy to implement method of attack detection and reporting systems. Our experimental results show that the RF-CBC can outperform the traditional Random Forest, Naïve Bayesian, traditional Clustering, and the Artificial Neural Network techniques in a very difficult attack detection task and in a very large dataset online and in real time consistently.