# An Ensemble-Based Machine Learning Approach for Cyber-Attacks Detection in Wireless Sensor Networks
###### Abstract  
Wireless Sensor Networks (WSNs) are the key underlying technology of the Internet of Things (IoT); however, these networks are energy constrained. Security has become a major challenge with the significant increase in deployed sensors, necessitating effective detection and mitigation approaches. Machine learning (ML) is one of the most effective methods for building cyber-attack detection systems. This paper presents a lightweight ensemble-based ML approach, Weighted Score Selector (WSS), for detecting cyber-attacks in WSNs. The proposed approach is implemented using a blend of supervised ML classifiers, in which the most effective classifier is promoted dynamically for the detection process to gain higher detection performance quickly. We compared the performance of the proposed approach to three classical ensemble techniques: Boosting-based, Bagging-based, and Stacking-based. The performance comparison was conducted in terms of accuracy, probability of false alarm, probability of detection, probability of misdetection, model size, processing time, and average prediction time per sample. We applied two independent feature selection techniques. We utilized the simulation-based labeled dataset, WSN-DS, that comprises samples of four internal network-layer Denial of Service attack types: Grayhole, Blackhole, Flooding, and TDMA scheduling, in addition to normal traffic. The simulation revealed promising results for our proposed approach. a _applied_  
_sciences_  
[1  
traffic [9]. All traditional supervised learning-based detection methods have flaws related to the learning process, such as dataset specifications in terms of size and number of features, selected ML techniques, and imbalanced classification [10]. Ensemble-based techniques have gained much attention in various fields since they offer better solutions and manage the different trade-offs more effectively than other classical single classifiers. Combining multiple ML algorithms to construct ensemble learners improves prediction capabilities because (1) ensemble approaches involve several ML algorithms cooperating to overcome their respective constraints; (2) the ensemble algorithms can perform averaging or majority voting and learn how to choose the correct classier; and (3) an ensemble built using the search from a variety of initial points can potentially provide a better approximation to the objective function at hand than any base classifier. We expected highly accurate classifications that can reduce the chance of false positives and false negatives when detecting different types of network layer WSN-based cyber-attacks, such as false data injection, Sybil, Sinkhole, and Denial of Service (DoS) [11]. Special considerations must be taken when applying these techniques to WSNs due to their unique characteristics. For these reasons, applying ensemble-based ML techniques to detect DoS attacks on WSNs requires further investigation and performance evaluation [12]. We present a lightweight ensemble-based ML approach, Weighted Score Selector (WSS), to detect cyber-attacks targeting WSNs. The proposed approach allows us to choose the most effective model among a set of classifiers to detect attacks. The proposed approach's design is simpler than any other ensemble technique, formed of a pool of conventional supervised ML techniques: Support Vector Machine (SVM), Gaussian Naive Bayes (NB), Decision Tree (DT), K-Nearest Neighbor (KNN), Random Forest (RF), and LightGBM. The model with the best performance in terms of the considered evaluation metrics will be dynamically promoted for the detection process. We investigated the proposed ensemble approach's effectiveness against three classical ensemble techniques: Boosting-based, Bagging-based, and Stacking-based. We conducted performance analysis in terms of accuracy, probability of false alarm, probability of detection, probability of misdetection, processing time, average prediction time per sample, and model size. We applied two independent feature selection techniques to simplify the design.