# A Novel Intrusion Detection Approach Using Machine Learning Ensemble for IoT Environments
## 4 Experimental Results and Discussion
### Hyperparameter Optimization for the Random Forest Model  
To optimize the parameters, a search-space needs to be defined, so for the random forest model the defined search space is as follows in Table 5. \begin{table}
\begin{tabular}{c c c c} \hline \hline \multirow{2}{*}{**Parameter Description**} & \multirow{2}{*}{**Parameter Identifier**} & **Hyperparameter Search** & \multirow{2}{*}{**Hyperparameter Search Space Result**} \\  & & **Space Training** & \\ \hline Number of tree & & Uniform integer space in the & \\ estimators & (n\_estimators) & interval of [10; 100]. & \\ \hline Information gain criterion & (criterion) & Choice of Gini or entropy. & The entropy criterion yields a better performance than the Gini criterion in our search run. \\ \hline Maximum depth of a & (max\_depth) & (max\_depth) & Uniform integer space in the interval of [10; 100] or None resulting in an unbounded tree. & Restricting the depth of the trees seems to perform better than using unrestricted trees. A value in the interval of [20; 50] for the maximum tree depth yields a good performance. \\ \hline Maximum features for & (max\_features) & Choice of sqrt or log2. & The sqrt option seems to perform better than log2. \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Hyperparameter search space for random forest. The accuracy score of the random forest model, with consideration of precision and recall as visualized in Figure 5 with an average ratio of precision and recall, was 98.10%, and the computed confusion matrix over the true and predicted values is presented in Figure 6, which represents the number of true positives, true negatives, false positives, and false negatives. This time, before applying the gradient boosting machine learning modeling technique over the dataset, a preprocess was applied to compute the best optimal parameters of the data as visualized in Figure 7. The performance of the gradient boosting machine model over loss time had an average error score of \(-0.9826\), including the finite loss range pf \(-0.9827\), \(-0.9720\), and \(-0.9825\) as presented in Figure 8. The model performed quite well, again except for the attack category infiltration. Tables 6 and 7 cover the classification report and the range of misclassification attack of the model before using the random forest model, respectively. \begin{table}
\begin{tabular}{c c c c c} \hline \hline  & **Precision** & **Recall** & **f1-Score** & **Support** \\ \hline
**0** & 0.991 & 0.993 & 0.992 & 1,348,471 \\
**1** & 0.967 & 0.955 & 0.961 & 274,823 \\ \hline
**Accuracy** & & & 0.987 & 1,623,294 \\
**Macro avg** & 0.979 & 0.974 & 0.977 & 1,623,294 \\
**Weighted avg** & 0.987 & 0.987 & 0.987 & 1,623,294 \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Classification report of model before using random forest model. Figure 4: The loss-time graph with a best average error of random forest of \(-0.9810\) and the finite loss range of \(-0.9810\), \(-0.9751\), and \(-0.9805\). \begin{table}
\begin{tabular}{c c c c} \hline \hline  & **Misclassified** & **Total** & **Percent\_Misclassified** \\ \hline
**Infiltration** & 12,252 & 16,193 & 0.756623 \\
**SQL Injection** & 1 & 9 & 0.111111 \\
**Brute Force–Web** & 4 & 61 & 0.065574 \\
**Brute Force–XSS** & 1 & 23 & 0.043478 \\
**DoS attacks-Slowloris** & 8 & 1099 & 0.007279 \\
**Benign** & 8820 & 1,348,471 & 0.006541 \\
**Bot** & 17 & 28,619 & 0.000594 \\
**DDOS attack-HOIC** & 22 & 68,601 & 0.000321 \\
**DDoS attacks-LOIC-HTTP** & 17 & 57,619 & 0.000295 \\ \hline \hline \end{tabular}
\end{table} 
Table 7: Misclassification by attack category. Figure 5: Precision-recall curve with average precision/recall score \(\approx\) 98.10%. Figure 6: Confusion matrix without normalization. Hyperparameter optimization for gradient boosting machine (GBM) model. Again, the defined search space for the GBM model is as follows in Table 8.  
Figure 8: Loss-time graph with a best average error of gradient boosting machine of \(-0.9826\) and a finite loss range of \(-0.9827\), \(-0.9720\), and \(-0.9825\).