# XGB-RF: A Hybrid Machine Learning Approach for IoT Intrusion Detection
## 2 Materials and Methods
### Classifiers
#### 2.4.2 eXtreme Gradient Boosting (XGBoost)
Five other machine learning (ML) schemes have also been used: (i) RF-RF (RF classification using RF-based feature selection), (ii) RF-RFE (RF classification using RFE-based feature selection), (iii) RF-RFECV (RF classification using RFECV-based feature selection), (iv) RF-SelectK (RF classification using Select-K-best feature selection) and (v) RF-WFS (RF classification without feature selection). The classification performance is shown in Table 3.

From Table 3, it is clear that the best accuracy (99.9426%) has been achieved from the XGB-RF model while RF-RF, RF-RFE, RF-RFECV, RF-SelectKBest, and RF-WFS model obtained nearly 90% accuracy for each. XGB-RF has also obtained the highest results for other performance metrics, including sensitivity (99.9426%), specificity (99.9942%), F1 score (99.9426%), balanced accuracy (99.9683%), etc. The proposed model has the lowest error score (0.06%). So, it can be said that the proposed model has surpassed other remaining models to a large extent in terms of performance. However, the RF-WFS approach performed worst among all of these models. In addition, we have now \begin{table}
\begin{tabular}{l c c c c c c c c} \hline \hline
**ML** & **ACC** & **F1\_Score** & **Kappa** & **MCC** & **Sensitivity** & **Specificity** & **Threat\_Score** &
\begin{tabular}{c} **Balanced** \\ **Accuracy** \\ \end{tabular} \\ \hline RF-RF & 89.6638\% & 86.2163\% & 88.5499\% & 89.6139\% & 89.6638\% & 98.9503\% & 86.3819\% & 94.3070\% \\
**XGB-RF** & **99.9426\%** & **99.9426\%** & **99.9364\%** & **99.9364\%** & **99.9426\%** & **99.9942\%** & **99.8921\%** & **99.9683\%** \\ RF-RFE & 89.6603\% & 86.2128\% & 88.5460\% & 89.6100\% & 89.6603\% & 98.9499\% & 86.3725\% & 94.3051\% \\ RF-RFECV & 89.6585\% & 86.2112\% & 88.5441\% & 89.6077\% & 89.6585\% & 98.9498\% & 86.3728\% & 94.3041\% \\ RF-SelectK & 89.6551\% & 86.2076\% & 88.5402\% & 89.6042\% & 89.6551\% & 98.9494\% & 86.3635\% & 94.3022\% \\ RF-WFS & 89.6324\% & 86.8542\% & 88.5153\% & 89.4106\% & 89.6324\% & 98.9472\% & 86.6114\% & 94.2898\% \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Performance of Classification Algorithms. calculated the execution time of our proposed approach as well. For the whole test set (57,458 instances), it required 57.822 s in a machine having a Core i9 Processor and 64 GB of RAM. This implies that the time required for each attack detection is only 0.0010063 s using XGB-RF. ### Confusion Matrix

A multi-class confusion matrix is used to understand the comparativeness of different classifiers. As we have multiple classes in our N-BaIoT dataset, the multi-class confusion matrix lets us visualize the confusion faced during predicting attacks. The confusion matrix for different classifiers is shown in Figure 3.

Here, the same test set is used in all cases in Figure 3 for a fair justification. From the confusion matrix of (a) RF-RF, it is noticeable that the classifier rarely classifies Gafgyt.tcp attacks where it only classifies 7 Gafgyt.tcp attacks out of 5939. Again, in the case of Gafgyt.udp attacks, RF-RF classifies almost all the attacks. However, it misclassifies 5930 as Gafgyt.tcp which affects the accuracy score. The confusion matrix of (b) XGB-RF, which is our proposed method, overcomes the unexpected issues created by the previously discussed classifier for detecting Gafgyt.tcp and Gafgyt.udp attacks, respectively. The misclassification rate is extremely low for this XGB-RF model. The model successfully recognizes 99.9426% of attacks. Again, from the (c) RF-RFECV confusion matrix, we see that it rarely classifies Gafgyt.tcp attacks. Here it classifies only 7 Gafgyt.tcp attacks out of 5939 while it misclassifies 5930 attacks as Gafgyt.upd. The accuracy of RF-RFECV is 89.6585% which is much lower than our proposed approach. Similarly, for (d) RF-RFE, (e) RF-SelectKBest, and (f) RF-WFS, a large amount of misclassification occurs for Gafgyt.tcp attacks as well.