Abstract: To address the performance bottlenecks in IoT intrusion detection caused by resource-constrained devices, high-dimensional redundant traffic features, and imbalanced attack sample distributions, we propose an IoT intrusion detection method that integrates adaptive feature optimization and boundary-balanced sampling. First, to mitigate the increased computational overhead and classification interference caused by high-dimensional redundant features in IoT traffic data, we design an adaptive cross-validation recursive feature selection algorithm based on Light Gradient Boosting Machine (LightGBM), termed LightGBM-based Adaptive Cross-Validation Recursive Feature Selection (LARFS). This algorithm combines feature importance evaluation with a cross-validation recursive feature elimination mechanism and adaptively searches for the optimal feature subset, thereby effectively reducing feature dimensionality while maintaining detection performance. Second, to overcome the class imbalance in IoT traffic and the boundary noise introduced by conventional oversampling methods, we propose a data balancing method termed Weighted Borderline-SMOTE and Tomek-ENN-based Data Balancing (WBSTE), which combines weighted Borderline-Synthetic Minority Over-sampling Technique (weighted Borderline-SMOTE) with Tomek links and Edited Nearest Neighbors (ENN). By enhancing boundary samples, removing class overlap, and cleansing noise, WBSTE effectively improves the model’s ability to recognize minority attack samples. Experimental results on the N-BaIoT dataset demonstrate that the proposed method achieves high detection accuracy and low computational overhead, making it well-suited for resource-constrained IoT environments.

Key words: IoT intrusion detection, adaptive feature optimization, boundary-balanced sampling, feature selection, class imbalance

摘要： 针对物联网设备资源受限、流量数据特征高维冗余以及攻击样本分布不均衡导致的入侵检测性能瓶颈，本文提出一种融合自适应特征优化与边界均衡采样的物联网入侵检测方法。首先，针对物联网流量数据存在高维冗余特征导致模型计算开销增加并干扰分类决策的问题，设计一种基于轻量级梯度提升机（Light Gradient Boosting Machine，LightGBM）的自适应交叉验证递归特征选择算法，该算法结合特征重要性评估与交叉验证递归特征消除机制，通过自适应搜索最优特征子集，在保障检测性能的同时有效降低特征维度。其次，针对物联网流量类别分布不均衡及传统过采样易引入边界噪声的不足，提出一种加权边界合成少数类过采样技术（Synthetic Minority Oversampling Technique，SMOTE）与Tomek-ENN相结合的数据均衡采样方法（Weighted Border-line-SMOTE and Tomek-ENN-based Data Balancing，WBSTE），通过边界样本增强、清除类别重叠及噪声清洗，有效提升模型对少数类攻击样本的识别能力。在N-BaIoT数据集上的实验结果表明，所提方法能够在资源受限的物联网环境中实现高精度、低计算开销的入侵检测。

关键词: 物联网入侵检测, 自适应特征优化, 边界均衡采样, 特征选择, 类别不平衡