Detecting anomalies in Internet of Things (IoT) networks is a critical security challenge, often hampered by highly imbalanced and diverse network traffic datasets. Standard classifiers struggle to perform well across all traffic types. This paper proposes a hybrid detection model to address this challenge using the Bot-IoT dataset. Instead of a single complex classifier, we first employ K-Means clustering to segment the training data into three distinct traffic profile clusters. We then train and evaluate multiple baseline machine learning models, including Decision Tree, KNN, and XGBoost, on each cluster independently to identify the optimal classifier for that specific data profile. Our results show that this clusterspecific, hybrid approach, which assigns different simple models to different clusters, improves detection accuracy and provides a more robust and efficient framework for handling diverse IoT attack traffic.

翻译：物联网（IoT）网络中的异常检测是一项关键安全挑战，而高度不平衡且多样化的网络流量数据集往往使这一问题更加棘手。标准分类器难以在所有流量类型上均取得良好性能。本文基于Bot-IoT数据集提出了一种混合检测模型以应对该挑战。我们不采用单一复杂分类器，而是首先利用K-Means聚类将训练数据划分为三个不同的流量特征簇。随后，在每个簇上独立训练并评估多个基准机器学习模型（包括决策树、KNN和XGBoost），以确定该特定数据特征对应的最优分类器。实验结果表明，这种为不同簇分配不同简单模型的簇特定混合方法能够提升检测精度，并为处理多样化IoT攻击流量提供了更稳健高效的框架。