[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-119201-en":3,"doc-seo-119201-105":30,"detail-sidebar-cat-0-en-105":91},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":4,"is_deleted":4,"is_public":20,"is_downloadable":20,"audit_status":20,"page_count":21,"language":22,"language_code":23,"site_id":24,"html_lang":23,"table_of_contents":25,"faqs":26,"seo_title":27,"seo_description":14,"update_tm":28,"read_time":29},119201,8796095461610,"Oliver","https://ap-avatar.wpscdn.com/davatar_276721f389ce27ea32af1340a28f341c",8,"Research & Report","Extracting Optimal Number of Features for Machine Learning Models in Multilayer IoT Attacks","Rapid adoption of Internet of Things (IoT) systems increases security exposure from sophisticated multilayer attacks that breach multiple defenses and cause substantial data loss, personal information theft, and financial damages. Prior work shows limited real-world readiness, often relying on outdated datasets and focusing insufficiently on adaptive, dynamic defenses. This research proposes a Semi-Automated Intrusion Detection System (SAIDS) combining feature selection, feature weighting, normalization, visualization, and human–machine interaction to detect and identify multilayer attacks. The framework extracts an optimal set of 13 features from 64 in the Edge-IIoT dataset, improving binary detection with KNN accuracy above 94% across attacks such as UDP, ICMP, HTTP flood, MITM, TCP SYN, XSS, and SQL injection.","Article  \nExtracting Optimal Number of Features for Machine Learning Models in Multilayer IoT Attacks  \nBadeea Al Sukhni 1, *, Soumya K. Manna 1, *, Jugal M. Dave 2 and Leishi Zhang 1  \nCitation: Sukhni, B.A.; Manna, S.K.; Dave, J.M.; Zhang, L. Extracting Optimal Number of Features for Machine Learning Models in Multilayer IoT Attacks. Sensors 2024, 24, 8121. [https://doi.org/10.3390/](https://doi.org/10.3390/)  \ns24248121  \nAcademic Editors: Rodrigo  \nRomán-Castro and Antonio Muñoz  \nReceived: 15 October 2024  \nRevised: 14 December 2024  \nAccepted: 18 December 2024  \nPublished: 19 December 2024  \nCopyright: © 2024 by the authors. Licensee MDPI, Basel, Switzerland. This article is an open access article distributed under the terms and conditions of the Creative Commons Attribution (CC BY) license ([https://](https://)[ ](https://)[creativecommons.org/licenses/by/](creativecommons.org/licenses/by/)[ ](creativecommons.org/licenses/by/)[4.0/](4.0/)) .  \n1 School of Engineering, Technology and Design, Canterbury Christ Church University, Canterbury CT1 1QU, UK; [leishi.zhang@canterbury.ac.uk](leishi.zhang@canterbury.ac.uk)  \n2 Directorate of Research and Publications, Rashtriya Raksha University, Gandhinagar 382305, India; [jugal.dave@rru.ac.in](jugal.dave@rru.ac.in)  \n* [Correspondence: b.alsukhni331@canterbury.ac.uk](Correspondence: b.alsukhni331@canterbury.ac.uk) (B.A.S.); [soumyakanti.manna@canterbury.ac.uk](soumyakanti.manna@canterbury.ac.uk) (S.K.M.)  \nAbstract: The rapid integration of Internet of Things (IoT) systems in various sectors has escalated security risks due to sophisticated multilayer attacks that compromise multiple security layers and lead to significant data loss, personal information theft, financial losses etc. Existing research on multilayer IoT attacks exhibits gaps in real-world applicability, due to reliance on outdated datasets with a limited focus on adaptive, dynamic approaches to address multilayer vulnerabilities. Additionally, the complete reliance on automated processes without integrating human expertise in feature selection and weighting processes may affect the reliability of detection models. Therefore, this research aims to develop a Semi-Automated Intrusion Detection System (SAIDS) that integrates efficient feature selection, feature weighting, normalisation, visualisation, and human–machine interaction to detect and identify multilayer attacks, enhancing mitigation strategies. The proposed framework managed to extract an optimal set of 13 significant features out of 64 in the Edge-IIoT dataset, which is crucial for the efficient detection and classification of multilayer attacks, and also outperforms the performance of the KNN model compared to other classifiers in binary classification. The KNN algorithm demonstrated an average accuracy exceeding 94% in detecting several multilayer attacks such as UDP, ICMP, [HTTP flood](HTTP flood), MITM, TCP SYN, XSS, SQL injection, etc.  \nKeywords: IoT attacks; multilayer security; feature selection; feature weighting; machine learning; human–machine teaming  \n1. Introduction  \nThe rise of the Internet of Things has changed how we live and work, leading to new developments in areas such as health, education, energy, and transportation. This change is driven by the increasing use of IoT devices, such as smart metres, wearable technology, and smartphones. The number of these devices is expected to reach 55.7 billion by 2025, according to the International Data Corporation (Global market intelligence, data, and events provider, Massachusetts, United States) [1] . However, this growth also brings new challenges, especially in terms of security and privacy. This is because IoT devices are often designed with limited computational resources and processing power, making them easy targets for cyber attackers. Estimations from the National Cyber Security Centre (Government Cyber Security Organization, London, United Kingdom) suggest that around 98% of IoT traff","cbCaipAA5s96eZfm","https://ap.wps.com/l/cbCaipAA5s96eZfm","pdf",10123717,1,31,"English","en",105,"# Abstract\n# Introduction\n## IoT growth and security challenges\n## IoT architecture vulnerabilities\n## Single-layer vs multilayer attacks\n# Proposed Semi-Automated Intrusion Detection System","[{\"question\":\"Why do multilayer IoT attacks pose greater risk than single-layer attacks?\",\"answer\":\"Multilayer attacks exploit vulnerabilities across multiple IoT layers simultaneously, which can compromise the overall ecosystem and lead to greater impacts such as data loss and personal information theft.\"},{\"question\":\"What problem does the paper aim to address in existing multilayer attack research?\",\"answer\":\"It targets gaps in real-world applicability caused by reliance on outdated datasets and limited adaptive, dynamic approaches, as well as over-automation that omits human expertise in feature selection and weighting.\"},{\"question\":\"How does the proposed SAIDS improve detection performance?\",\"answer\":\"SAIDS integrates feature selection and weighting with normalization and visualization, using human–machine interaction to detect and identify multilayer attacks. It extracts an optimal set of 13 features from 64 and achieves KNN binary classification accuracy exceeding 94% on multiple attack types.\"}]","Extracting Optimal Number of Features for Machine Learning Models in Multilayer IoT Attacks | PDF",1785723067,78,{"code":4,"msg":31,"data":32},"ok",{"site_id":24,"language":23,"slug":33,"title":13,"keywords":34,"description":14,"schema_data":35,"social_meta":86,"head_meta":88,"extra_data":90,"updated_unix":28},"extracting-optimal-number-of-features-for-machine-learning-models-in-multilayer-iot-attacks","",{"@graph":36,"@context":85},[37,54,68],{"@type":38,"itemListElement":39},"BreadcrumbList",[40,44,48,51],{"item":41,"name":42,"@type":43,"position":20},"https://docshare.wps.com","Home","ListItem",{"item":45,"name":46,"@type":43,"position":47},"https://docshare.wps.com/document/","Document",2,{"item":49,"name":12,"@type":43,"position":50},"https://docshare.wps.com/document/research-report/",3,{"item":52,"name":13,"@type":43,"position":53},"https://docshare.wps.com/document/extracting-optimal-number-of-features-for-machine-learning-models-in-multilayer-iot-attacks/119201/",4,{"url":52,"name":13,"@type":55,"author":56,"headline":13,"publisher":58,"fileFormat":61,"inLanguage":23,"description":14,"dateModified":62,"datePublished":62,"encodingFormat":61,"isAccessibleForFree":63,"interactionStatistic":64},"DigitalDocument",{"name":9,"@type":57},"Person",{"url":41,"name":59,"@type":60},"DocShare","Organization","application/pdf","2026-08-03",true,{"@type":65,"interactionType":66,"userInteractionCount":4},"InteractionCounter",{"@type":67},"ViewAction",{"@type":69,"mainEntity":70},"FAQPage",[71,77,81],{"name":72,"@type":73,"acceptedAnswer":74},"Why do multilayer IoT attacks pose greater risk than single-layer attacks?","Question",{"text":75,"@type":76},"Multilayer attacks exploit vulnerabilities across multiple IoT layers simultaneously, which can compromise the overall ecosystem and lead to greater impacts such as data loss and personal information theft.","Answer",{"name":78,"@type":73,"acceptedAnswer":79},"What problem does the paper aim to address in existing multilayer attack research?",{"text":80,"@type":76},"It targets gaps in real-world applicability caused by reliance on outdated datasets and limited adaptive, dynamic approaches, as well as over-automation that omits human expertise in feature selection and weighting.",{"name":82,"@type":73,"acceptedAnswer":83},"How does the proposed SAIDS improve detection performance?",{"text":84,"@type":76},"SAIDS integrates feature selection and weighting with normalization and visualization, using human–machine interaction to detect and identify multilayer attacks. It extracts an optimal set of 13 features from 64 and achieves KNN binary classification accuracy exceeding 94% on multiple attack types.","https://schema.org",{"og:url":52,"og:type":87,"og:title":13,"og:site_name":59,"og:description":14},"article",{"robots":89,"canonical":52},"index,follow",{"doc_id":7,"site_id":24},{"code":4,"msg":5,"data":92},[93,97,101,105,110,115,120,123,128,131,135],{"id":20,"doc_module":4,"doc_module_name":46,"category_name":94,"show_sort_weight":95,"slug":96},"Story & Novel",90,"story-novel",{"id":47,"doc_module":4,"doc_module_name":46,"category_name":98,"show_sort_weight":99,"slug":100},"Literature",80,"literature",{"id":53,"doc_module":4,"doc_module_name":46,"category_name":102,"show_sort_weight":103,"slug":104},"Exam",70,"exam",{"id":106,"doc_module":4,"doc_module_name":46,"category_name":107,"show_sort_weight":108,"slug":109},5,"Comic",60,"comic",{"id":111,"doc_module":4,"doc_module_name":46,"category_name":112,"show_sort_weight":113,"slug":114},6,"Technology",50,"technology",{"id":116,"doc_module":4,"doc_module_name":46,"category_name":117,"show_sort_weight":118,"slug":119},7,"Healthcare",40,"healthcare",{"id":11,"doc_module":4,"doc_module_name":46,"category_name":12,"show_sort_weight":121,"slug":122},30,"research-report",{"id":124,"doc_module":4,"doc_module_name":46,"category_name":125,"show_sort_weight":126,"slug":127},9,"Religion & Spirituality",20,"religion-spirituality",{"id":126,"doc_module":4,"doc_module_name":46,"category_name":129,"show_sort_weight":126,"slug":130},"World Cup","world-cup",{"id":132,"doc_module":4,"doc_module_name":46,"category_name":133,"show_sort_weight":132,"slug":134},10,"Lifestyle","lifestyle",{"id":136,"doc_module":4,"doc_module_name":46,"category_name":137,"show_sort_weight":106,"slug":138},19,"General","general"]