CA-WGA: A Correlation-Aware Wrapper-Based Genetic Algorithm for Efficient IoT Anomaly Detection

Abstract

The rapid emergence of Internet of Things (IoT) applications has led to a substantial increase in network traffic and a rise in computational complexity, concurrently exposing these resource-constrained devices to cyber threats. A major concern regarding these devices is the collection of sensitive data, including personally identifiable information. Due to the distinctive attributes of these devices, traditional Intrusion Detection Systems (IDS) often struggle with the high-dimensional and redundant nature of IoT network data, and intruders can easily bypass security with little effort. In this paper, we introduce a Correlation-Aware Wrapper-based Genetic Algorithm (CA-WGA) designed to optimize feature selection for anomaly-based IDS. The core innovation is a modified Genetic Algorithm fitness function that combines the F1-macro score and accuracy of a Decision Tree classifier with a correlation penalty to select optimal features. A frequency-based selection mechanism further stabilizes the chosen features across generations. The proposed approach is rigorously evaluated using the NSL-KDD and BoT-IoT datasets, demonstrating significant feature reduction (70% for BoT-IoT) while maintaining robust detection accuracy. Experimental results, validated across multiple machine learning classifiers (including Random Forest and XGBoost), show high accuracies (e.g., 99.84% on BoT-IoT) and F1-scores (e.g., 0.99 on BoT-IoT), coupled with substantial reductions in both training and prediction times. This approach offers a highly efficient and effective solution for enhancing anomaly detection in resource-constrained IoT environments.