Year: 2026
Type: dissertation
Abstract: This thesis investigates machine learning-based anomaly detection techniques for cybersecurity in Industrial Internet of Things (IIoT) environments using the TON-IoT dataset. The study focuses on detecting Distributed Denial of Service (DDoS) attacks using Zeek network traffic logs derived from the TON-IoT dataset. The research implements and compares three models: Isolation Forest, Autoencoder, and Extreme Learning Machine (ELM). The preprocessing pipeline includes feature engineering, one-hot encoding of categorical variables, normalization of numerical features, and transformation of raw network traffic logs into structured machine learning features suitable for anomaly detection. The Autoencoder model is trained exclusively on normal network traffic and identifies anomalies based on reconstruction error. Isolation Forest is used as an unsupervised baseline method, while ELM is evaluated as a supervised classification model using labeled data. The experimental results demonstrate that the Autoencoder achieves strong discriminative capability, particularly when threshold selection is optimized. Isolation Forest successfully identifies statistically distinct anomalies, while ELM achieves very high classification performance under supervised conditions. The findings highlight the importance of feature engineering, threshold selection, and model choice in anomaly detection systems. The study also demonstrates that unsupervised approaches are particularly valuable in IIoT environments where labeled attack data is limited or unavailable. Overall, the results contribute to the development of scalable and adaptive cybersecurity solutions for Industrial IoT systems.
Source: Theseus (Ammattikorkeakoulujen)
Author: Sharma, Arushi
Institution: Arcada University of Applied Sciences
Language: English
Subfield: Computer Networks and Communications
Field: Computer Science
Domain: Physical Sciences
Open Access status: green
OpenAlex ID: W7163458778