Jul 2026· International Conference on Future Internet of Things and Cloud· pp. 67-74· 0 citations· 14 references
Abstract
With the proliferation of Internet of Things (IoT), critical infrastructures such as smart cities, industrial automation, precision healthcare, and intelligent transportation have seen a significant shift in their security landscape. As these critical infrastructures are increasingly depending on OneM2M standards for interoperability and scalable service management, they are simultaneously presenting a larger and more structured attack surface. One of the most serious and realistic threats in such scenarios is black-box adversarial attacks, in which an attacker can compromise Machine Learning (ML) and Deep Learning (DL)-based intrusion detection systems (IDS) without having prior knowledge of the ML/DL model's architecture, parameters, and training data. To mitigate such a critical challenge, we propose a multi-stage framework specific to OneM2M-based IoT networks that can effectively counter transfer-based and query-based black-box adversarial attacks. Our framework's effectiveness will be tested on a dataset of 1.25 million labeled network flows collected from Azure IoT Hub-based IoT devices over a 10-day period. We will test the robustness of our framework against three adversarial attacks: FGSM with $\varepsilon=0.05$, PGD with 40 iterations and step size 0.01, and C&W with L2 optimization and 1,000 iterations. The proposed pipeline consists of four different mechanisms: (1) adversarial training with the use of mixed clean and adversarial samples, (2) traffic sanitization to minimize malicious and/or suspicious traffic flows before processing by the Common Service Entity (CSE), (3) the use of a black-box adversarial detector based on feature transformation, and (4) the use of an ensemble-based IDS to make use of the results of the Random Forest, XGBoost, MLP, and 1D-CNN-based IDSs via majority voting. The experimental results show that the proposed Ensemble + multi-defense configuration results in 98.1% accuracy, 98.3% TPR, and 1.7% FNR. Most notably, the proposed Ensemble + multi-defense configuration results in an ASR of 11.2%, which is down by 86% compared to the 82.3% ASR achieved by the baseline IDS. Notably, the proposed framework results in limited overheads in terms of RTT (increased by 8 ms), CPU (increased by 17%), and RAM (increased by 1.6 GB).
The rapid proliferation of Internet of Things (IoT) devices across critical domains including healthcare, smart cities, industrial control systems, and intelligent transportation has fundamentally transformed the cybersecurity threat landscape. The inherent characteristics of IoT environments, namely resource-constrained devices, heterogeneous architectures, and large-scale deployment, render traditional Intrusion Detection Systems (IDS) inadequate for the sophisticated and evolving attack vectors targeting these networks. Deep learning (DL) has emerged as a compelling paradigm for next-generation IoT IDS, offering automated feature extraction, temporal pattern recognition, and adaptive threat detection capabilities that address the limitations of conventional approaches.
This paper provides a thorough and systematic review of the existing DL methods for IoT intrusion detection. The paper explore the IoT architectural paradigms, outline a four layered taxonomy for types of IoT attacks across its three primary layers Perception, Network and Application as well as Adversarial Machine Learning attacks, and systematically review seven classes of DL architectures Convolutional Neural Networks (CNN), Long Short-Term Memory (LSTM) networks, Gated Recurrent Units (GRU), Autoencoders, Generative Adversarial Networks (GAN), models based on Transformer architecture and Federated Learning frameworks. In a comparative review of forty peer-reviewed studies, we demonstrate that hybrid DL models provide excellent detection performance (99-100% classification accuracy on benchmark datasets) as well as practical viability for deployment with privacy-preserving Federated Learning for large-scale data. The study additionally highlights five enduring challenges class imbalance, adversarial vulnerability, zero-day detection limitations, computational constraints and the absence of standardized benchmarking protocols that together account for the gap between performance benchmarks and real-world deployment efficacy. It outlines future research avenues targeting on five key axes with a particular focus in the integration of Explainable AI (XAI), lightweight edge-deployable architectures, and adversarial robustness mechanisms. This survey identifies a structured reference to advance the state of IoT intrusion detection from research to operationally viable and deployable systems.
Mohammed Gharkan, Mustafa I. Hussien Al-Janabi, Obaid Salim· Al-Noor Journal of Engineeri...· 0 citations
Deep-learning-based Network Intrusion Detection Systems (NIDS) play a vital role in protecting Internet of Things (IoT) environments; however, they remain vulnerable to adversarial examples, in which small input perturbations can cause misclassification. Previous research has considered that there exists a trade-off between model accuracy and robustness; however, this work seeks to prove that TRADES, which uses KL divergence regularization, does not exhibit this trade-off on IoT tabular data. It has been shown that TRADES enables aligning the decision boundaries of the DNN with causal traffic feature spaces rather than vulnerable anomalies. For the Bot-IoT dataset, TRADES has achieved almost full robustness (~100%) against three different attacks including PGD, FGSM, and C&W in a bounded threat model ( $\epsilon $ =0.1). In addition, the TRADES framework has improved the robustness of models in case of data brittleness through using SMOTE method on NSL-KDD imbalanced dataset, leading to an increase of 55 points in robustness. Furthermore, cross-dataset evaluation on UNSW-NB15 and CICIDS2017 datasets has demonstrated good generalization properties (86.10% and 93.20% PGD robustness). Apart from theoretical findings, we provide practical validation for edge deployment within sub-millisecond latency (0.03 ms/packet) based on a quantized 150 KB TensorFlow Lite model, demonstrating promising potential for deployment in IoT devices using latency measurements.
Aqeel S. Azez, Maytham S Jabor, Alberto Bonastre et al.· IEEE Access· 0 citations
This study proposes a hybrid machine learning-based intrusion detection and prevention framework for securing IoT networks that integrates Isolation Forest, Autoencoder, Extreme Gradient Boosting, and Bidirectional Long Short-Term Memory models within a stacked ensemble architecture to improve attack detection while reducing false-positive predictions.
Ruthwik Palem, Likhith Reddy Peketi, Vanathi M et al.· Cureus Journal of Computer S...· 0 citations
A new explainable hybrid IDS architecture for IoT environments named XABiL-IDS (Explainable Attention-based Bi LSTM-Intrusion Detection System) in response to this challenge, which uses a robust hybrid architecture to detect attacks effectively.
Ravi Patni, Gurvinder Singh· International journal of com...· 0 citations
An intelligent DDoS detection and mitigation framework that combines classical Machine Learning (ML) classifiers with Deep Learning (DL) architectures to achieve high-fidelity, low-latency attack identification across heterogeneous network topologies is presented.
S. Singh, Alok Kumar· International Journal of Com...· 0 citations
This rapid growth of IoT has changed the landscape of today’s digital world by allowing devices
to communicate effectively, especially in different fields like healthcare, smart cities, industrial
control, and defense. Despite its advantages, IoT introduces significant security challenges due
to device heterogeneity, constrained computational resources, and weak security architectures,
making it highly vulnerable to cyber threats. Traditional vulnerability management approaches,
including rule-based intrusion detection systems and signature-based scanning, have proven
inadequate in addressing the dynamic and large-scale nature of IoT environments, as they are
largely reactive and incapable of detecting novel attack patterns. This study proposes an AI
driven vulnerability management framework that integrates anomaly detection techniques using
machine learning to enhance proactive threat identification and mitigation in IoT ecosystems.
The framework leverages publicly available datasets such as Bot-IoT, CIC-IoT, and UNSW
NB15 to train and evaluate models capable of distinguishing between normal and malicious
network behaviors. Various machine learning algorithms, including supervised and
unsupervised techniques, were implemented and assessed using performance metrics such as
accuracy, precision, recall, F1-score and false positive rate. The results demonstrate that AI
based models significantly outperform traditional methods in detecting previously unseen
threats, achieving high detection accuracy and reduced false positives. The proposed framework
integrates anomaly detection into a structured vulnerability management lifecycle encompassing
identification, prioritization and remediation of vulnerabilities. Generally, the study provides a
scalable and adaptive solution for improving IoT security, reducing system vulnerabilities, and
enhancing resilience against evolving cyber threats, with potential for future real-world
deployment across critical sectors.
Daniel Nafisatu Mshelbila· International Journal of Com...· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
