Aug 2026· Italian National Conference on Sensors· Vol 26· 0 citations· 73 references
Medicine
TL;DR
A hybrid IDS framework that integrates supervised Random Forest classification, unsupervised Isolation Forest anomaly monitoring, and Kolmogorov–Smirnov (KS)-based concept drift monitoring is presented, providing initial evidence of generalization to one held-out attack family but should not be interpreted as proof of broad zero-day detection capability.
Abstract
The rapid deployment of Internet of Things (IoT) devices across smart cities, healthcare systems, industrial automation, transportation networks, smart grids, and cyber-physical infrastructures has expanded the modern cyberattack surface. IoT devices are often constrained by limited processing capacity, memory, battery power, and communication bandwidth, making conventional security mechanisms difficult to deploy consistently at scale. Intrusion detection systems (IDSs) provide an important defensive layer; however, many machine-learning-based IDSs are developed under static assumptions and may experience performance degradation as traffic distributions evolve due to firmware changes, device onboarding, protocol updates, user behavior variation, or adaptive attacks. This paper presents a hybrid IDS framework that integrates supervised Random Forest classification, unsupervised Isolation Forest anomaly monitoring, and Kolmogorov–Smirnov (KS)-based concept drift monitoring. In the experimental pipeline, Isolation Forest is trained exclusively on benign traffic to ensure that the anomaly detector models normal behavior rather than an attack-dominated training distribution. The evaluation uses a large-scale chronologically sampled subset of the CICIoT2023 dataset containing 3,890,621 records while preserving the natural class distribution of 2.35% benign traffic and 97.65% attack traffic. The chronological 80/20 train/test split is established first at the file level, followed by systematic sampling within each split to reduce the risk of leakage across the evaluation boundary. On the 746,094-record test set, the proposed hybrid IDS achieved 99.73% accuracy, 99.89% precision, 99.83% recall, 99.86% F1-score, and a false positive rate of 4.77%. The corresponding confusion matrix contains TN = 16,683, FP = 836, FN = 1205, and TP = 727,370, yielding 95.23% specificity and 97.53% balanced accuracy. Standalone Random Forest marginally outperformed the hybrid model in raw accuracy and false positive rate; therefore, the contribution of the proposed framework is centered on deployment-oriented anomaly monitoring, drift awareness, and generalization rather than absolute superiority in static classification metrics. A leave-one-attack-family-out experiment withholding MITM-ArpSpoofing from training showed that the hybrid model detected 85.26% of the unseen attack-family samples, compared with 85.18% for Random Forest alone and 7.05% for Isolation Forest alone. These findings provide initial evidence of generalization to one held-out attack family but should not be interpreted as proof of broad zero-day detection capability. The framework is therefore positioned as a competitive IDS that combines supervised detection with anomaly monitoring and concept drift awareness for deployment-oriented IoT security.
This study investigates the effectiveness of supervised machine learning techniques for detecting cyberattacks in IoT-based smart city networks using the TON_IoT dataset, finding that advanced ensemble learning combined with robust feature engineering provides a reliable and scalable solution for securing smart city IoT networks.
E. Okonta, Oluwaseun Bamgbose· ABC2: Journal of Architectur...· 0 citations
This review presents a comprehensive analysis of machine learning-based intrusion detection systems, covering a wide range of techniques including supervised learning, unsupervised learning, ensemble learning, and deep learning models, and discusses critical challenges affecting the deployment of ML-based IDS.
Ranobir Hasan, H. Jamal, Kamal Kamal et al.· The Eastasouth Journal of In...· 0 citations
Traditional Internet of Things (IoT) security solutions often rely on heavy cloud-based or gateway-class infrastructure, which is frequently unsuitable for resource-limited hardware due to latency, power, and memory constraints. This paper proposed a resource-aware behavioral Intrusion Detection System (IDS) designed for highly constrained IoT devices. To address these challenges, the proposed system implements real-time application-layer monitoring on an ESP32 Microcontroller Unit (MCU) and utilizes an offline-trained logistic regression model for autonomous, on-device inference. The detection mechanism extracts behavioral features, such as request rates, failed authentication attempts, and invalid resource access within sliding time windows to estimate attack probabilities. Experimental evaluations under controlled scenarios involving flood, brute force, and scan attacks demonstrate that the system achieves high accuracy, precision, and recall. These findings indicate that effective cyber intrusion detection and local mitigation can be successfully executed directly on a single MCU while preserving stable runtime performance and minimal memory usage. Finally, this paper highlights the need for further optimizations to improve robustness and scalability.
Sofyan Bisher, Anas Fawaza, Tarek Mawed et al.· International Conference on...· 0 citations
This study presents a Quantum Machine Learning (QML)-based Intrusion Detection framework that uses Quantum Support Vector Machines (QSVM) to improve detection accuracy, adaptability, and computational efficiency in conceptual IoT Cloud-Enabled Smart City environments.
Sukanya. Pondavakam, S. Singh, Himanshu Gupta· Discover Internet of Things· 0 citations
The Internet of Things (IoT) is rapidly being integrated into critical infrastructure sectors, such as energy, transportation, healthcare, and industry. This surge of interconnected devices dramatically expands the attack surface and increases the risk of cascading system failures and data breaches. To address these emerging threats, this work proposes an intrusion detection system (IDS) for IoT networks that incorporates machine learning techniques, considering side-channel (power) and network traffic features. We collected power consumption traces and network metrics from IoT devices during normal operation and under diverse cyberattacks (e.g., cryptomining, flooding, port scanning). Time-series machine learning classifiers are trained on this hybrid dataset to differentiate benign versus malicious behavior. The experimental results show that the combined-feature model significantly outperforms models using only one data type, achieving high detection accuracy (F1≈0.89) and correctly identifying the attack type. The resulting IDS generalizes to previously unseen attacks, demonstrating robust, adaptive defense capabilities. The novelty of our approach lies in integrating physical side-channel signals into an automated ML framework, enhancing robustness and resilience. This smart, data-driven solution operates in near real time and helps build autonomous, constantly evolving defenses against cyber threats. Overall, our study delivers a state-of-the-art ML-based tool that learns and evolves to counter modern IoT cyberattacks.
Felipe Lemus-Prieto, Alejandro Domínguez Campos, José-Luis González-Sánchez et al.· Electronics· 0 citations
With the rapid adoption of smart home solutions and related technologies, edge computing has emerged as a key enabler by offering low-latency data processing, increased efficiency and improved scalability. However, this integration in IoT systems introduces complex security challenges in smart home edge environments, increasingly susceptible to cyber threats such as denial-of-service (DoS), malware injection, passive surveillance, and unauthorized access. This paper investigates intelligent intrusion detection and attack classification strategies specifically designed for smart home edge systems. Using the comprehensive ML-EdgeIIoT dataset, this study designs and evaluates a machine learning-based intrusion detection framework for multiclass classification of eight categories of IoT network attacks, namely Backdoor, MITM, DDoS, Ransomware, Password Attack, SQL Injection, Prob-attacks, and Normal traffic while minimizing false positives and false negatives. The framework incorporates data cleaning, correlation- and feature importance-based feature selection, hyperparameter optimization using gridsearchCV, model training, and ensemble learning. A set of machine learning models comprising Artificial Neural Network, Balanced Random Forest, K-Nearest Neighbours, Random Forest, and Logistic Regression was implemented and comparatively evaluated. Two ensemble techniques were subsequently developed using the three best-performing classifiers: (1) a stacking ensemble with Logistic Regression as the meta-learner and (2) a Top-3 majority voting ensemble. Model performance was evaluated using accuracy, precision, recall, F1-score, confusion matrix, and ROC-AUC. Robustness and generalization of the individual machine learning models were assessed through stratified 10-fold cross-validation for the three best-performing classifiers. The Top-3 voting ensemble subsequently achieved the highest performance on the independent test set, with accuracy of 99.24%, average precision of 98.75%, recall of 99.00%, and an F1-score of 99.00% for all attack classes, while reducing misclassification compared with individual classifiers. The findings of this study significantly enhance the understanding of smart home edge computing security, which will pave the way for more robust and intelligent threat detection frameworks.
Abhay Kumar Ray, Rupak Sharma, Sunil Kumar Pandey· International Journal of Wir...· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
