Implementation and Web Deployment of an Anomaly Detection System for IoT Environments Using the CRISP-ML(Q) Methodology

Abstract

The expansion of the Internet of Things (IoT) has intensified cyber risk in Edge deployments with limited computational resources, where conventional intrusion detection systems are unfeasible. Aiming to reduce this gap, a lightweight anomaly detection system for IoT networks has been designed and implemented, structured through the CRISP-ML(Q) (Cross-Industry Standard Process for Machine Learning with Quality Assurance) lifecycle. Unsupervised models (Isolation Forest, OCSVM, K-Means, and Autoencoder) and supervised models (Decision Tree, Extra Trees, and Random Forest) were trained and compared on the BoT-IoT dataset, validating their operational behavior through real-time traffic captures during “TCP RST Flood”, “TCP SYN Flood”, “UDP Flood”, and “ICMP Flood” attacks on a Raspberry Pi 4B platform. Isolation Forest provided the most consistent balance between detection capability and computational cost, while the Autoencoder achieved detection rates of up to 98.8%. Among the supervised models, Random Forest achieved the highest ROC–AUC, reaching 98.5%, whereas Extra Trees showed the lowest inference time under attack conditions (0.50 s). The system was deployed on a Raspberry Pi 4B with a Streamlit interface integrating traffic capture, preprocessing, inference, visualization, resource monitoring, and automated alerts. The results demonstrate the feasibility of combining complementary detection strategies in an operational Edge-based IDS, while highlighting the trade-off between detection performance and computational cost.