Aug 2026· Italian National Conference on Sensors· Vol 26, pp. 5110· 0 citations· 49 references
Medicine
TL;DR
A hybrid detection framework is proposed that integrates a Random Forest classifier with an unsupervised anomaly detection model based on a deep autoencoder combined through a Logistic Regression metaclassifier that addresses the gap in single-model detectors that either rely on fixed decision boundaries that struggle with gradually evolving stealthy FDIA patterns or on anomaly detection that lacks strong discriminative power in separating subtle adversarial deviations from normal operational variability.
Abstract
The rapid adoption of Internet of Things (IoT)-enabled applications has significantly expanded the cyberattack surface across a wide range of critical systems such as industrial IoT (IIoT), smart grids, transportation, healthcare, industrial control systems, and smart cities. False data injection attack (FDIA) has emerged as a serious security threat to these applications due to its stealthiness and adversarial nature, silently corrupting the data integrity of critical operational processes without triggering conventional detection mechanisms. Existing FDIA solutions rely on single-model architectures that are built based on classical or limited predefined attack scenarios. Such solutions often fail to achieve robust detection under adversarial and evolving attack conditions; accordingly, they lack generalisability and are insufficient to capture the broader scope of FDIAs. In this study, a hybrid detection framework is proposed that integrates a Random Forest classifier with an unsupervised anomaly detection model based on a deep autoencoder combined through a Logistic Regression metaclassifier. The proposed framework addresses the gap in single-model detectors that either rely on fixed decision boundaries that struggle with gradually evolving stealthy FDIA patterns or on anomaly detection that lacks strong discriminative power in separating subtle adversarial deviations from normal operational variability. Different types of stealthy and adversarial FDIA have been modelled and injected into the dataset samples for use in training the proposed model. The results show that the overall detection performance of the proposed architecture improved by 2.39 percentage points in terms of F1-score while maintaining a low false-positive rate of 0.49%. These findings reflect the effectiveness of feature representation learning via autoencoders and hybrid classification strategies against stealthy and adversarial FDIA patterns. Future work should include temporal modelling for further advancing robust detection against evolving adversarial threats.
Traditional rule-based intrusion detection systems generally fail in identifying unknown or evolving threats; thus, automated and adaptive kinds of methods are crucial. Deep learning models provide promising solutions, but many recent studies depend on hybrid architecture, which increase the computational cost and reduce deploying ability on real-time or resource-limited systems. In this paper, we present and test a standalone LSTM model for multiclass cyberattack detection based on a CIC_IoT_Dataset2023, a recent labeled dataset that mirrors the actual network environment containing 33 attack categories. The dataset was extremely imbalanced as benign traffic accounted for most of the classes. To detect such attacks, we used the Synthetic Minority Oversampling Technique (SMOTE) to increase the frequency of less common types of address. The pre-processed dataset was then employed to train four models (RNN, CNN, DNN and the proposed LSTM) for performance analysis with sequential data. The proposed LSTM model achieved an accuracy between 2% and 7%. LSTM had good detection for frequent attacks and slow-changing patterns, which shows its capacity in learning long-lasting dependencies. The results demonstrate that a simple, lightweight standalone LSTM model can be used for effective and realistic intrusion detection without the need for complex hybrid architecture.
Jawad Hussain Awan, Misbah Safdar, Muhammad Ayaz Shirazi et al.· Italian National Conference...· 0 citations
Cloud computing has emerged as an important core to the contemporary digital services, facilitating scalable, on demand provisioning of resources across a variety of application fields. Nevertheless, this multi-tenant and dynamic environment of clouds and the amplified attack surface make the detection of intrusions through reliable methods a consistent issue that cloud security systems struggle with. The proposed work is a Generative Adversarial Network (GAN)-based hardening framework of cloud intrusion detection systems, targeting better resilience to changing and low-rate cyberattacks. The methodology combines a conditional generator which is used to generate realistic cloud-specific attack traffic, a discriminator used to refine the adversarial traffic, as well as a co-trained intrusion classifier trained on both clean and synthetic data in a closed-loop way. The feature-aware regularization is introduced to maintain the statistical consistency of network traffic, and optimize the attack diversity. The proposed approach is proved to yield better results in comparison with signature-based, machine learning, deep learning, and adversarial ML-based IDS models by experimental assessment. Significant gains in the accuracy of identifying, the ability to recall, stability, and minimizing errors are also noticed with quantifiable increases observed in all evaluation measures. These findings represent the usefulness of adversarial data-driven learning to develop robust, adaptive, and future-ready cloud intrusion detection systems.
T. Divya, Sheik Saidhbi, S. Umarani et al.· 2026 International Conferenc...· 0 citations
With the widespread adoption of the Internet of Medical Things (IoMT), hospitals have become prime targets for cyberattacks. To overcome the limitations of traditional defenses and computationally heavy deep learning models, a hybrid Artificial Intelligence architecture is presented. By coupling a deep Autoencoder for feature extraction with a Random Forest classifier, the input space is reduced from 44 down to 16 latent dimensions. While a standalone Random Forest achieves 98.95%accuracy, it remains too resource-intensive for constrained edge devices. The proposed hybrid approach strategically accepts a marginal sacrifice in accuracy—achieving 94.60% overall—in exchange for a drastic reduction in computational complexity. Rigorously validated on the CICIoMT2024 dataset and balanced via SMOTE-ENN, this model achieves an ultra-low inference latency of 1.05 ms on edge-grade hardware, making it highly viable for Edge Computing deployment. Furthermore, integrating the SHAP algorithm ensures decision-making transparency, addressing the “black box" challenge in medical AI. These results demonstrate the efficacy of strategic dimensionality reduction in securing critical healthcare infrastructures.
Sophia ALAMI-KAMOURI, Ridouan Lachgar, M. Afif· International Journal of Adv...· 0 citations
The growth of Internet of Things devices has expanded the number of attackable targets of advanced cyber threats by orders of magnitude, and the limited computational capabilities of IoT devices have made more traditional intrusion detection systems infeasible to execute at the edge. A Knowledge-Distilled Multi-Model Intrusion Detection and Prevention System is presented, which combines a Residual Graph Convolutional Network, Long Short-Term Memory classifier, and a Conditional Tabular Generative Adversarial Network enhanced with the student-only autoencoders through multi-loss knowledge distillation to create a high-performing Teacher ensemble and compresses its intelligence into an edge-deployed system. The system is evaluated using the IoT-23 benchmark of 325 million network flow records and attains 98.2% Teacher-Student fidelity, 0.94 Knowledge Retention Score, and 4.4x throughput increase with 82.7% reduction in the parameter and provides per-packet SHapely Additive exPlanation forensic explainability.
S. K, Menaka T K, N. R· 2026 4th International Confe...· 0 citations
Modern Industrial Internet of Things (IIoT) integrates machine learning models for monitoring and control. However, they remain vulnerable to adversarial machine learning (AML) attacks, where an adversary adds small changes to the input data. These small changes degrade model quality, reduce accuracy, and can ultimately compromise the safety and security of the entire system. AML research in IIoT often focuses on individual attack types, defense methods, and datasets. Existing reviews lack a unified quantitative and system-level perspective. Therefore, a systematic literature review (SLR) is needed to provide a holistic analysis of existing attacks, defenses, and databases. This SLR analyzes 50 research articles to provide a holistic view of AML threats in IIoT systems and identifies seven distinct attack types: gradient-based perturbations, GAN-generated samples, poisoning attacks, reinforcement learning-based (RL) strategies, saliency-based feature manipulation, false data injection, and hybrid approaches. To illustrate the range of observed impacts, selected studies report the following degradation examples: saliency-based attacks cause accuracy reductions of 6–11 percentage points; iterative gradient attacks reduce accuracy from 95–99% to 30–40% in SIEM systems; and RL-based attacks reduce detection rates from 100% to 0% in rule-based IDS settings. In addition to the analysis of attack types, this SLR also evaluates current defense methods to protect IIoT systems. It has been observed that existing defense mechanisms lack generalization and require high computational resources. Moreover, the testing is performed under simplified threat models. The analysis of datasets further shows a clear gap between realistic industrial benchmarks (such as SWaT, WADI, and NSL-KDD) and synthetic datasets used for controlled experiments. By connecting attack behavior, defense performance, dataset characteristics, and system-level effects, this SLR identifies the key research gaps that must be addressed in future work.
Abeer Alsaidlani, Muhammad Rashid, M. Aljabri· Italian National Conference...· 0 citations
The rapid expansion of smart networks, encompassing the Internet of Things (IoT), software-defined networking (SDN), and 5G-enabled edge infrastructure, has dramatically increased the attack surface available to malicious actors, while simultaneously producing high-velocity, heterogeneous traffic that traditional signature-based intrusion detection systems struggle to analyze in real time. This paper proposes a Hybrid Deep Learning and Machine Learning (DL-ML) framework for intelligent cyber threat detection that fuses a Convolutional Neural Network combined with a Bidirectional Long Short-Term Memory (CNN-BiLSTM) branch, which captures spatial and temporal traffic patterns, with a gradient-boosted ensemble branch (XGBoost/Random Forest), which captures statistical flow-level signatures. The outputs of both branches are combined through a weighted feature-fusion and ensemble layer that produces a unified threat classification and severity score. The framework was evaluated on a large-scale smart-network intrusion dataset comprising over 1.8 million labeled flow records spanning six traffic classes: normal, DDoS, botnet, port scanning, malware communication, and spoofing. Experimental results show that the proposed hybrid model achieves 98.8% accuracy, 96.4% precision, 95.6% recall, and a 96.0% F1-score, exceeding the strongest individual baseline (LSTM) by 3.7 percentage points in F1-score and achieving an AUC of 0.992.
Rajesh Yadav, Dinesh Kumar, Sanjeev Kumar et al.· International journal of com...· 1 citation