The approach models inter-device state correlations using a heterogeneous graph structure and partitions behavior patterns through iterative community detection and automated semantic annotation, and represents normal behavior by embedding and clustering of state sequences.
Internet of Things (IoT) devices are vulnerable to zero-day attacks because most of them have weak or no inherent security due to the resource constraints of the devices. This weakness underscores the growing need for anomaly-based intrusion detection systems tailored to IoT networks. Nevertheless, general anomaly detection traditionally has a high number of false positives that drain analysts' time. Also, a semantic difference exists between the system's results and the operators' interpretations. We introduce a machine learning-based framework to tackle these issues in traditional systems in this paper by combining large language models (LLMs). Our model is effective in identifying possible threats as well as filling the semantic gap. The framework uses isolation forests to detect anomalies and random forests to measure device integrity. To further improve the assessment of anomalies and increase interpretability, system insights are further refined using GPT-4o mini, an LLM. The model gives statistical summaries of the IoT traffic, a risk score, and an explanation in easy language, which is easy to understand and therefore makes the process of decision-making easier. Such a novel system reduces the reliance on dedicated network operators and allows non-technical users to better understand and act on the results of the system.
M. Saeed, Rashid A. Saeed, Salah Hagahmoodi et al.· Baghdad Science Journal· 0 citations
Traditional Internet of Things (IoT) security solutions often rely on heavy cloud-based or gateway-class infrastructure, which is frequently unsuitable for resource-limited hardware due to latency, power, and memory constraints. This paper proposed a resource-aware behavioral Intrusion Detection System (IDS) designed for highly constrained IoT devices. To address these challenges, the proposed system implements real-time application-layer monitoring on an ESP32 Microcontroller Unit (MCU) and utilizes an offline-trained logistic regression model for autonomous, on-device inference. The detection mechanism extracts behavioral features, such as request rates, failed authentication attempts, and invalid resource access within sliding time windows to estimate attack probabilities. Experimental evaluations under controlled scenarios involving flood, brute force, and scan attacks demonstrate that the system achieves high accuracy, precision, and recall. These findings indicate that effective cyber intrusion detection and local mitigation can be successfully executed directly on a single MCU while preserving stable runtime performance and minimal memory usage. Finally, this paper highlights the need for further optimizations to improve robustness and scalability.
Sofyan Bisher, Anas Fawaza, Tarek Mawed et al.· International Conference on...· 0 citations
The rapid growth of Internet of Things (IoT) devices has significantly improved connectivity across smart environments. However, the resource-constrained nature of IoT devices and their limited built-in security mechanisms make them highly vulnerable to evolving cyberattacks. Traditional intrusion detection systems relying on signature-based or static rule sets are often ineffective against previously unseen attacks. This study proposes a hybrid machine learning-based intrusion detection and prevention framework for securing IoT networks. The framework integrates Isolation Forest, Autoencoder, Extreme Gradient Boosting, and Bidirectional Long Short-Term Memory models within a stacked ensemble architecture to improve attack detection while reducing false-positive predictions. The ensemble outputs are combined using a Logistic Regression meta-classifier to generate the final threat score. Experimental evaluation using the UNSW-NB15 dataset demonstrates that Extreme Gradient Boosting achieved the highest individual Receiver Operating Characteristic-Area Under the Curve score of 0.91, while the proposed framework further enhances detection robustness through ensemble learning and automated prevention. A Flask-based monitoring dashboard provides real-time visualization of detection results, blocked IP addresses, alerts, and system performance.
Ruthwik Palem, Likhith Reddy Peketi, Vanathi M et al.· Cureus Journal of Computer S...· 0 citations
As MNI becomes increasingly vulnerable to new kinds of attacks from the cyber world, accurate and timely detection of intrusions becomes a primary key to the power of cybersecurity. More complex attack patterns, complex traffic interactions within large scales are not very collaborable with the typical signature-based detection methods. A Transformer Based Network Anomaly Detection System for intelligent cyber security monitoring based on network flow analysis (NFAs) is proposed in the paper. This framework is derived from the CICIDS2017 data-set and proposes 78 of the statistical flow characteristics, where each flow characteristic impacts the behaviour of a packet, protocol, volume of traffic and temporal communication pattern. The model uses a Transformer Encoder network architecture along with multiple heads of self-attention, which provides greater understanding to deal with complex relationships between features from network traffic. LabelEncoder and StandardScaler have been applied to the columns with values that need to be encoded for categorical variables and scaled to fit the values for models training. A trained model is then applied to progress multiple different categories of cyberattacks including DDoS attacks, PortScan, Brute Force, Botnet, Web Based, etc. and different kinds of traffic, all traffic is considered benign traffic. For providing real-time predictions, confidence interval, prediction of class severity and alerts using trained model an API developed on flask to connect the trained model to a dashboard was built. The experimental results show that the Transformer-based learning could be very effective in achieving successful capturing of the network behavior and conducting realistic detection. The overall proposed system offers an intelligent, scalable and deployment-centric approach to improve the monitoring and proactive detection of threats in contemporary networks in the field of cybersecurity.
S. Nagendrudu, Shaik Mohammed Anays, F. Mahammad et al.· 2026 International Conferenc...· 0 citations
The rapid deployment of Internet of Things (IoT) devices across smart cities, healthcare systems, industrial automation, transportation networks, smart grids, and cyber-physical infrastructures has expanded the modern cyberattack surface. IoT devices are often constrained by limited processing capacity, memory, battery power, and communication bandwidth, making conventional security mechanisms difficult to deploy consistently at scale. Intrusion detection systems (IDSs) provide an important defensive layer; however, many machine-learning-based IDSs are developed under static assumptions and may experience performance degradation as traffic distributions evolve due to firmware changes, device onboarding, protocol updates, user behavior variation, or adaptive attacks. This paper presents a hybrid IDS framework that integrates supervised Random Forest classification, unsupervised Isolation Forest anomaly monitoring, and Kolmogorov–Smirnov (KS)-based concept drift monitoring. In the experimental pipeline, Isolation Forest is trained exclusively on benign traffic to ensure that the anomaly detector models normal behavior rather than an attack-dominated training distribution. The evaluation uses a large-scale chronologically sampled subset of the CICIoT2023 dataset containing 3,890,621 records while preserving the natural class distribution of 2.35% benign traffic and 97.65% attack traffic. The chronological 80/20 train/test split is established first at the file level, followed by systematic sampling within each split to reduce the risk of leakage across the evaluation boundary. On the 746,094-record test set, the proposed hybrid IDS achieved 99.73% accuracy, 99.89% precision, 99.83% recall, 99.86% F1-score, and a false positive rate of 4.77%. The corresponding confusion matrix contains TN = 16,683, FP = 836, FN = 1205, and TP = 727,370, yielding 95.23% specificity and 97.53% balanced accuracy. Standalone Random Forest marginally outperformed the hybrid model in raw accuracy and false positive rate; therefore, the contribution of the proposed framework is centered on deployment-oriented anomaly monitoring, drift awareness, and generalization rather than absolute superiority in static classification metrics. A leave-one-attack-family-out experiment withholding MITM-ArpSpoofing from training showed that the hybrid model detected 85.26% of the unseen attack-family samples, compared with 85.18% for Random Forest alone and 7.05% for Isolation Forest alone. These findings provide initial evidence of generalization to one held-out attack family but should not be interpreted as proof of broad zero-day detection capability. The framework is therefore positioned as a competitive IDS that combines supervised detection with anomaly monitoring and concept drift awareness for deployment-oriented IoT security.
Muath A. Obaidat, Meryem Abouali, Aneeza Shakeel· Italian National Conference...· 0 citations
The rapid growth of Internet of Things (IoT) devices has made modern attacks more vulnerable to cyberattacks. Traditional signature-based Intrusion Detection Systems (IDS) are no longer enough to keep up with new and evolving threats. Although machine learning and deep learning have improved detection accuracy, many AI-driven IDS models still face major issues. They often struggle to detect zero-day attacks, produce high false-positive rates and perform poorly with imbalanced datasets. Some models are also too computationally heavy to run efficiently in real time. To address these weaknesses, this research proposes a two-tier hybrid IDS that uses a Random Forest model for quick initial detection and a Neural Network for deeper analysis of suspicious traffic. A confidence threshold of 0.8 is used to decide whether traffic should be accepted or sent for further inspection. Using the NSL-KDD dataset, the system includes preprocessing steps such as binary mapping and structured feature extraction to support both detection stages. Our comparative analysis shows that this hybrid approach can achieve better accuracy, fewer false alarms, and stronger detection of unknown attacks compared to existing Machine Learning / Deep Learning IDS methods. It is more practical for large, diverse IoT environments because it reduces computational load while maintaining strong detection capability. Overall, the proposed architecture provides a balanced and efficient solution that overcomes key limitations of existing IDS models and offers a pathway towards a more robust real-time IoT intrusion detection.
R. Paper, Wong Zoey, Yu Watanabe et al.· International Journal of Eme...· 0 citations