The rapid growth of IoT and IIoT expands the cyber-attack surface of interconnected and safety-critical systems, and, as such, IDSs have become a fundamental security mechanism. Although very impressive results have been reported for machine learning and deep learning-based IDS in benchmark datasets, these gains often do not generalize to real-world deployments owing to dataset design limitations, realism deficits, and evaluation biases, rather than inherent flaws in detection algorithms, which can lead to significant vulnerabilities in actual operational environments. This study presents a dataset-centric review of widely used intrusion detection datasets from the IIoT, IoT, and traditional network domains. A unified taxonomy differentiates datasets based on the domain context, traffic representation, protocol semantics, and attack modeling assumptions. Based on a common analytical framework, each dataset was reviewed regarding its realism, coverage of the threats, class imbalance, temporal continuity, and modern ML/DL-based evaluation of the IDS. The cross-dataset analysis conducted in this study shows that, in addition to the fact that model architecture and feature engineering play a major role, several studies indicate that the simplicity of the datasets, the class imbalance, and the repetitive attack patterns as well as the evaluation methods can affect accuracy of the IDS. This work further underlines the remaining gaps, such as zero-day and adaptive attacks, limited encrypted traffic, weak temporal evolution, poor support for federated learning, and sparse annotations for explainable IDSs. Finally, this study presents future directions for dataset design aligned with the requirements of next-generation IDSs by highlighting digital twin-based IIoT environments, edge-cloud collaborative data generation, sequential traffic modeling, and explainability-oriented annotations that can ensure robust, trustworthy, and deployment-ready IDS solutions.
Dwarsala Sreedhar Reddy, Kakelli Anil Kumar· Frontiers in Big Data· 1 citation
Introduction ARP spoofing poses a major security threat to Internet of Medical Things (IoMT) networks by enabling man-in-the-middle attacks that compromise the integrity of life-critical communications. Existing intrusion detection methods fail to simultaneously address temporal attack dynamics, unequal medical safety requirements, and explicit control of false negative rates. Methods This study proposes the Self-Healing IoT-Optimized Random Forest (SH-IORF) framework, which integrates temporal behavioral feature engineering, validation-guided cost-sensitive learning, and medical safety-constrained threshold optimization. To ensure methodological rigor and prevent information leakage, a stratified three-way partitioning strategy consisting of training, validation, and completely held-out testing datasets was employed. Class penalty weights and operating thresholds were determined exclusively from the validation dataset. Results Experimental evaluation on the CICIoMT2024 benchmark demonstrated that the proposed SH-IORF framework achieved 99.90% accuracy, 99.83% recall, 99.95% precision, a 0.9989 F1-score, and an AUC-ROC of 0.9996. The framework limited the false negative rate to 0.17%, satisfying the predefined medical safety constraint (FNR ≤ 0.5%), corresponding to 40 missed detections among 23,390 attack samples and 12 false alarms across 28,768 benign traffic instances. Discussion The results demonstrate that the proposed framework provides stable and safety-oriented intrusion detection capability under heterogeneous IoMT deployment conditions while maintaining strict testing independence and robust performance under rigorous evaluation settings.
Siddhartha Singhal, Kakelli Anil Kumar· Frontiers in Big Data· 0 citations
Accurately and in real-time identifying advanced cyber-attacks continues to be a serious challenge for modern Network Intrusion Detection Systems (NIDS), especially in situations of highly imbalanced network traffic load and large-scale network attacks. Signature-based and single-model learning methods are typically ineffecive in capturing the complexity of traffic interactions and are not generalizable to new attack patterns. To overcome these limitations, this study introduces an Enhanced Multi-Model Ensemble Network Intrusion Detection System (EME-NIDS), a deep meta-learning system that combines five different heterogeneous learning paradigms, including Convolutional Neural Networks (CNN), Dense Neural Networks, Transformers, XGBoost, and Random Forests. The probabilistic output of the base learners is then condensed into a 220-dimensional meta-feature space and further processed by a five-layer deep meta-learner with approximately 289 k trainable parameters. A large-scale network flow dataset with 703,168 instances was used to assess the learning stability and attack detection of the minority class in the presence of various attacks, with 43 attacks and one attack class (benign) in the dataset. The experimental evaluation provided a detection accuracy of 95.65% and a macro-ROC-AUC score of 99.76%, outperforming all standalone models. Moreover, the proposed framework, which provides an average inference latency of 8.4 ms is suitable for real-time intrusion detection. The robustness, scalability and practical deployment capability of the proposed EME-NIDS framework were confirmed by statistical significance analysis (McNemar’s test, p < 0.001) and ablation studies.