Sep 2026· IEEE Internet of Things Journal· Vol 13, pp. 40691-40703· 0 citations· 44 references
Abstract
Out-of-distribution (OOD) anomalies pose serious threats to the reliability and security of Internet of Things (IoT) systems. As graph neural networks (GNNs) have become a dominant framework for modeling the relational structures inherent in IoT networks, detecting OOD nodes on graphs has emerged as an essential requirement for trustworthy IoT deployment. For graph node-level OOD detection, current leading methods predominantly follow the OOD-exposure paradigm, which leverages real or synthesized OOD samples to explicitly separate in-distribution (ID) and OOD scores during training. However, this paradigm suffers from two fundamental limitations: 1) real OOD samples are inherently difficult to collect, as novel anomaly patterns in evolving IoT environments are unpredictable before deployment and 2) synthesized pseudo-OOD samples inevitably deviate from true OOD samples, introducing a distributional mismatch that undermines detection reliability. Moreover, both routes rely on regularization hyperparameters that cannot be validated without OOD data. Together, these limitations render OOD-exposure methods illsuited for real-world IoT deployments. To address these issues, we propose multigranularity OOD detection via self-aligned ID consistency (MOSAIC), a graph node-level OOD detection framework that avoids reliance on OOD samples and instead characterizes the ID distribution itself from multiple complementary granularities. MOSAIC evaluates each node from three perspectives: macrolevel global deviation via cosine distance to a distance-weighted ID centroid, mesolevel class-aware boundary deviation via minimum Euclidean distance to class-specific centroids, and microlevel representational stability via feature-masked embedding consistency. A homoscedastic uncertainty framework further balances the training objectives automatically, eliminating the manually tuned regularization hyperparameters required by OOD-exposure methods. Extensive experiments on five social-IoT proxy benchmarks and a bitcoin transaction graph demonstrate that MOSAIC matches or surpasses OOD-exposure-based methods while requiring no OOD data during training, offering a practical solution for open and evolving graph-based IoT systems. The codes are available at https://github.com/Brucesustech/MOSAIC
The Internet of Things (IoT) plays a vital role in the digital age by interconnecting numerous heterogeneous devices. This complexity and ubiquity expose IoT networks to diverse and sophisticated cyber threats. IoT environments require rigorous collaborative intrusion detection system (IDS) that operates in distributed environments and heterogeneous data traffic. While federated learning offers a promising, privacy-conscious training model, most traditional approaches to IDS fail to detect the structural relationships between connected entities. On the other hand, Graph Neural Networks (GNNs) have attracted significant attention in Network Intrusion Detection Systems (NIDS) for their effectiveness in modeling complex network traffic flows in real-world environments. However, existing GAD methods are generally designed for centralized training, thereby posing privacy leakage risks. Despite progress, current mainstream Federated Graph anomaly detection (FGAD) methods still face challenges. A key limitation is that most existing approaches focus on node-level analysis while disregarding inter-node relationships making them ineffective against sophisticated attacks. To tackle this problem, this paper presents an Edge Federated Graph Anomaly Detection (E-FGAD) framework for IoT environments that combines centralized self-supervised pre-training with distributed supervised learning over edge embeddings. During the supervised phase, parameters are optimized in a federated manner using FedAvg with FedProx and server momentum. Our framework operates on graphs, where nodes represent IP endpoints and edges represent NetFlow records with traffic statistics as features, aiming to capture the flow of interactions between entities. We evaluate experiments on two real-world datasets, NF-BoT-IoT-v3 and NF-ToN-IoT-v3, in both binary and multi-class settings. E-FGAD achieves a maximum detection accuracy of 99.32%, a Macro-F1 of 89.73%, and a Weighted-F1 of 99.2%. Our framework outperforms centralized and federated baselines, demonstrating its effectiveness in detecting attacks while preserving privacy.
Nuha A. Hamad, Khairul Azmi Abu Bakar, Faizan Qamar et al.· IEEE Access· 0 citations
Internet of Things (IoT) devices are vulnerable to zero-day attacks because most of them have weak or no inherent security due to the resource constraints of the devices. This weakness underscores the growing need for anomaly-based intrusion detection systems tailored to IoT networks. Nevertheless, general anomaly detection traditionally has a high number of false positives that drain analysts' time. Also, a semantic difference exists between the system's results and the operators' interpretations. We introduce a machine learning-based framework to tackle these issues in traditional systems in this paper by combining large language models (LLMs). Our model is effective in identifying possible threats as well as filling the semantic gap. The framework uses isolation forests to detect anomalies and random forests to measure device integrity. To further improve the assessment of anomalies and increase interpretability, system insights are further refined using GPT-4o mini, an LLM. The model gives statistical summaries of the IoT traffic, a risk score, and an explanation in easy language, which is easy to understand and therefore makes the process of decision-making easier. Such a novel system reduces the reliance on dedicated network operators and allows non-technical users to better understand and act on the results of the system.
M. Saeed, Rashid A. Saeed, Salah Hagahmoodi et al.· Baghdad Science Journal· 0 citations
Deep-learning-based Network Intrusion Detection Systems (NIDS) play a vital role in protecting Internet of Things (IoT) environments; however, they remain vulnerable to adversarial examples, in which small input perturbations can cause misclassification. Previous research has considered that there exists a trade-off between model accuracy and robustness; however, this work seeks to prove that TRADES, which uses KL divergence regularization, does not exhibit this trade-off on IoT tabular data. It has been shown that TRADES enables aligning the decision boundaries of the DNN with causal traffic feature spaces rather than vulnerable anomalies. For the Bot-IoT dataset, TRADES has achieved almost full robustness (~100%) against three different attacks including PGD, FGSM, and C&W in a bounded threat model ( $\epsilon $ =0.1). In addition, the TRADES framework has improved the robustness of models in case of data brittleness through using SMOTE method on NSL-KDD imbalanced dataset, leading to an increase of 55 points in robustness. Furthermore, cross-dataset evaluation on UNSW-NB15 and CICIDS2017 datasets has demonstrated good generalization properties (86.10% and 93.20% PGD robustness). Apart from theoretical findings, we provide practical validation for edge deployment within sub-millisecond latency (0.03 ms/packet) based on a quantized 150 KB TensorFlow Lite model, demonstrating promising potential for deployment in IoT devices using latency measurements.
Aqeel Salman Azez, Maytham S Jabor, Alberto Miguel Bonastre Pina et al.· IEEE Access· 0 citations
The rapid growth of IoT and IIoT expands the cyber-attack surface of interconnected and safety-critical systems, and, as such, IDSs have become a fundamental security mechanism. Although very impressive results have been reported for machine learning and deep learning-based IDS in benchmark datasets, these gains often do not generalize to real-world deployments owing to dataset design limitations, realism deficits, and evaluation biases, rather than inherent flaws in detection algorithms, which can lead to significant vulnerabilities in actual operational environments. This study presents a dataset-centric review of widely used intrusion detection datasets from the IIoT, IoT, and traditional network domains. A unified taxonomy differentiates datasets based on the domain context, traffic representation, protocol semantics, and attack modeling assumptions. Based on a common analytical framework, each dataset was reviewed regarding its realism, coverage of the threats, class imbalance, temporal continuity, and modern ML/DL-based evaluation of the IDS. The cross-dataset analysis conducted in this study shows that, in addition to the fact that model architecture and feature engineering play a major role, several studies indicate that the simplicity of the datasets, the class imbalance, and the repetitive attack patterns as well as the evaluation methods can affect accuracy of the IDS. This work further underlines the remaining gaps, such as zero-day and adaptive attacks, limited encrypted traffic, weak temporal evolution, poor support for federated learning, and sparse annotations for explainable IDSs. Finally, this study presents future directions for dataset design aligned with the requirements of next-generation IDSs by highlighting digital twin-based IIoT environments, edge-cloud collaborative data generation, sequential traffic modeling, and explainability-oriented annotations that can ensure robust, trustworthy, and deployment-ready IDS solutions.
Dwarsala Sreedhar Reddy, Kakelli Anil Kumar· Frontiers in Big Data· 1 citation
The exponential growth of IoT (Internet of Things) devices and their deployment has raised numerous threats of botnet-based cyberattacks, making IoT networks more vulnerable than traditional IT systems. The deployment of intelligent network-based intrusion detection systems (NIDS) on these edge devices forces researchers into an impossible trilemma: accuracy, speed, or size of the model. This study presents Tiny-IDS, an intelligent, lightweight system that predicts Mirai botnet attacks on IoT devices. Tiny-IDS is a lightweight and efficient Intrusion Detection System (IDS) that jointly optimizes for four key objectives: high accuracy, low inference latency, a nominal memory footprint, and high interpretability. The core of Tiny-IDS is a three-phase pipeline applied on N-BaIoT dataset. Model performance was evaluated using accuracy, inference time, model size, and interpretability. LightGBM achieved accuracy of 0.999999 but with a inference time of $0.904~\mu $ s/sample and bigger model size of 1.74 MB. Our proposed Distilled Student Tree outperformed other models in terms of efficiency, and achieved classification accuracy of 0.999562 while reducing inference time to $0.278~\mu $ s/sample and model size to 6.25 KB. The results demonstrate the effectiveness of the proposed Tiny-IDS in accurately identifying Mirai botnet attacks on IoT devices along with a minimal memory footprint and low inference time, while also emphasizing the need for IoT-specific evaluation frameworks to support the development of robust and lightweight IDS.
Shyam Bahadur, Sudhanshu Kumar Jha, Rajkumar Singh Rathore et al.· IEEE Open Journal of the Com...· 0 citations
The Internet of Things (IoT) is becoming a widely deployed system with a high number of cybersecurity vulnerabilities, including zero-day and asymmetric attacks. The conventional intrusion detection systems (IDS) usually fail because of limited labelled data, large computational complexity as well as insufficient generalization in a heterogenous environment. The paper presents SLArDHO-Net, a multi-model framework that integrates LSTM-based temporal feature extraction with lightweight classifiers (XGBoost and Random Forest). The hyperparameter optimization, as well as the SLArDHO architecture, involves a semi-supervised learning loop, with pseudo-labels being built by confidence-thresholding unlabeled samples. Such pseudo-labels are repeatedly updated via self-training, where retraining the model with labeled data together with high-confidence pseudo-labeled data is periodically done. The model is employed to optimize both parameters and hyperparameters based on the validation performance ensuring consistency between pseudo-label quality and model generalization. To address class imbalance, a redistribution is applied to rare attacks using a defined threshold. The framework achieves accuracy of 0.97–0.99 at 0–100% labelling ratios on CIC-IoT-2023 data under semi-supervised learning using pseudo-labelling and self-training. Additionally, it demonstrates high efficiency being 1530 times faster during inference, requiring less than 2 GB of memory, and achieving inference times below 28 ms on hardware comparable to a Raspberry Pi 4, making it suitable for edge deployment. However, the approach has limitations, including sensitivity to pseudo-label noise in very low-label situations and the need for further validation of the long-term performance in real-world edge environments.
Assistant Professor Pat Pataranutaporn describes a new interface that lets everyday users glimpse inside an AI's neural network before their chatbot ever says a word.
MIT News · Artificial Intelligence· news.mit.eduJul 6, 2026
PhD student Rachel Sava, winner of the Envisioning the Future of Computing Prize, explores transformative improvements and dystopian risks of neural technology.