TL;DR
An ensemble-based approach TriFusion-AnomNet is proposed by fusing predictions from isolation forest, autoencoders, and one-class support vector machine (OCSVM) to improve robustness and a feedback loop to refine and improve AD models based on human reviews and system performance.
This paper introduces an innovative ML-based security paradigm that improves the attack detection accuracy by combining adaptive feature extraction techniques with a context-attentive hybrid mechanism and maximizes detection accuracy and computational efficiency.
Internet of Things (IoT) devices are vulnerable to zero-day attacks because most of them have weak or no inherent security due to the resource constraints of the devices. This weakness underscores the growing need for anomaly-based intrusion detection systems tailored to IoT networks. Nevertheless, general anomaly detection traditionally has a high number of false positives that drain analysts' time. Also, a semantic difference exists between the system's results and the operators' interpretations. We introduce a machine learning-based framework to tackle these issues in traditional systems in this paper by combining large language models (LLMs). Our model is effective in identifying possible threats as well as filling the semantic gap. The framework uses isolation forests to detect anomalies and random forests to measure device integrity. To further improve the assessment of anomalies and increase interpretability, system insights are further refined using GPT-4o mini, an LLM. The model gives statistical summaries of the IoT traffic, a risk score, and an explanation in easy language, which is easy to understand and therefore makes the process of decision-making easier. Such a novel system reduces the reliance on dedicated network operators and allows non-technical users to better understand and act on the results of the system.
The fast development of internet of things (IoT) networks has led to an increased probability of cyberattacks. Intrusion detection systems (IDS) are needed for identifying unauthorised access and malicious activities in such dynamic environments. However, existing machine learning (ML) models failed to handle the complexity and variability of modern cyber threats. In this work, a hybrid deep learning (DL)-based anomaly detection model is presented for IoT cybersecurity. The model combines three types of features: (i) supervised feature extraction using linear discriminant analysis (LDA) to extract the most discriminative features, (ii) unsupervised feature learning through autoencoders to capture latent representations of the input data, and (iii) statistical features such as mean, variance, skewness, and kurtosis to learn input characteristics. The fused feature matrix is fed into a learning based echo state network (LBESN) for final detection. The parameters of the LBESN model are tuned using black eagle optimizer (BEO). Experimental results on standard intrusion detection datasets such as UNSW-NB15, KDD99, and InSDN show that the proposed model achieves superior performance in terms of accuracy, precision, recall, and F1-score compared to conventional DL techniques.
The majority of assaults in heterogeneous networks are detected by intrusion detection systems (IDS). Cyberattack kinds that seriously harm networks are difficult for conventional IDSs to detect. The majority of existing solutions rely on deep learning models, which have a significant computational and energy overhead that limits their use in IoT environments with limited resources. A lightweight IDS based on ML is proposed in this research as a solution to this difficulty. Predicting the behavior of network traffic is achieved using ToN-IoT data and a tailored preprocessing pipeline. The voting-based ensemble classifier is built through the combination of models of RF and LightGBM to enhance the stability of the classification. The standard performance measures that are utilized to evaluate the proposed approach include accuracy, precision, recall, F1score, false alarm rates, and ROC analysis. The experimental findings indicate that RF achieve 99.81% accuracy, LGBM achieve 99.83%, and the ensemble model has a high accuracy of 99.99% with very low false alarms. Comparative evaluation with traditional ML and DL models demonstrates improved detection reliability with reduced computational overhead. These results prove that the suggested architecture is both computationally efficient and practically applicable to IoT settings with limited resources. However, direct hardware-level energy measurements are required to fully quantify the energy-saving characteristics of the proposed IDS.
The purpose of this study is to address the challenges of repairing errors in real-time data streams generated by Internet of Things (IoT) devices, which benefit various sectors including healthcare, business, and industry. Although these data streams are valuable, IoT readings often contain errors that lead to unreliable analysis and flawed decisions. Traditional IoT data repairing techniques rely primarily on batch processing methods, such as rule-based filtering, which introduce latency and cannot effectively handle real-time streaming data. Furthermore, these conventional approaches typically remove all anomalies without identifying their underlying causes, which can result in the loss of critical insights. Compounding these issues, the computational demands of real-time processing present significant obstacles, and the dynamic nature of data streams makes anomaly repair especially difficult. The study proposes a real-time anomaly repair model for structured IoT data streams. The model classifies and repairs detected anomalies automatically. The proposed model uses statistical measurements and machine learning techniques to repair anomalies. The authors evaluated the model using four data sets, demonstrating improved data quality in real-time data streams by correctly assigning repair techniques to the detected and classified anomalies. By eliminating manual intervention and triggering repair only upon anomaly detection, the proposed method reduces decision delays and avoids unnecessary computational overhead, making it well-suited for efficiently handling anomalies in real-time data streams. This research offers an automated framework to repair anomalies in real-time data streams by applying one of three actions: delete, keep or replace, selected according to anomaly classification and type. Also, it integrates a repair toolset that uses statistical measurements and machine learning techniques to provide multiple replacement options for anomaly repair.
The Internet of Things (IoT) has become increasingly integrated into our daily lives, offering a wide range of services through the proliferation of connected devices. While this connectivity enhances convenience and functionality, it also introduces significant security challenges, exposing IoT systems to various forms of cyberattacks. In this paper, we propose a lightweight edge-based intrusion detection approach for massive IoT networks, leveraging a Long Short-Term Memory (LSTM) model to achieve high accuracy with minimal resource consumption. Unlike centralized solutions, the proposed system is fully implemented and deployed at the edge level, enabling local traffic analysis directly on edge devices. This design reduces latency, minimizes bandwidth consumption, enhances data privacy, and ensures real-time detection capabilities in large-scale IoT environments. The approach incorporates an efficient data pre-processing methodology applied to the wellknown Avast IoT-23 dataset, resulting in a detection accuracy of 99.9% with a compact model size of only 1767 KB. To further optimize performance, the system decomposes the data into clusters before applying a tailored LSTM model for each subset. Experimental evaluation using real malicious traffic demonstrates that the proposed model achieves up to 90% specificity and 88% precision under real-world conditions. These results confirm the effectiveness of our edge-level LSTM framework in providing secure, scalable, and resource-efficient intrusion detection for large-scale IoT environments.