Intrusion detection in evolving internet of things environments using decentralized data systems
TL;DR
A hybrid IDS framework built on a stacking ensemble of four heterogeneous base classifiers, namely random forest, extreme gradient boosting, light gradient-boosting machine, and a shallow multi-layer perceptron (MLP), coupled with a PyTorch-based neural network meta-classifier, establishing that pairing meta-learning with decentralized log storage yields a robust, auditable IDS suited for dynamic IoT environments.
Abstract
Growing internet of things (IoT) deployments have widened the attack surface for cyber threats that static, signature-dependent intrusion detection systems (IDSs) struggle to counter, particularly against previously unseen attack variants. This research introduces a hybrid IDS framework built on a stacking ensemble of four heterogeneous base classifiers, namely random forest (RF), extreme gradient boosting (XGBoost), light gradient-boosting machine (LightGBM), and a shallow multi-layer perceptron (MLP), coupled with a PyTorch-based neural network meta-classifier. Recursive feature elimination (RFE) guided by a RF estimator selected the 15 most informative behavioral flow features, while a hybrid random sampling approach corrected severe class imbalance in the training data. Detection outputs are stored immutably through the interplanetary file system (IPFS) via the Pinata gateway, enabling decentralized, content-addressed logging of IDS alerts. Evaluated on the CIC-BCCC-NRC-TabularIoT-2024 benchmark, the model achieved a classification accuracy of 99.51%, precision of 99.71%, recall of 99.30%, and an F1-score of 99.51%, establishing that pairing meta-learning with decentralized log storage yields a robust, auditable IDS suited for dynamic IoT environments.