A Two-Tier Hybrid Intrusion Detection System for IoT Networks

An Intelligent Intrusion Detection Framework for Cyber Security in Hybrid Network Environments

In the era of contemporary data traffic routing, the concept of Intrusion Detection Systems (IDS) is substantially utilized. However, the efficacy of IDS is often decreased because of the reality that high-concentration traffic postfixes, sophisticated cyber criminals, and more and more stringent demands are tending to decrease in resource-limited environments. The paper presents the enhanced intrusion detection system based on deep learning architecture, which can be flexible, adaptive and as well maintain the high detection capability with confidence under changing or to-be changed network settings. The objectives of this and aforementioned also address the issue of avoiding strong overtting behavior by models during the transfer learning and even rich feature representation through the first-stage operation: moving to address and ideally preventing attacks rather than supporting other attacks. The work is tailored to the deployment of the light-weight and adaptive IDS design which is supposed to be large enough to work in real time on low-powered devices such as IoTs and edge devices that are nondominated in energy and computationally less demanding. Real-time adaptability of the model will be examined through operational deployment simulations. It is also expected that such simulations would take into account latency, throughput, and energy consumption of the IDS model. On the one hand, In a stage nested within the very last period of this research, the IDS model has been merged with Explainable AI technologies; now LIME and SHAP are also preserved to improve the interpretability of the model decisions and the level of decision-making. What kind of feature attributions are made with the intrusion data? How is Interpretability of the model evaluated in terms of fidelity, comprehensibility, and expert belief? Therefore, all the above-mentioned events will be a perfect example of how the technologically ingrained tasks, particularly in the technical discipline of security studies, can be wrapped into the very cognitive resource of human beings.

Energy-Efficient Machine Learning (ML)-Based Intrusion Detection System (IDS) for IoT Devices

The majority of assaults in heterogeneous networks are detected by intrusion detection systems (IDS). Cyberattack kinds that seriously harm networks are difficult for conventional IDSs to detect. The majority of existing solutions rely on deep learning models, which have a significant computational and energy overhead that limits their use in IoT environments with limited resources. A lightweight IDS based on ML is proposed in this research as a solution to this difficulty. Predicting the behavior of network traffic is achieved using ToN-IoT data and a tailored preprocessing pipeline. The voting-based ensemble classifier is built through the combination of models of RF and LightGBM to enhance the stability of the classification. The standard performance measures that are utilized to evaluate the proposed approach include accuracy, precision, recall, F1score, false alarm rates, and ROC analysis. The experimental findings indicate that RF achieve 99.81% accuracy, LGBM achieve 99.83%, and the ensemble model has a high accuracy of 99.99% with very low false alarms. Comparative evaluation with traditional ML and DL models demonstrates improved detection reliability with reduced computational overhead. These results prove that the suggested architecture is both computationally efficient and practically applicable to IoT settings with limited resources. However, direct hardware-level energy measurements are required to fully quantify the energy-saving characteristics of the proposed IDS.

An Effective Hierarchical Anomaly Based Intrusion Detection System for IoT Using Ant Colony Optimization Based Feature Selection

AI-Driven Security: Detecting Cyber Attacks in IoT Networks

Traditional rule-based intrusion detection systems generally fail in identifying unknown or evolving threats; thus, automated and adaptive kinds of methods are crucial. Deep learning models provide promising solutions, but many recent studies depend on hybrid architecture, which increase the computational cost and reduce deploying ability on real-time or resource-limited systems. In this paper, we present and test a standalone LSTM model for multiclass cyberattack detection based on a CIC_IoT_Dataset2023, a recent labeled dataset that mirrors the actual network environment containing 33 attack categories. The dataset was extremely imbalanced as benign traffic accounted for most of the classes. To detect such attacks, we used the Synthetic Minority Oversampling Technique (SMOTE) to increase the frequency of less common types of address. The pre-processed dataset was then employed to train four models (RNN, CNN, DNN and the proposed LSTM) for performance analysis with sequential data. The proposed LSTM model achieved an accuracy between 2% and 7%. LSTM had good detection for frequent attacks and slow-changing patterns, which shows its capacity in learning long-lasting dependencies. The results demonstrate that a simple, lightweight standalone LSTM model can be used for effective and realistic intrusion detection without the need for complex hybrid architecture.

HybridML CyberShield for explainable proactive intrusion detection in enterprise and IoT networks

Modern networks are becoming increasingly complex as the number of interconnections grows and the number of Internet of Things (IoT) devices rapidly increases, making it possible for complex cyberattacks, including zero-day attacks, distributed denial-of-service (DDoS) attacks, and advanced persistent threats (APTs), to take root. Current traditional IDSs and individual machine learning/deep learning methods have drawbacks, including limited ability to learn from new attacks, high false alarm rates, limited interpretability, and scalability issues. These constraints hinder their usefulness in enterprise-level and IoT-based cybersecurity applications. To overcome these challenges, this paper introduces HybridML-CyberShield, a hybrid machine learning system designed for proactive cyber threat intelligence and intrusion detection. The framework introduces CNN–BiLSTM deep learning networks to represent traffic in a spatiotemporal manner and adopts ensemble machine learning classifiers, such as Random Forest, Support Vector Machine, and Gradient Boosting, to enhance the robustness of traffic detection and its interpretability. A Proactive Threat Scoring Mechanism (PTSM) is added to prioritise threats based on attack probability, attack severity, and confidence, enabling adaptive incident response prioritisation. Additionally, SHAP and LIME models also provide both global and local interpretability, resulting in greater transparency and analyst trust. Experimental evaluation across various benchmark cybersecurity datasets shows that HybridML-CyberShield achieves up to 98.4% accuracy on the CICIDS2017 dataset, with strong F1-scores, AUC-ROC values, and fewer false-positive alerts. The proposed architecture is scalable, transparent and almost real-time for enterprise and IoT cybersecurity monitoring environments.

A Deep Learning-Based Framework for Cyber Attack Detection in IoT Networks

An intelligent cyberattack detection system that applies machine learning and deep learning techniques to classify network traffic as either normal or malicious, and demonstrates the potential of machine learningbased intrusion detection systems in improving network security and supporting the protection of modern smart environments.