IoT Intrusion Detection on Large Scale Network Data: From Classical ML and DL to Robust, Explainable and Deployable Benchmarking

Abstract

Internet of Things networks are common targets for cyberattacks, which makes intrusion detection systems an important part of IoT security. Although both machine learning and deep learning have shown good results in this area, fair comparison is still difficult because prior studies often use different datasets, preprocessing steps and evaluation settings. In addition, practical factors such as latency, memory use, model size, robustness and explainability are often not included. This paper presents a fair benchmark of ML and DL models for IoT intrusion detection using a modern large-scale IoT dataset. Nine models are evaluated under one unified pipeline with consistent preprocessing, training, tuning and evaluation rules. The benchmark includes detection metrics such as accuracy, precision, recall, F1 score, ROC-AUC and PR-AUC, as well as deployment metrics, robustness tests under missing and noisy input conditions, which reflect cases such as missing sensor readings, incomplete packet records, sensor noise and calibration drift and SHAP based explainability. The results show that all models achieved strong detection performance, but important differences appeared when deployment and robustness were also considered. XGBoost provided the best overall trade-off, combining the strongest detection results with better efficiency than heavier models such as Random Forest and LSTM. So, this research helps identify which models are most suitable for practical IoT intrusion detection deployment.