Jul 2026· 2026 4th International Conference on Sustainable Computing and Smart Systems (ICSCSS)· pp. 264-269· 0 citations· 27 references
Abstract
The growth of Internet of Things devices has expanded the number of attackable targets of advanced cyber threats by orders of magnitude, and the limited computational capabilities of IoT devices have made more traditional intrusion detection systems infeasible to execute at the edge. A Knowledge-Distilled Multi-Model Intrusion Detection and Prevention System is presented, which combines a Residual Graph Convolutional Network, Long Short-Term Memory classifier, and a Conditional Tabular Generative Adversarial Network enhanced with the student-only autoencoders through multi-loss knowledge distillation to create a high-performing Teacher ensemble and compresses its intelligence into an edge-deployed system. The system is evaluated using the IoT-23 benchmark of 325 million network flow records and attains 98.2% Teacher-Student fidelity, 0.94 Knowledge Retention Score, and 4.4x throughput increase with 82.7% reduction in the parameter and provides per-packet SHapely Additive exPlanation forensic explainability.
A lightweight, explainable IDS that combines a 1D-CNN for spatial feature analysis with SHAP for model interpretation, yielding streamlined models that preserve over 93% F1-score and reduce computational overhead by more than 38%, facilitating millisecond-level inference on edge hardware.
Miracle Udurume, Vladimir V. Shakhov, Insoo Koo· Scientific Reports· 0 citations
Modern networks are becoming increasingly complex as the number of interconnections grows and the number of Internet of Things (IoT) devices rapidly increases, making it possible for complex cyberattacks, including zero-day attacks, distributed denial-of-service (DDoS) attacks, and advanced persistent threats (APTs), to take root. Current traditional IDSs and individual machine learning/deep learning methods have drawbacks, including limited ability to learn from new attacks, high false alarm rates, limited interpretability, and scalability issues. These constraints hinder their usefulness in enterprise-level and IoT-based cybersecurity applications. To overcome these challenges, this paper introduces HybridML-CyberShield, a hybrid machine learning system designed for proactive cyber threat intelligence and intrusion detection. The framework introduces CNN–BiLSTM deep learning networks to represent traffic in a spatiotemporal manner and adopts ensemble machine learning classifiers, such as Random Forest, Support Vector Machine, and Gradient Boosting, to enhance the robustness of traffic detection and its interpretability. A Proactive Threat Scoring Mechanism (PTSM) is added to prioritise threats based on attack probability, attack severity, and confidence, enabling adaptive incident response prioritisation. Additionally, SHAP and LIME models also provide both global and local interpretability, resulting in greater transparency and analyst trust. Experimental evaluation across various benchmark cybersecurity datasets shows that HybridML-CyberShield achieves up to 98.4% accuracy on the CICIDS2017 dataset, with strong F1-scores, AUC-ROC values, and fewer false-positive alerts. The proposed architecture is scalable, transparent and almost real-time for enterprise and IoT cybersecurity monitoring environments.
Ramesh N. S. V. S. C. Sripada, A. Bhavani, Kiran B. Malagi et al.· Discover Computing· 0 citations
The rapid growth of Internet of Things (IoT) devices has significantly improved connectivity across smart environments. However, the resource-constrained nature of IoT devices and their limited built-in security mechanisms make them highly vulnerable to evolving cyberattacks. Traditional intrusion detection systems relying on signature-based or static rule sets are often ineffective against previously unseen attacks. This study proposes a hybrid machine learning-based intrusion detection and prevention framework for securing IoT networks. The framework integrates Isolation Forest, Autoencoder, Extreme Gradient Boosting, and Bidirectional Long Short-Term Memory models within a stacked ensemble architecture to improve attack detection while reducing false-positive predictions. The ensemble outputs are combined using a Logistic Regression meta-classifier to generate the final threat score. Experimental evaluation using the UNSW-NB15 dataset demonstrates that Extreme Gradient Boosting achieved the highest individual Receiver Operating Characteristic-Area Under the Curve score of 0.91, while the proposed framework further enhances detection robustness through ensemble learning and automated prevention. A Flask-based monitoring dashboard provides real-time visualization of detection results, blocked IP addresses, alerts, and system performance.
Ruthwik Palem, Likhith Reddy Peketi, Vanathi M et al.· Cureus Journal of Computer S...· 0 citations
The rapid growth of heterogeneous network environments such as the Internet of Things (IoT), Industrial IoT (IIoT), cloud computing, and software‐defined networks has significantly increased exposure to sophisticated cyberattacks, making intrusion detection a critical component of modern cybersecurity infrastructures. Traditional intrusion detection systems and conventional machine learning techniques often face limitations when handling high‐dimensional network traffic, class imbalance, and evolving attack patterns, resulting in reduced detection performance and limited scalability under complex network environments. These challenges reduce their effectiveness in practical, large‐scale deployments. To overcome these issues, this paper proposes a hybrid intrusion detection framework based on an Autoencoder and a TabTransformer, optimized using the Whale Optimization Algorithm (WOA). The Autoencoder is employed to perform unsupervised feature learning, transforming high‐dimensional network traffic data into compact and noise‐resistant latent representations. These latent features are then processed by the TabTransformer, which utilizes multi‐head self‐attention to capture complex inter‐feature relationships and enhance classification performance. The WOA is incorporated to automatically optimize key hyperparameters, improving convergence speed, stability, and generalization capability of the model. The proposed framework is primarily evaluated using the CIC‐IDS2018 benchmark dataset. In addition, supplementary cross‐dataset validation on the CIC‐IDS2017 and UNSW‐NB15 datasets is conducted to assess the generalization capability of the proposed framework. Experimental results demonstrate that the proposed model achieves an accuracy of 99.87%, precision of 99.85%, recall of 99.88%, and an F1‐score of 99.86% while maintaining very low false alarm and false negative rates. Comparative analysis with existing deep learning‐based intrusion detection approaches confirms the superior and balanced performance of the proposed method. Overall, the Hybrid Autoencoder–TabTransformer framework provides an effective intrusion detection solution that demonstrates strong performance under the evaluated experimental conditions.
Rui Guo, Guangjun Wen· Transactions on Emerging Tel...· 0 citations
Traditional rule-based intrusion detection systems generally fail in identifying unknown or evolving threats; thus, automated and adaptive kinds of methods are crucial. Deep learning models provide promising solutions, but many recent studies depend on hybrid architecture, which increase the computational cost and reduce deploying ability on real-time or resource-limited systems. In this paper, we present and test a standalone LSTM model for multiclass cyberattack detection based on a CIC_IoT_Dataset2023, a recent labeled dataset that mirrors the actual network environment containing 33 attack categories. The dataset was extremely imbalanced as benign traffic accounted for most of the classes. To detect such attacks, we used the Synthetic Minority Oversampling Technique (SMOTE) to increase the frequency of less common types of address. The pre-processed dataset was then employed to train four models (RNN, CNN, DNN and the proposed LSTM) for performance analysis with sequential data. The proposed LSTM model achieved an accuracy between 2% and 7%. LSTM had good detection for frequent attacks and slow-changing patterns, which shows its capacity in learning long-lasting dependencies. The results demonstrate that a simple, lightweight standalone LSTM model can be used for effective and realistic intrusion detection without the need for complex hybrid architecture.
Jawad Hussain Awan, Misbah Safdar, Muhammad Ayaz Shirazi et al.· Italian National Conference...· 0 citations
In the fast-growing world of Internet of Things (IoT), devices have exploded that are not only efficient but also expose serious security vulnerabilities that can be used as vectors for more advanced cyber-attacks. Traditional IDS has the challenge of false positive rate, which could cause critical operations to be disrupted in various domains from smart medical devices (SMDs) to municipal infrastructure. Machine Learning (ML) and Deep Learning (DL) models are state-of-the art solutions to detect complex, high-dimensional and temporal network anomalies in terms of accuracy but their deployment is still hampered severely due to the fact that they lack interpretability. This paper introduces a new explainable hybrid IDS architecture for IoT environments named XABiL-IDS (Explainable Attention-based Bi LSTM-Intrusion Detection System) in response to this challenge. This study uses a robust hybrid architecture to detect attacks effectively. Global analysis using the SHAP method for determining the most relevant traffic attributes affecting the classification process in the dataset on the other hand local analysis done by LIME for providing explanation at the instance level on the prediction made regarding network flows. The key differentiating feature of this approach compared to earlier methods is the incorporation of both global and local explainability in single pipeline.
Ravi Patni, Gurvinder Singh· International journal of com...· 0 citations
