HMCTI: A Hierarchical Multi-Context Threat Intelligence Framework for Proactive Cyberattack Detection in IoT Environments

Abstract

The rapid growth of Internet of Things (IoT) networks has increased their exposure to cyber threats, while existing Intrusion Detection Systems (IDS) remain largely reactive and resource-intensive. This paper proposes a HMCTI Framework for proactive cyberattack detection in IoT environments. The framework distributes threat intelligence across Edge, Fog, and Cloud layers, integrating behavioral drift analysis, flow-level features, and device-context information to identify attacks at their early stages. By combining lightweight anomaly detection, context-aware threat analysis, and multi-layer threat correlation, HMCTI enhances detection capability while maintaining scalability and efficiency. Experimental evaluation using the CICIoT2023 dataset assesses detection accuracy, Detection Lead Time (DLT), and resource overhead. The proposed framework provides a scalable and proactive approach for early cyberattack detection in next-generation IoT networks.