Cross-Layer Intrusion Detection in IoT via Honeypot and Hardware Telemetry Fusion

Abstract

IoT devices are now at the center of operation for critical infrastructure, from hospital monitoring systems to control units, but they still come with poor default passwords and minimal security features. This has not gone unnoticed by attackers. The problem is that most security solutions operate in their own bubbles: network honeypots detect unusual login activity and commands, while hardware sensors detect unusual temperature and power anomalies, but they do not communicate with each other. An attacker can therefore easily evade detection by remaining below the radar of each individual solution. This paper proposes a Hybrid Hardware-Software Honeypot Framework, developed and tested on a Raspberry Pi 5, to address this problem. We created a Cowrie honeypot for SSH/Telnet communications, a DS18B20 temperature sensor, and an INA219 voltage and current sensor, and synchronized their outputs into time-windowed feature vectors that were fed into a variety of machine learning models. With a dataset of 4,240 labelled examples over five attack types, XGBoost achieved 94.1% accuracy with an F1 macro of $\mathbf{0. 9 4 3 9}$. More importantly, ablation studies showed that honeypot log data alone achieved 24.1% accuracy with LSTM models, while the addition of sensor data increased this to 93.1%. This directly validates the importance of cross-layer monitoring.