Jun 2026· Engineering Systems and Intelligent Technologies (ESIT)· Vol 3, pp. 49-58· 0 citations· 27 references
TL;DR
Across all five algorithms, boosting methods showed a small but consistent advantage over bagging methods, and detection was effective for every MITM technique considered, with SSL stripping proving the most difficult to identify.
Abstract
The expansion of Internet of Things (IoT) deployments has widened the attack surface available to adversaries, and the man-in-the-middle (MITM) attack remains one of the most damaging threats facing these networks. In a MITM attack, two parties that believe they are communicating directly are in fact exchanging traffic through an intermediary that silently alters or observes the exchange. Common realizations of this threat include ARP spoofing, DNS hijacking, and SSL stripping, each producing a distinct signature in network traffic that a classifier can learn to recognize. This study evaluates and compares five ensemble learning algorithms, Random Forest, Extra Trees, XGBoost, CatBoost, and LightGBM, for the detection of MITM activity in the TON_IoT network traffic dataset. Performance is assessed using accuracy, precision, recall, F1-score, area under the ROC curve, and computational cost. CatBoost obtained the highest detection accuracy (99.2%) and F1-score (0.987), while LightGBM required roughly one third of CatBoost’s training time at a negligible cost in detection quality. Across all five algorithms, boosting methods showed a small but consistent advantage over bagging methods, and detection was effective for every MITM technique considered, with SSL stripping proving the most difficult to identify. The results suggest that the choice among these algorithms in an operational deployment should depend on whether the priority is raw detection accuracy, inference speed, or interpretability, rather than on accuracy alone.
The rapid growth of Internet of Things (IoT) devices has significantly improved connectivity across smart environments. However, the resource-constrained nature of IoT devices and their limited built-in security mechanisms make them highly vulnerable to evolving cyberattacks. Traditional intrusion detection systems relying on signature-based or static rule sets are often ineffective against previously unseen attacks. This study proposes a hybrid machine learning-based intrusion detection and prevention framework for securing IoT networks. The framework integrates Isolation Forest, Autoencoder, Extreme Gradient Boosting, and Bidirectional Long Short-Term Memory models within a stacked ensemble architecture to improve attack detection while reducing false-positive predictions. The ensemble outputs are combined using a Logistic Regression meta-classifier to generate the final threat score. Experimental evaluation using the UNSW-NB15 dataset demonstrates that Extreme Gradient Boosting achieved the highest individual Receiver Operating Characteristic-Area Under the Curve score of 0.91, while the proposed framework further enhances detection robustness through ensemble learning and automated prevention. A Flask-based monitoring dashboard provides real-time visualization of detection results, blocked IP addresses, alerts, and system performance.
Ruthwik Palem, Likhith Reddy Peketi, Vanathi M et al.· Cureus Journal of Computer S...· 0 citations
The rapid propagation of Internet of Things (IoT) devices has significantly expanded the cyber-attack surface, particularly in essential infrastructure sectors such as energy, water, and healthcare. Machine learning (ML) based intrusion detection systems (IDS) offer a promising defense, but their real-world deployment is often hindered by data imbalance, lack of interpretability, and computational demands. In this paper, we introduce a lightweight ensemble approach, which integrates XGBoost and LightGBM using a soft-voting method. The system is evaluated on the IDSAI dataset after eliminating duplicates, resulting in 693,116 unique samples with a natural class imbalance. The preprocessing phase includes data cleansing and data scaling. The results indicate that the proposed ensemble achieves 99.95% accuracy, 99.95% F1-score, and a perfect AUC of 1.0 on a test set of 207,935 samples. Training completes in under 8 seconds on a standard CPU. The feature importance (gain) highlights delta_time; packet inter-arrival time, as the most significant feature, followed by source/destination ports. SHapley Additive exPlanations (SHAP) analysis provides local explanations, revealing that high inter-arrival times push predictions toward malicious—likely due to slow scanning or burst-and-pause attack patterns. All code and the trained model are publicly available to facilitate reproducibility1.
Nooruddine F. Assarwie, F. Alqasemi, Tasnim M. Al-Khawlani et al.· 2026 6th International Confe...· 0 citations
An intelligent cyberattack detection system that applies machine learning and deep learning techniques to classify network traffic as either normal or malicious, and demonstrates the potential of machine learningbased intrusion detection systems in improving network security and supporting the protection of modern smart environments.
KADADHARAPU ANUPRIYA, Dr.S.SWATHI RAO· International Journal of Eng...· 0 citations
With the proliferation of Internet of Things (IoT), critical infrastructures such as smart cities, industrial automation, precision healthcare, and intelligent transportation have seen a significant shift in their security landscape. As these critical infrastructures are increasingly depending on OneM2M standards for interoperability and scalable service management, they are simultaneously presenting a larger and more structured attack surface. One of the most serious and realistic threats in such scenarios is black-box adversarial attacks, in which an attacker can compromise Machine Learning (ML) and Deep Learning (DL)-based intrusion detection systems (IDS) without having prior knowledge of the ML/DL model's architecture, parameters, and training data. To mitigate such a critical challenge, we propose a multi-stage framework specific to OneM2M-based IoT networks that can effectively counter transfer-based and query-based black-box adversarial attacks. Our framework's effectiveness will be tested on a dataset of 1.25 million labeled network flows collected from Azure IoT Hub-based IoT devices over a 10-day period. We will test the robustness of our framework against three adversarial attacks: FGSM with $\varepsilon=0.05$, PGD with 40 iterations and step size 0.01, and C&W with L2 optimization and 1,000 iterations. The proposed pipeline consists of four different mechanisms: (1) adversarial training with the use of mixed clean and adversarial samples, (2) traffic sanitization to minimize malicious and/or suspicious traffic flows before processing by the Common Service Entity (CSE), (3) the use of a black-box adversarial detector based on feature transformation, and (4) the use of an ensemble-based IDS to make use of the results of the Random Forest, XGBoost, MLP, and 1D-CNN-based IDSs via majority voting. The experimental results show that the proposed Ensemble + multi-defense configuration results in 98.1% accuracy, 98.3% TPR, and 1.7% FNR. Most notably, the proposed Ensemble + multi-defense configuration results in an ASR of 11.2%, which is down by 86% compared to the 82.3% ASR achieved by the baseline IDS. Notably, the proposed framework results in limited overheads in terms of RTT (increased by 8 ms), CPU (increased by 17%), and RAM (increased by 1.6 GB).
Hamza Jamiri, A. Zyane· International Conference on...· 0 citations
The increasing deployment of Internet of Things (IoT) devices in smart city infrastructures has significantly expanded the network attack surface, making effective intrusion detection a critical security requirement. Traditional intrusion detection systems struggle to cope with the volume, heterogeneity, and dynamic behaviour of IoT network traffic, often resulting in high false alarm rates and missed attacks. This study investigates the effectiveness of supervised machine learning techniques for detecting cyberattacks in IoT-based smart city networks using the TON_IoT dataset. A progressive modelling approach is adopted, beginning with Logistic Regression as the baseline model, followed by Random Forest as an ensemble method, and culminating in an optimised XGBoost model. Preprocessing and feature engineering address dimensionality, feature representation, and the challenges associated with imbalanced IoT traffic distributions. Experimental results demonstrate that ensemble and boosting-based models significantly outperform linear approaches. Among the evaluated models, XGBoost achieves the highest detection performance, substantially reducing missed attacks while maintaining robust classification accuracy. The findings demonstrate that advanced ensemble learning combined with robust feature engineering provides a reliable and scalable solution for securing smart city IoT networks.
E. Okonta, Oluwaseun Bamgbose· ABC2: Journal of Architectur...· 0 citations
Denial-of-Service (DoS) attacks continue to threaten the availability and dependability of Internet of Things (IoT) networks. Because many IoT devices have limited processing power, memory, and built-in protection, they are frequently exploited to generate abnormal traffic that blocks legitimate communication. Signature-driven security tools are often unable to cope with changing attack behaviour. This paper presents a hybrid intrusion detection model that combines Artificial Neural Networks (ANNs) and Random Forest (RF) classification for DoS detection in IoT networks. The ANN component learns non-linear traffic representations, while the RF component performs the final ensemble-based classification. The model was implemented in MATLAB and evaluated using detection accuracy, false positive rate (FPR), and latency. The results show that the hybrid ANN-RF model reached 93% detection accuracy and 5% FPR, outperforming standalone ANN and RF models. The findings indicate that the proposed approach can support reliable and scalable real-time intrusion detection for IoT applications such as smart homes, healthcare systems, and industrial automation.
Bulelani S. Ndaba, T. Mathonsi, D. D. du Plessis· 2026 6th International Confe...· 0 citations