Jul 2026· 2026 6th International Conference on Electrical, Computer and Energy Technologies (ICECET)· pp. 1-6· 0 citations· 29 references
Abstract
Heterogeneous architecture, large-scale data generation and susceptibility to variety of cyber attacks are some of the major factors that contribute towards security challenge with rapid expansion of Internet of Things (IoT) networks. Classic intrusion detection systems (IDS) face challenges to maintain high detection accuracy and robustness in such variable environments. In addition, this paper presents a novel approach towards an ensemble of heterogeneous machine learning and deep learning classifiers as an intrusion detection framework for IoT networks to improve the performance of valid attacks detection. The suggested model combined Decision Tree (DT), Random Forest (RF), XGBoost, and Convolutional Neural Network (CNN) with a confidence-based soft voting mechanism enabled by Mutual Information feature selection to reduce redundancy and computational complexity. In order to generalize across all attack types, a diversified combined dataset from CICIDS2017, NSL-KDD, IoTID20, CIC-IoT2023 and ransomware traffic is created that accurately represents modern IoT cyber threats. Performance of the system was assessed for both binary and multi-class classification modes based on conventional performance measures (accuracy, precision, recall, F1-score and ROC-AUC). The experimental results prove that the proposed ensemble model always outperforms individual classifier: It achieves an accuracy of 99.08%, precision, recall and F1-score are also similar to 99.07 in case of multi-class classification, and for the binary classification task it outperforms traditional machine learning models. The ensemble also shows great discriminative capacity with an ROC-AUC of 0.955, which confirms that the ensemble is robust in differentiating between normal and malicious traffic. The results validate the effect of integrating heterogeneous learners with effective feature selection in improving detection accuracy, stability, generalization capabilities in complex IoT environments. This practical foundation for safe AIoT systems lays the groundwork to expand upon, as we demonstrate a scalable and reliable IDS solution that can defeat various cyber-attack patterns.
The increasing deployment of Internet of Things (IoT) devices in smart city infrastructures has significantly expanded the network attack surface, making effective intrusion detection a critical security requirement. Traditional intrusion detection systems struggle to cope with the volume, heterogeneity, and dynamic behaviour of IoT network traffic, often resulting in high false alarm rates and missed attacks. This study investigates the effectiveness of supervised machine learning techniques for detecting cyberattacks in IoT-based smart city networks using the TON_IoT dataset. A progressive modelling approach is adopted, beginning with Logistic Regression as the baseline model, followed by Random Forest as an ensemble method, and culminating in an optimised XGBoost model. Preprocessing and feature engineering address dimensionality, feature representation, and the challenges associated with imbalanced IoT traffic distributions. Experimental results demonstrate that ensemble and boosting-based models significantly outperform linear approaches. Among the evaluated models, XGBoost achieves the highest detection performance, substantially reducing missed attacks while maintaining robust classification accuracy. The findings demonstrate that advanced ensemble learning combined with robust feature engineering provides a reliable and scalable solution for securing smart city IoT networks.
E. Okonta, Oluwaseun Bamgbose· ABC2: Journal of Architectur...· 0 citations
Traditional rule-based intrusion detection systems generally fail in identifying unknown or evolving threats; thus, automated and adaptive kinds of methods are crucial. Deep learning models provide promising solutions, but many recent studies depend on hybrid architecture, which increase the computational cost and reduce deploying ability on real-time or resource-limited systems. In this paper, we present and test a standalone LSTM model for multiclass cyberattack detection based on a CIC_IoT_Dataset2023, a recent labeled dataset that mirrors the actual network environment containing 33 attack categories. The dataset was extremely imbalanced as benign traffic accounted for most of the classes. To detect such attacks, we used the Synthetic Minority Oversampling Technique (SMOTE) to increase the frequency of less common types of address. The pre-processed dataset was then employed to train four models (RNN, CNN, DNN and the proposed LSTM) for performance analysis with sequential data. The proposed LSTM model achieved an accuracy between 2% and 7%. LSTM had good detection for frequent attacks and slow-changing patterns, which shows its capacity in learning long-lasting dependencies. The results demonstrate that a simple, lightweight standalone LSTM model can be used for effective and realistic intrusion detection without the need for complex hybrid architecture.
Jawad Hussain Awan, Misbah Safdar, Muhammad Ayaz Shirazi et al.· Italian National Conference...· 0 citations
Modern networks are becoming increasingly complex as the number of interconnections grows and the number of Internet of Things (IoT) devices rapidly increases, making it possible for complex cyberattacks, including zero-day attacks, distributed denial-of-service (DDoS) attacks, and advanced persistent threats (APTs), to take root. Current traditional IDSs and individual machine learning/deep learning methods have drawbacks, including limited ability to learn from new attacks, high false alarm rates, limited interpretability, and scalability issues. These constraints hinder their usefulness in enterprise-level and IoT-based cybersecurity applications. To overcome these challenges, this paper introduces HybridML-CyberShield, a hybrid machine learning system designed for proactive cyber threat intelligence and intrusion detection. The framework introduces CNN–BiLSTM deep learning networks to represent traffic in a spatiotemporal manner and adopts ensemble machine learning classifiers, such as Random Forest, Support Vector Machine, and Gradient Boosting, to enhance the robustness of traffic detection and its interpretability. A Proactive Threat Scoring Mechanism (PTSM) is added to prioritise threats based on attack probability, attack severity, and confidence, enabling adaptive incident response prioritisation. Additionally, SHAP and LIME models also provide both global and local interpretability, resulting in greater transparency and analyst trust. Experimental evaluation across various benchmark cybersecurity datasets shows that HybridML-CyberShield achieves up to 98.4% accuracy on the CICIDS2017 dataset, with strong F1-scores, AUC-ROC values, and fewer false-positive alerts. The proposed architecture is scalable, transparent and almost real-time for enterprise and IoT cybersecurity monitoring environments.
Ramesh N. S. V. S. C. Sripada, A. Bhavani, Kiran B. Malagi et al.· Discover Computing· 0 citations
An intelligent cyberattack detection system that applies machine learning and deep learning techniques to classify network traffic as either normal or malicious, and demonstrates the potential of machine learningbased intrusion detection systems in improving network security and supporting the protection of modern smart environments.
KADADHARAPU ANUPRIYA, Dr.S.SWATHI RAO· International Journal of Eng...· 0 citations
The rapid growth of digital communication technologies, cloud computing, and Internet of Things (IoT) devices has
increased both the frequency and sophistication of cyber-attacks, making effective intrusion detection an essential component of
modern cybersecurity systems. Traditional signature-based intrusion detection systems (IDS) are effective against known attacks
but fail to detect previously unseen or evolving threats. This study investigates the application of deep learning models for binary
network intrusion detection using the NSL-KDD benchmark dataset. Three standalone architectures, Convolutional Neural
Networks (CNN), Long Short-Term Memory (LSTM) networks, and Deep Neural Networks (DNN), are implemented and
evaluated, alongside a CNN-LSTM Hybrid model that integrates spatial and sequential learning, and a DNN-LSTM Ensemble
model that combines independently trained DNN and LSTM predictions through weighted averaging. Following data cleaning,
categorical encoding, normalization, and Random Forest-based feature selection (41 features reduced to 20), all models were
trained and evaluated under identical conditions using Accuracy, Precision, Recall, F1-Score, ROC-AUC, training time, and
inference time. The standalone DNN model achieved the best overall performance, with 80.98% accuracy, 97.08% precision,
68.66% recall, 80.43% F1-score, and 96.11% ROC-AUC, while also requiring the shortest training time (39.69 s). The CNNLSTM Hybrid model attained the highest precision (97.23%) but did not outperform the standalone architectures overall, and
the DNN-LSTM Ensemble produced balanced but not superior results. These findings indicate that carefully designed
standalone architectures can match or exceed the performance of more complex hybrid and ensemble models for binary
intrusion detection, while incurring substantially lower computational cost. The study contributes a controlled, commonframework comparison of five deep learning architectures and provides practical guidance for selecting computationally
efficient models for anomaly-based intrusion detection.
Ketki Naik, Sanjeev Ghosh· International Journal for Re...· 0 citations
The fast development of internet of things (IoT) networks has led to an increased probability of cyberattacks. Intrusion detection systems (IDS) are needed for identifying unauthorised access and malicious activities in such dynamic environments. However, existing machine learning (ML) models failed to handle the complexity and variability of modern cyber threats. In this work, a hybrid deep learning (DL)-based anomaly detection model is presented for IoT cybersecurity. The model combines three types of features: (i) supervised feature extraction using linear discriminant analysis (LDA) to extract the most discriminative features, (ii) unsupervised feature learning through autoencoders to capture latent representations of the input data, and (iii) statistical features such as mean, variance, skewness, and kurtosis to learn input characteristics. The fused feature matrix is fed into a learning based echo state network (LBESN) for final detection. The parameters of the LBESN model are tuned using black eagle optimizer (BEO). Experimental results on standard intrusion detection datasets such as UNSW-NB15, KDD99, and InSDN show that the proposed model achieves superior performance in terms of accuracy, precision, recall, and F1-score compared to conventional DL techniques.
P. Palpandi, B. Sakthivel, M. Ponnrajakumari et al.· International Journal of Inf...· 0 citations