Stacked Deep Learning Ensemble Framework for IoT Network Intrusion Detection

Abstract

Network Intrusion Detection Systems (NIDS) are critical defense layers in modern IoT and IIoT environments, which are disproportionately targeted by evolving cyber threats. Classical machine learning approaches and individual deep learning models face documented limitations, including reliance on outdated datasets, susceptibility to class imbalance, and failure to leverage the complementary detection strengths of diverse architectures. This paper presents the formulation and evaluations of a Stacked Deep Learning Ensemble (SDLE) framework for binary network intrusion detection. The ensemble was based on Recurrent Neural Networks (RNN), Gated Recurrent Units (GRU), and Autoencoders as base learners with a Long Short-Term Memory (LSTM) network as the meta-learner. The framework is trained and evaluated on the ToN_IoT dataset, a contemporary IoT/IIoT benchmark comprising 461,043 records and nine attack categories, following a systematic three-stage preprocessing pipeline that incorporates label encoding, one-hot encoding, feature selection, SMOTE-based class balancing, and standard scaling. Experimental results demonstrate that the SDLE achieves 98.67% accuracy, 98.91% precision, 98.45% recall, and 98.68% F1-score, surpassing each base model and a simple voting ensemble by 0.78–1.94 percentage points. Preprocessing contributes a cumulative gain of 7.43 percentage points over raw data performance, with feature selection identified as the single most impactful step (+2.29%). The results also established that the platform provides an effective IDS model and empirical guidance for preprocessing and meta-learner design in deep learning ensemble systems.