2026· International Journal of Advanced Computer Science and Applications· Vol 17· 0 citations· 38 references
TL;DR
A behavior-sensitive access control solution is presented, which integrates lightweight supervised Machine Learning on the IoT gateway to provide dynamic authorization and uses a Supervised Random Forest model to process real-time statistical feature summaries in terms of mean, standard deviation, and sparsity of the IoT telemetry data.
Abstract
The growing amount of heterogeneous devices with scarce resources is compromising the security of the Internet of Things (IoT), as they are more likely to adapt to a fixed and identity-based access control. Conventional security systems tend to assume that once a device is authenticated, the network may be exposed to credential theft, firmware, and insider abuse. In this study a behavior-sensitive access control solution is presented, which integrates lightweight supervised Machine Learning (ML) on the IoT gateway to provide dynamic authorization. Unlike the traditional passive intrusion detection models, the proposed framework uses a Supervised Random Forest model to process real-time statistical feature summaries in terms of mean, standard deviation, and sparsity of the IoT telemetry data. The method converts the output of anomaly detection directly into access (full, restricted or blocked) levels. The system was implemented on a Flask-based gateway and tested with ToN-IoT benchmark dataset. The results of the experiments show an anomaly-class recall of 0.9986 (99.86%) with 91,169 correctly detected attack and 125 false negatives among the 91,294 attack instances, for a security-oriented Zero Trust profile. As an example, when rounded to two decimal places, this value is 1.00, but the unrounded value is reported so as not to suggest 100% detection. The enforcement layer focuses on reducing risk and removes or filters out requests that were determined to be malicious or unauthorized in the scenarios. The architecture is designed to provide low latency through feature extraction and inference on the edge, which provides data privacy because telemetry processing is locally done without relying on the cloud.
Internet of Things (IoT) devices are vulnerable to zero-day attacks because most of them have weak or no inherent security due to the resource constraints of the devices. This weakness underscores the growing need for anomaly-based intrusion detection systems tailored to IoT networks. Nevertheless, general anomaly detection traditionally has a high number of false positives that drain analysts' time. Also, a semantic difference exists between the system's results and the operators' interpretations. We introduce a machine learning-based framework to tackle these issues in traditional systems in this paper by combining large language models (LLMs). Our model is effective in identifying possible threats as well as filling the semantic gap. The framework uses isolation forests to detect anomalies and random forests to measure device integrity. To further improve the assessment of anomalies and increase interpretability, system insights are further refined using GPT-4o mini, an LLM. The model gives statistical summaries of the IoT traffic, a risk score, and an explanation in easy language, which is easy to understand and therefore makes the process of decision-making easier. Such a novel system reduces the reliance on dedicated network operators and allows non-technical users to better understand and act on the results of the system.
M. Saeed, Rashid A. Saeed, Salah Hagahmoodi et al.· Baghdad Science Journal· 0 citations
A security tool can be used to monitor network related tasks and activities of a system to identify unwanted activities and unauthorized access that can be referred to as intrusion Detection System (IDS). Within the Internet of Things (IoT) systems, the IDS examines the large volume and non-uniform traffic of the distributed and resource-constrained devices with the aim of detecting the cyber-attacks in real time. However, the existing designs of the IoT-based IDS are not only expensive to compute but are also limited in their dynamism to the variations in the traffic, and degrade substantially in their performance under the condition of the distribution shifts. In an attempt to relieve these problems this paper will propose a new light and adaptive IDS architecture. Adaptive Feature-aware Traffic Encoding (AFTE) is the method which dynamically adjusts the network parameter, which is the feature of the network the network according to the statistic and time, which enhances resistance to the changing IoT traffic. It has been demonstrated that Hybrid Partial -Temporal Convolution Network (HPTCN) provides a good way to capture discriminative spatio-temporal features at a low cost of computation through partial convolution and gated temporal modelling. Continual Multi-source Knowledge Distillation (CMKD) is an online cross-domain adaptation algorithm that employs knowledge transfer between two or more teachers that adapt with time, and thus is more resistant to unseen and few-shot attacks. It is experimentally demonstrated that the proposed framework is very precise in finding and much less expensive in computation and enhanced generalization in dynamic IoT.
S.Jeevitha, A. S, Ajayprasath I et al.· International Conference Com...· 0 citations
The development of intrusion detection and network security solutions for securing Internet of Things (IoT) networks is constrained by the limited availability of representative network security datasets. Many existing datasets rely on centralised traffic collection and do not capture the non-Independent and Identically Distributed (non-IID) characteristics inherent to edge environments. To address this limitation, this work presents a device-level IoT network dataset generated using the open-source Gotham testbed, a virtualised smart city environment. Network traffic is collected in a distributed manner at the interfaces of 78 heterogeneous IoT devices operating across multiple protocols, including MQTT, CoAP, and RTSP. The dataset comprises over 31.8 million packet-level records, each described by 22 features. It includes both benign traffic and multiple attack classes, namely Network Scanning, Brute Force, Infection, Denial of Service (DoS), and Command and Control (C&C) Communication. Ground-truth labels are assigned using a deterministic process based on orchestration logs. The dataset preserves device-level traffic distributions and captures non-IID characteristics without artificial partitioning. It is publicly available and can be used to support reproducible evaluation of intrusion detection approaches and network analysis tasks in both centralised and distributed learning settings.
Othmane Belarbi, Theodoros Spyridopoulos, Eirini Anthi et al.· International Conference on...· 0 citations
Traditional Internet of Things (IoT) security solutions often rely on heavy cloud-based or gateway-class infrastructure, which is frequently unsuitable for resource-limited hardware due to latency, power, and memory constraints. This paper proposed a resource-aware behavioral Intrusion Detection System (IDS) designed for highly constrained IoT devices. To address these challenges, the proposed system implements real-time application-layer monitoring on an ESP32 Microcontroller Unit (MCU) and utilizes an offline-trained logistic regression model for autonomous, on-device inference. The detection mechanism extracts behavioral features, such as request rates, failed authentication attempts, and invalid resource access within sliding time windows to estimate attack probabilities. Experimental evaluations under controlled scenarios involving flood, brute force, and scan attacks demonstrate that the system achieves high accuracy, precision, and recall. These findings indicate that effective cyber intrusion detection and local mitigation can be successfully executed directly on a single MCU while preserving stable runtime performance and minimal memory usage. Finally, this paper highlights the need for further optimizations to improve robustness and scalability.
Sofyan Bisher, Anas Fawaza, Tarek Mawed et al.· International Conference on...· 0 citations
The rapid expansion of the Internet of Things (IoT) has raised additional concerns about security, and there was a major risk of Distributed Denial-of-Service (DDoS) attacks because the IoT devices have limited computation, memory, and energy capabilities. Traditional intrusion detection methods, which are at times contrived to support a high capacity, are incompetent at these limitations, delaying detections, having too many false alarms, and also compromising the system performance. This study offers a resource-efficient, adaptive machine learning system that was suitable to be used in the operation of DDoS attacks in resource-confined IoT settings. The technique combines the hybrid feature selection algorithms based on mutual information gain and recursive feature elimination to construct a more compact and high-utility feature set together with the optimization of the lightweight classifiers, including stochastic gradient descent and shallow decision trees. The concept drift was solved by an online incremental learning mechanism that guarantees long-term trend detection over time against changing patterns of attacks. The evaluation of the benchmark datasets (CICDDoS2019, BoT-IoT, TON_IoT) using experimental evaluation on a heterogeneous testbed IoT and assessing both security metrics and resource efficiency was researched. The model suggested had a precision of 0.973, a recall of 0.959, an F1-score of 0.966, and an average decrease of malicious traffic by 93 percent at the expense of legitimacy throughput. Latency was decreased to 2.6 seconds when detecting high-intensity attacks, and the CPU and memory usage continued to be less than 35 percent and 70 percent of the device capacity, respectively. A better result in terms of accuracy, response time, false positive rates, and not using resource budgets was witnessed when compared to baseline models through comparative analysis. The results verify the framework's ability to provide low latency and correct DDoS mitigation directly on the IoT devices, which can be considered a feasible solution to achieve resilience improvement of critical IoT deployments in health care, industrial automation, and smart cities.
Selvi. T, Jayaganesh. J· International journal of com...· 0 citations
Among the industries that have been revolutionized by the new development of the Internet of Things (IoT) are healthcare, industry, and smart cities but at the same time, it has brought great security threats, notably Distributed Denial of Service (DDoS) attacks. Conventional deep learning intrusion detection systems offer good accuracy in detection, but can be costly in computation and do not fit well in the constrained resource environment of IoT. This review takes a critical look at the newer IoT-based DDoS detection methods with the attention to Federated Learning (FL), Explainable Artificial Intelligence (XAI), and lightweight machine learning (ML) methods. In a comparison of recent literature, it has been found that lightweight ML models including Support Vector Machines (SVM) and K-Nearest Neighbors (KNN) reach a detection accuracy of around 94-96% with low computational and communication overhead, which makes them an appropriate choice in the deployment of edge-based IoT. Conversely, the FL-integrated deep learning methods, such as FL-XAI frameworks and FL-LSTM models, achieve better detection accuracy (99-99.8) and better privacy protection, but pose serious training complexities, communication, and resource constraints on the devices. As a middle ground to scalability, interpretability, and detection accuracy (97-98%), hybrid models like FL-Autoencoders and FL-CNNs exist. Notwithstanding such progress, the majority of investigations are based on simulated data and do not provide the validity of IoT implementation in the real world, which defines a significant research gap. In general, these results indicate that lightweight ML models are the most viable choice in real-time IoT setups, and federated and explainable frameworks are promising the scalability, privacy-aware, and explainable IoT security systems, as long as their computational efficiency and applicability in the real world are further enhanced.
Binay Sharma, Bipasha Regmi· Devkota Journal of Interdisc...· 0 citations
