AI-POWERED INTRUSION DETECTION SYSTEM FOR IOT SECURITY

Blockchain and federated learning-based intrusion detection approaches for edge-enabled industrial IoT networks: a survey

Background The growing scale and complexity of Internet of Things (IoT) environments have intensified the need for intelligent and adaptive cybersecurity mechanisms. Artificial intelligence (AI)-based intrusion detection systems (IDS) have emerged as a promising solution for identifying and mitigating threats in real time. Methodology This review systematically evaluates the effectiveness of AI-based IDS in IoT networks, following the Preferred Reporting Items for Systematic Reviews and Meta-Analyses (PRISMA) 2020 guidelines. A comprehensive search of the Scopus and Web of Science databases was conducted, yielding 203 studies, of which 51 met the inclusion criteria. Eligible studies, published between 2016 and 2025, were analyzed for geographic distribution, AI techniques used, methodological quality, and reported outcomes. Meta-regression and contour-enhanced funnel plots were employed to assess effect size trends and publication bias. Results Most studies originated from India, Saudi Arabia, and China, with research output peaking in 2024. Meta-regression analysis revealed a positive correlation between publication year and reported effect size, indicating progressive advancements in AI methodologies. Machine learning (ML) and deep learning (DL) were the most widely used techniques, with a growing trend toward hybrid and ensemble models that enhance threat detection accuracy. Recent studies also showed increased interest in explainable artificial intelligence (XAI), reflecting the demand for transparency and interpretability in model outputs. Funnel plot asymmetry suggested a bias toward publishing positive findings. Conclusions AI-based IDSs have demonstrated substantial potential in strengthening IoT security, particularly through ML, DL, and hybrid approaches. However, inconsistencies in evaluation metrics, reporting standards, and methodological design remain significant challenges. The findings highlight the need for standardized benchmarks and robust frameworks to guide future research and ensure reliable deployment of AI-driven IDS in diverse IoT contexts.

The integration of IDS and Internet of Things (IoT) with deep learning plays a significant role in safety. Security has a strong role to play. Application of the IoT network decreases the time complexity and resources. In the traditional intrusion detection systems (IDS), this research work implements the cutting-edge methodologies in the IoT environment. This research is based on analysis, conception, testing and execution. Detection of intrusions can be performed by using the advanced deep learning system and multiagent. The NSL-KDD dataset is used to test the IoT system. The IoT system is used to test the IoT system. In order to detect attacks from intruders of transport layer, efficiency result rely on advanced deep learning idea. In order to increase the system performance, multi -agent algorithms could be employed to train communications agencies and to optimize the feedback training process. Advanced deep learning techniques such as CNN will be researched to boost system performance. The testing part an IoT includes data simulator which will be used to generate in continuous of research work finding with deep learning algorithms of suitable IDS in IoT network environment of current scenario without time complexity.

With the development of Internet of Things communities, the complexity and scale of cyber security threats multiply swiftly in these intelligent cities and their connected digital infrastructure. As hybrid computing and cyber environment continue to develop, NGID systems become increasingly fragile because of their lack of adaptability and the ability to understand local context to accurately detect the cyber-attacks in dynamic cyber environment like cloud computing. The current work investigates the design and deployment of context-awareness intrusion detection systems (IDS) based on advanced artificial intelligence (AI) approaches to improve a security framework in smart city. Utilizing the real time environmental, network and user behavior data, the IDS models introduced here can optimize detection parameters as dynamic, to improve the anomaly recognition, false positives’ reduction and response time. The research is aiming at combining context information from multiple and diverse internet of things devices, and sensors, and communication networks, so as to enable AI algorithms to build a complete situational awareness model. Such context-aware processing enables the IDS to draw the borderline between normal operation and attacks more accurately. Machine learning techniques, like deep learning and reinforcement learning, can be used to continuously enhance the power of detection over adaptive leaning and build robustness against zero-day attacks and adaptive threats. In addition, the software architecture highlights fog computing for real-time threat detection and transmission from edge to network and it emphasizes a decentralized processing system at the edge of the network while maintaining data privacy. Experimental results, analyzed on several simulated smart city networks, clearly show that the context-aware AI-based IDS performs considerably better than traditional IDSs on detecting a variety of cyber threats like DDoS attacks, data breaches, and unauthorized access attempts. The results demonstrate the system's strength, scalability, and efficiency, which points a promising trend for securing the digital backbone of the future smart cities. This work paves the way for smarter, secure urban ecosystems by leveraging AI and context-awareness in the domain of cybersecurity.

The Internet of Things (IoT) has transformed various sectors by enabling connectivity and automation through smart devices. However, the expansion of IoT networks has introduced new security challenges, particularly concerning the detection and prevention of cyber threats. This study explores the application of machine learning (ML) models for enhancing network security in IoT-enabled smart systems. The primary objective was to evaluate the performance of different ML algorithms, including Convolutional Neural Networks (CNN), Random Forest (RF), Support Vector Machine (SVM), Decision Tree (DT), K-Means, and Autoencoder, in detecting and mitigating security threats in IoT environments. The study also aimed to identify the most effective model in terms of accuracy, precision, recall, and F1-score. The research methodology involved training and testing these models on publicly available IoT security datasets, followed by performance evaluation based on the key metrics. Statistical analysis, including One-Way ANOVA and post-hoc testing, was used to assess the significance of the performance differences across the models. The results revealed that CNN outperformed all other models, achieving the highest accuracy (96.7%), precision (95.8%), recall (97.2%), and F1-score (96.5%). Random Forest also demonstrated strong performance with an accuracy of 95.6% and a balanced evaluation across all metrics. In contrast, traditional models like SVM and DT showed comparatively lower performance, while Autoencoder struggled with classification tasks, particularly in real-time threat detection. Statistical analysis confirmed the significant differences in model performance. In conclusion, the study demonstrates the effectiveness of deep learning and ensemble models, particularly CNN and Random Forest, in enhancing IoT network security. The research highlights the importance of selecting the appropriate ML model based on the specific requirements of the IoT environment and computational constraints, and suggests that hybrid models and model optimization strategies may offer promising solutions for resource-constrained IoT systems.

The rapid expansion of Internet of Things (IoT) networks has introduced new cybersecurity risks, particularly due to their heterogeneous, dynamic, and resource-constrained nature. Intrusion Detection Systems (IDS) are commonly used to detect cyber threats in such environments, but traditional IDSs and many machine learning (ML) or deep learning (DL)-based methods face challenges. These include poor detection of unknown attacks, dependence on large datasets, static feature learning, and an inability to adapt to evolving traffic patterns without frequent retraining. Furthermore, while graph-based IDSs capture relational context, their high computational cost and difficulty in adapting to dynamic IoT networks hinder their scalability. To address these challenges, we propose LNNIDS , a novel IDS method that integrates spike encoding with a Hybrid Liquid Neural Network (HLLN) to capture the temporal evolution of IoT attack network traffic. To further enhance accuracy, we introduce DYNGraph , a dynamic graph-based method that performs n → 1 pattern clustering for scalable attack classification. This allows the LNNIDS to dynamically group related flow behaviors and adapt to new or unknown attacks without retraining. We evaluated LNNIDS on two public IoT datasets. This method achieved 99.50% accuracy and maintained robust performance with only 20% training data. Furthermore, we compared the LNNIDS with the seven recent state-of-the-art methods, and we found that LNNIDS outperformed them in the detection of known and unknown IoT attacks with 13.45% and 11.99% better accuracy, respectively.

The substantial growth of Internet-connected devices within the Internet of Things (IoT) has given rise to significant security challenges. Among the various threats confronting these interconnected devices, Denial of Service (DoS)/Distributed Denial of Service (DDoS) attacks emerge as significant concerns. The attacks, which seek to disrupt IoT services by flooding networks with unnecessary traffic, there is a critical need for robust security measures. Intrusion Detection Systems (IDS) are vital in identifying suspicious activities, yet many existing systems lack real-time capabilities to address evolving attack strategies. This study investigates the vulnerabilities of IoT networks and the pressing need to detect and classify DoS/DDoS attacks in real time. Traditional IDS, while effective in recognizing known attack patterns, fall short in identifying new attack types due to their reliance on historical data. To bridge this gap, this research focuses on developing an enhanced hybrid network intrusion detection and classification system. This study seeks to make contribution to the advancement of resilient security measures within IoT environments. The framework uses the Kth Nearest Neighbor (KNN) algorithm and dense neural networks to efficiently detect and categorize DoS/DDoS attacks in real time. To achieve this, a simulation model implementing the proposed hybrid algorithm will be developed. The framework utilized the MQTT-IoT-IDS2020 dataset, and a comparison was presented with recent approaches found in the literature. The results demonstrated enhanced performance in terms of true positive rate, accuracy, speed of detection.

The proliferating popularity of Internet of Things (IoT) devices has led to wide‐scale networked system implementations across multiple disciplines, including transportation, medicine, smart homes, and many others. This unprecedented level of interconnectivity has introduced new security vulnerabilities and threats. Ensuring security in these IoT settings is crucial for protecting against malicious activities and safeguarding data. Real‐time identification and response to potential intrusions and attacks are essential, and intrusion detection systems (IDS) are pivotal in this process. However, the dynamic and diverse nature of the IoT environment presents significant challenges to existing IDS solutions, which are often based on rule‐based or statistical approaches. Deep learning, a subset of artificial intelligence, has shown great potential to enhance IDS in IoT. Deep learning models can identify complex patterns and characteristics by utilizing artificial neural networks, automatically building hierarchical representations from data. This capability results in more precise and efficient intrusion detection in IoT‐based systems. The primary aim of this survey is to present an extensive overview of the current research on deep learning and IDS in the IoT domain. By examining existing literature, discussing mainstream datasets, and highlighting current challenges and potential prospects, this survey provides valuable insights into the prevailing scenario and future directions for using deep learning in IDS for IoT. The findings from this research aim to enhance intrusion detection techniques in IoT environments and promote the development of more effective antimalware solutions against cyber threats targeting IoT device systems.

We are living in a connected world which encompasses various types of devices and networks. The most widely used network in modern age is Internet of Things (IoT). It is a type of network where IOT devices can communicate with each other without human intervention. The life of people is transformed with the evolution of smart city, smart home concepts. The areas are not limited. It ranges from healthcare, medical, transportation to banking, smart grid, agriculture. It has transformed the lives of people by providing ease and comfort of completing the tasks in less time with less overhead. However, there is a negative side of IoT and that is it lacks the implementation of sound and effective security measures. There are various risks associated with use of IoT. Some of them are risk of unauthorized access of data, node spoofing and different cyber-attacks like denial of service (DoS), Botnet, Ransom ware, eavesdropping, zero day attack. So, the main concern addressed here is how to detect intrusions into the network using Machine Learning. Machine Learning (ML) plays an important role in designing of intrusion detection systems to detect the anomalies in the network. The ML techniques are very efficient in detection of different types of cyber-attacks. This paper presents the review of different ML techniques in detection of intrusions into IoT networks. Different ML techniques like Random Forest, Neural Network, support vector machine etc. are useful in detection of anomalies in the network. Different datasets like UNSW-NB 15, CICIDS-2017, KDD-99, NSL-KDD, TON_IoT and ECU-IOHT are available which consists of data related to different types of cyber-attacks and are used to form intrusion detection systems. This paper presents the application of different ML algorithms in detection of abnormalities in the network, comparative analysis of different feature selection and machine learning techniques along with challenges and issues present in traditional intrusion detection systems(IDS) in IOT networks.

The rise of the Internet of Things (IoT) has transformed our daily lives by connecting objects to the Internet, thereby creating interactive, automated environments. However, this rapid expansion raises major security concerns, particularly regarding intrusion detection. Traditional intrusion detection systems (IDSs) are often ill-suited to the dynamic and varied networks characteristic of the IoT. Machine learning is emerging as a promising solution to these challenges, offering the intelligence and flexibility needed to counter complex and evolving threats. This comprehensive review explores different machine learning approaches for intrusion detection in IoT systems, covering supervised, unsupervised, and deep learning methods, as well as hybrid models. It assesses their effectiveness, limitations, and practical applications, highlighting the potential of machine learning to enhance the security of IoT systems. In addition, the study examines current industry issues and trends, highlighting the importance of ongoing research to keep pace with the rapidly evolving IoT security ecosystem.

Fog computing extends cloud services to the network edge, enabling low-latency processing for Internet of Things (IoT) applications. However, this distributed approach is vulnerable to a wide range of attacks, necessitating advanced intrusion detection systems (IDSs) that operate under resource constraints. This study proposes integrating self-awareness (online learning and concept drift adaptation) into a lightweight RL (reinforcement learning)-based IDS for fog networks and quantitatively comparing it with non-RL static thresholds and bandit-based approaches in real time. Novel self-aware reinforcement learning (RL) models, the Hierarchical Adaptive Thompson Sampling–Reinforcement Learning (HATS-RL) model, and the Federated Hierarchical Adaptive Thompson Sampling–Reinforcement Learning (F-HATS-RL), were proposed for real-time intrusion detection in a fog network. These self-aware RL policies integrated online uncertainty estimation and concept-drift detection to adapt to evolving attacks. The RL models were benchmarked against the static threshold (ST) model and a widely adopted linear bandit (Linear Upper Confidence Bound/LinUCB). A realistic fog network simulator with heterogeneous nodes and streaming traffic, including multi-type attack bursts and gradual concept drift, was established. The models’ detection performance was compared using metrics including latency, energy consumption, detection accuracy, and the area under the precision–recall curve (AUPR) and the area under the receiver operating characteristic curve (AUROC). Notably, the federated self-aware agent (F-HATS-RL) achieved the best AUROC (0.933) and AUPR (0.857), with a latency of 0.27 ms and the lowest energy consumption of 0.0137 mJ, indicating its ability to detect intrusions in fog networks with minimal energy. The findings suggest that self-aware RL agents can detect traffic–dynamic attack methods and adapt accordingly, resulting in more stable long-term performance. By contrast, a static model’s accuracy degrades under drift.

The increasing occurrence of cyberattacks specifically aimed at critical infrastructure has led to the adoption of network intrusion detection techniques for the Internet of Things (IoT). Securing IoT networks is difficult because of the growing number of connected devices and the advanced methods used by attackers. This study investigates the application of machine learning and neural networks in the prevention of prevalent online fraud and assesses their efficacy. The text discusses important ideas related to email filtering, machine learning, artificial neural networks, and network intrusion techniques. The study discusses the difficulties related to e-fraud detection and suggests methods to improve detection systems. Furthermore, it offers a thorough examination of IoT intrusion detection, emphasizing the risks, weaknesses, assaults, and methods of detection. Securing the billions of autonomous nodes in the Internet of Things (IoT), each with distinct characteristics, poses a significant challenge. Conventional techniques like as encryption, access control, and authentication are inadequate when used individually. Thus, this work utilizes deep learning techniques to detect widespread IoT vulnerabilities, such as Distributed Denial of Service (DDoS) assaults. The models are evaluated using different datasets, including NSL-KDD, DS2OS, and IoT Botnet. The evaluation is based on measures such as accuracy, precision, recall, and F1-score. The deep machine learning intrusion detection system has a high accuracy rate of 96.38%, which shows its efficiency in recognizing risks related to the Internet of Things (IoT) Where the data was trained by 80% and the data was tested by 20.

Scarcely any Intrusion detection systems (IDS) are based on the principle of Machine Learning (ML). Such systems are the potential next-generation tool for enhancing cyber security in networks. These systems can detect zero-day attacks. These attacks are anonymous and unorthodox for researchers and users. Recently, various advanced attacks have been occurring simultaneously with the unprecedented development of the Internet. To detect such attacks, both Machine Learning (ML) and Deep Learning (DL) have been introduced. Therefore, researchers have proposed several methods for detecting any advanced attacks. In this paper, a thorough classification is introduced for algorithms of Machine Learning (ML) and Deep Learning (DL). In addition, the detailed survey will cast light on various methods adopted in detection attacks. All of these methods are based on the principles of DL and ML. Further, many platforms and devices will be introduced both of which are used in executing the methods of the DL and ML and in suggesting security solutions that could be utilized within the field of the Internet of Things (IoT).

A blockchain-enabled Model integrates blockchain technology with Intrusion Detection Systems to enhance the security of Internet of Things (IoT) networks. It ensures data integrity, decentralization, and tamper-proof logging of intrusion detection. The approach improves trust, transparency, and real-time threat detection in distributed IoT environments. The existing blockchain-based IDS approaches, Blockchain Enabled (BCE-IoT), uniquely integrate blockchain consensus with federated-style local training, lightweight cryptography, and Shapley Additive Explanations (SHAP)-based explainability, ensuring both security and interpretability in IoT environments. The proposed work combines Blockchain technology with explainable artificial intelligence solutions to create a new cybersecurity Model that strengthens intrusion detection within IoT networks. The proposed model enhances transparency in tracking cyberattacks by combining blockchain security storage capabilities with SHAP, an explainable AI. This research utilises machine learning and artificial intelligence to detect threats in real-time, countering Distributed Denial of Service (DDoS), Denial of Service (DoS), scanning, Cross-Site Scripting (XSS), injection, password, and backdoor attacks. BCE-IoT delivers more precise security by combining blockchain’s permanent data features and AI anomaly detectors, thereby reducing security alert mistakes. The performance effectiveness of Blockchain-Enabled IoT surpasses that of the Content Integrity Detection System. It combines Blockchain and Software-Defined Networking to enhance security in network environments, utilising blockchain-based mutual confirmation for software-defined networking to detect and block cyber threats. The evaluation establishes BCE-IoT as an effective IoT network security solution that delivers strong cybersecurity features, is adaptable to modern connected environments, and offers interpretable security solutions. The performance evaluations demonstrate that BCE-IoT provides a robust, flexible, and interpretable cybersecurity solution suitable for modern IoT environments.

The Internet of Things (IoT) has been rapidly evolving towards making a greater impact on everyday life to large industrial systems. Unfortunately, this has attracted the attention of cybercriminals who made IoT a target of malicious activities, opening the door to a possible attack to the end nodes. Due to the large number and diverse types of IoT devices, it is a challenging task to protect the IoT infrastructure using a traditional intrusion detection system. To protect IoT devices, a novel ensemble Hybrid Intrusion Detection System (HIDS) is proposed by combining a C5 classifier and One Class Support Vector Machine classifier. HIDS combines the advantages of Signature Intrusion Detection System (SIDS) and Anomaly-based Intrusion Detection System (AIDS). The aim of this framework is to detect both the well-known intrusions and zero-day attacks with high detection accuracy and low false-alarm rates. The proposed HIDS is evaluated using the Bot-IoT dataset, which includes legitimate IoT network traffic and several types of attacks. Experiments show that the proposed hybrid IDS provide higher detection rate and lower false positive rate compared to the SIDS and AIDS techniques.