Comparison on Blockchain-based Intrusion Detection Systems for Internet of Things

Distributed Denial-of-Service (DDoS) attacks are widespread for Internet of Things (IoT) systems that aim to disrupt the availability of a system completely (high-rate DDoS) or partially (low-rate DDoS). Design and placement of intrusion detection systems (IDSs) for DDoS attacks on IoT systems are challenging due to the low power and lossy nature of networks. Existing IDSs are designed to handle either high-rate or low-rate DDoS but cannot handle both with good accuracy. Existing IDS placement techniques are mostly nontransparent, making malicious nodes aware of the presence of IDS nodes. Most of the IDS placement strategies are nonoptimal, making them energy inefficient. Accordingly, this work proposes a transparent, optimally placed, distributed IDS solution, namely, OPTIMIST, which can handle both high-rate and low-rate DDoS attacks with good accuracy. The placement problem is formulated as the weighted minimum vertex cover problem of a <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">${K}$ </tex-math></inline-formula> -uniform hypergraph and solved with an approximation algorithm. The IDS module is based on a long short-term memory (LSTM) model where a novel offline training method for LSTM is proposed using Wasserstein GAN-generated artificial flows. Extensive experimentation on simulation and testbed shows that the OPTIMIST can best achieve the balance between DDoS detection and energy overhead.

The integration of IDS and Internet of Things (IoT) with deep learning plays a significant role in safety. Security has a strong role to play. Application of the IoT network decreases the time complexity and resources. In the traditional intrusion detection systems (IDS), this research work implements the cutting-edge methodologies in the IoT environment. This research is based on analysis, conception, testing and execution. Detection of intrusions can be performed by using the advanced deep learning system and multiagent. The NSL-KDD dataset is used to test the IoT system. The IoT system is used to test the IoT system. In order to detect attacks from intruders of transport layer, efficiency result rely on advanced deep learning idea. In order to increase the system performance, multi -agent algorithms could be employed to train communications agencies and to optimize the feedback training process. Advanced deep learning techniques such as CNN will be researched to boost system performance. The testing part an IoT includes data simulator which will be used to generate in continuous of research work finding with deep learning algorithms of suitable IDS in IoT network environment of current scenario without time complexity.

Destructive cyber-attacks and cybercriminals are increasing with the increase in IoT (Internet of Things) devices globally. This ha/s led to the need for increase in security in IoT systems. Innovative and novel techniques are used by the intruders to accomplish malicious goals effectively through cyber-attacks. An Intrusion Detection System (IDS) is used for classification of attacks in IoT networks based on anomaly detection and machine learning techniques. Inefficiency is observed in the conventional machine learning models and intrusion detection techniques as the network technologies are unpredictable. Accurate identification of various anomalies is possible with deep learning models in several research segments. The input data along with its prominent characteristics may be categorized automatically for classification and anomaly detection using convolutional neural networks (CNN). Faster computations are enabled due to the performance efficiency of CNN. For IoT networks, an intrusion detection model based on anomaly detection is designed and developed in this paper. A multiclass classification framework is created initially using a CNN model. Further, 3D CNN is used for implementation of the proposed model. Various intrusion detection datasets from IoT networks are used for validation of the proposed CNN model. Pre-trained multiclass CNN model is used for implementation of multiclass and binary classification based on transfer learning. When compared to the conventional deep learning models, the proposed multiclass and binary classification framework has attained improved F1 score, recall, precision and accuracy.

The Internet of Things (IoT) has emerged as a crucial expansion of Internet services, linking numerous devices that produce and exchange substantial quantities of data. Strong defense against evolving cyberattacks that jeopardize the confidentiality, integrity, and availability (CIA Triad) of IoT systems is necessary due to this interconnectedness. Therefore, by controlling network activity to stop invasions and identify odd data patterns, intrusion detection systems can offer a robust layer of security for IoT systems. With a focus on identifying less frequent Advanced Persistent Threats (APT), this study aims to detect attacks directed at the CIA Triad. We examined two popular and unbalanced data sets, TON-IoT and BoT-IoT, for anomaly detection in IoT networks. By examining the usefulness of the ensemble learning and deep learning models in anomaly detection inside the IoT network data, we were able to study the security element of the network. The ensemble learning models considered are the following. Random Forest, XGBoost, and Stacking. The considered deep learning models are as follows: BiLSTM, GRU, Autoencoder, and Self-Taught Learning (STL: AE-SVM). The performance metrics studied are as follows: Accuracy, False Alert Rate, Recall, Precision, and F1-score. Regrettably, there were instances in which anomalies could not be detected using conventional techniques. This is because labeled data is scarce, particularly for APT attacks, and attack traffic is frequently sparse and noisy. We suggested a deep self-taught learning system (STL: AE-XGB) based on Transfer Learning to detect anomalies in IoT network data to tackle these difficult issues. To enhance classification performance and capture the changing landscape of attack methods in IoT networks. Our models automatically augment annotated data. The results show that our proposed model (STL: AE-XGB) outperforms the conventional models studied and provides interesting results in binary and multiclass classification.

The proliferating popularity of Internet of Things (IoT) devices has led to wide‐scale networked system implementations across multiple disciplines, including transportation, medicine, smart homes, and many others. This unprecedented level of interconnectivity has introduced new security vulnerabilities and threats. Ensuring security in these IoT settings is crucial for protecting against malicious activities and safeguarding data. Real‐time identification and response to potential intrusions and attacks are essential, and intrusion detection systems (IDS) are pivotal in this process. However, the dynamic and diverse nature of the IoT environment presents significant challenges to existing IDS solutions, which are often based on rule‐based or statistical approaches. Deep learning, a subset of artificial intelligence, has shown great potential to enhance IDS in IoT. Deep learning models can identify complex patterns and characteristics by utilizing artificial neural networks, automatically building hierarchical representations from data. This capability results in more precise and efficient intrusion detection in IoT‐based systems. The primary aim of this survey is to present an extensive overview of the current research on deep learning and IDS in the IoT domain. By examining existing literature, discussing mainstream datasets, and highlighting current challenges and potential prospects, this survey provides valuable insights into the prevailing scenario and future directions for using deep learning in IDS for IoT. The findings from this research aim to enhance intrusion detection techniques in IoT environments and promote the development of more effective antimalware solutions against cyber threats targeting IoT device systems.

Internet of Things (IoT) has been thriving in recent years, playing an important role in a multitude of various domains, including industry 4.0, smart transportation, home automation, and healthcare. As a result, a massive number of IoT devices are deployed to collect data from our surrounding environment and transfer these data to other systems over the Internet. This may lead to cybersecurity threats, such as denial of service attacks, brute‐force attacks, and unauthorized accesses. Unfortunately, many IoT devices lack solid security mechanisms and hardware security supports because of their limitations in computational capability. In addition, the heterogeneity of devices in IoT networks causes nontrivial challenges in detecting security threats. In this article, we present a collaborative intrusion detection system (IDS), namely, MidSiot, deployed at both Internet gateways and IoT local gateways. Our proposed IDS consists of three stages: (1) classifying the type of each IoT device in the IoT network; (2) differentiating between benign and malicious network traffic; and (3) identifying the type of attacks targeting IoT devices. The last two stages are handled by the Internet gateways, whereas the first stage is on the local gateway to leverage the computational resources from edge devices. The evaluation results on three popular IDS datasets (IoTID20, CIC‐IDS‐2017, and BOT‐IoT) indicate our proposal could detect seven common cyberattacks targeting IoT devices with an average accuracy of 99.68% and outperforms state‐of‐the‐art IDSs. This demonstrates that MidSiot could be an effective and practical IDS to protect IoT networks.

Federated Learning (FL, or Collaborative Learning (CL)) has surely gained a reputation for not only building Machine Learning (ML) models that rely on distributed datasets, but also for starting to play a key role in security and privacy solutions to protect sensitive data and information from a variety of ML-related attacks. This made it an ideal choice for emerging networks such as Internet of Things (IoT) systems, especially with its state-of-the-art algorithms that focus on their practical use over IoT networks, despite the presence of resource-constrained devices. However, the heterogeneous nature of the current devices and models in complex IoT networks has seriously hindered the FL training process's ability to perform well. Thus, rendering it almost unsuitable for direct deployment over IoT networks despite ongoing efforts to tackle this issue and overcome this challenging obstacle. As a result, the main characteristics of FL in the IoT from both security and privacy aspects are presented in this study. We broaden our research to investigate and analyze cutting-edge FL algorithms, models, and protocols, with a focus on their efficacy and practical application across IoT networks and systems alike. This is followed by a comparative analysis of the recently available protection solutions for FL that can be based on cryptographic and non-cryptographic solutions over heterogeneous, dynamic IoT networks. Moreover, the proposed work provides a list of suggestions and recommendations that can be applied to enhance the effectiveness of the adoption of FL and to achieve higher robustness against attacks, especially in heterogeneous dynamic IoT networks and in the presence of resource-constrained devices.

Background The growing scale and complexity of Internet of Things (IoT) environments have intensified the need for intelligent and adaptive cybersecurity mechanisms. Artificial intelligence (AI)-based intrusion detection systems (IDS) have emerged as a promising solution for identifying and mitigating threats in real time. Methodology This review systematically evaluates the effectiveness of AI-based IDS in IoT networks, following the Preferred Reporting Items for Systematic Reviews and Meta-Analyses (PRISMA) 2020 guidelines. A comprehensive search of the Scopus and Web of Science databases was conducted, yielding 203 studies, of which 51 met the inclusion criteria. Eligible studies, published between 2016 and 2025, were analyzed for geographic distribution, AI techniques used, methodological quality, and reported outcomes. Meta-regression and contour-enhanced funnel plots were employed to assess effect size trends and publication bias. Results Most studies originated from India, Saudi Arabia, and China, with research output peaking in 2024. Meta-regression analysis revealed a positive correlation between publication year and reported effect size, indicating progressive advancements in AI methodologies. Machine learning (ML) and deep learning (DL) were the most widely used techniques, with a growing trend toward hybrid and ensemble models that enhance threat detection accuracy. Recent studies also showed increased interest in explainable artificial intelligence (XAI), reflecting the demand for transparency and interpretability in model outputs. Funnel plot asymmetry suggested a bias toward publishing positive findings. Conclusions AI-based IDSs have demonstrated substantial potential in strengthening IoT security, particularly through ML, DL, and hybrid approaches. However, inconsistencies in evaluation metrics, reporting standards, and methodological design remain significant challenges. The findings highlight the need for standardized benchmarks and robust frameworks to guide future research and ensure reliable deployment of AI-driven IDS in diverse IoT contexts.

The advancement of Internet of Things (IoT) technologies leads to a wide penetration and large-scale deployment of IoT systems across an entire city or even country. While IoT systems are capable of providing intelligent services, the large amount of data collected and processed in IoT systems also raises serious security concerns. Many research efforts have been devoted to design intelligent network intrusion detection system (NIDS) to prevent misuse of IoT data across smart applications. However, existing approaches may suffer from the issue of limited and imbalanced attack data when training the detection model, which make the system vulnerable especially for those unknown type attacks. In this study, a novel hierarchical adversarial attack (HAA) generation method is introduced to realize the level-aware black-box adversarial attack strategy, targeting the graph neural network (GNN)-based intrusion detection in IoT systems with a limited budget. By constructing a shadow GNN model, an intelligent mechanism based on a saliency map technique is designed to generate adversarial examples by effectively identifying and modifying the critical feature elements with minimal perturbations. A hierarchical node selection algorithm based on random walk with restart (RWR) is developed to select a set of more vulnerable nodes with high attack priority, considering their structural features, and overall loss changes within the targeted IoT network. The proposed HAA generation method is evaluated using the open-source data set UNSW-SOSR2019 with three baseline methods. Comparison results demonstrate its ability in degrading the classification precision by more than 30% in the two state-of-the-art GNN models, GCN and JK-Net, respectively, for NIDS in IoT environments.

The environmental impacts that are associated with the interconnected sensor devices in the Internet of Things (IoT) network are minimized with the utilization of green communication. This is because, when the IoT devices tend to grow, the IoT system becomes more prone to issues regarding the utilization of resources, sustainability, and energy consumption within the communication system. Tuning the communication protocols, lowering the IoT device’s energy usage rate, and establishing an effective technique for the transmission of data are performed. This is achieved by the green communication technique, which aids in the establishment of significant energy savings in the IoT network. For devices with limited power sources, the green communication technology offers an extended battery life. Despite the enormous potential of IoT technology, a number of obstacles need to be overcome, including those related to load balancing, security, storage, privacy, energy management, and device heterogeneity. In response to the challenges posed by conventional models, an innovative solution for the selection of Cluster Head (CH) using a hybrid approach is devised here. The energy consumption of sensor nodes is influenced by various factors, such asCH load, temperature, distance, residual energy, the number of alive nodes, delay, and so on. To address these challenges in IoT networks, a hybrid approach that combines the Squid Game Optimizer (SGO) and the Artificial Gorilla Troops Optimizer (AGTO) for the optimal selection of CH is suggested. The implemented approach is named Hybrid Squid Game with Artificial Gorilla Troops Optimizer (HSG-AGTO). This approach aims to optimize the above-mentioned factors and overcome energy consumption challenges in IoT networks. The effectiveness of the model is validated, and the results demonstrate the superior performance of the suggested model.

The Internet of Things (IoT) represents a paradigm shift in which the Internet is connected to real objects in a range of areas, including home automation, industrial processes, human health, and environmental monitoring. The global market for IoT devices is booming, and it is estimated that there will be 50 billion connected devices by the end of 2025. This explosion of IoT devices, which can be expanded more easily than desktop PCs, has led to an increase in cyber-attacks involving IoT devices. To address this issue, it is necessary to create novel approaches for identifying attacks launched by hacked IoT devices. Due to the possibility that these attacks would succeed, Intrusion Detection Systems (IDS) are required. IDS' feature selection stage is widely regarded as the most essential stage. This stage is extremely time-consuming and labor-intensive. However, numerous machine learning (ML) algorithms have been proposed to enhance this stage to boost an IDS's performance. These approaches, however, did not produce desirable results in terms of accuracy and detection rate (DR). In this paper, we propose a novel hybrid Autoencoder and Modified Particle Swarm Optimization (HAEMPSO) for feature selection and deep neural network (DNN) for classification. The PSO with modification of inertia weight was utilized to optimize the parameters of DNN. The experimental analysis was performed on two realistic UNSW-NB15 and BoT-IoT datasets that are suitable for IoT environment. The findings obtained by analyzing the proposed HAEMPSO against the Generic attack in the UNSW-NB15 dataset gave an accuracy of 98.8%, and a DR of 99.9%. While the benign class revealed an accuracy of 99.9% and DR of 99.7%. In the BoT-IoT dataset, the DDoS HTTP attack revealed an accuracy of 99.22% and DR of 97.79%. While the benign class gave an accuracy of 97.54% and DR of 97.92%. In comparison with the state-of-the-art machine learning schemes, our proposed HAEMPSO-DNN achieved a competitive feat in terms of DR and accuracy.

The Internet of Things (IoT) enables smart settings, which help human pursuits. Although the IoT has increased economic opportunities and made numerous human conveniences possible, it has also made it easier for intruders or attackers to take advantage of the technology by either attacking it or avoiding it. Therefore, the primary concerns for IoT networks are security and privacy. For Internet of Things (IoT) networks, several intrusion detection systems (IDS) have been developed thus far using various optimization techniques methods. But as data dimensionality has increased, the search space has grown significantly, offering difficult problems for optimization techniques like swarm optimization using particles (PSO). To overcome these obstacles, this work suggests an approach for feature selection dubbed enhanced to increase the sticky binary dynamic sticky binary particle swarm optimization's searchability, and particle swarm optimization (IDSBPSO) was developed. It introduced a method for decrease of the dynamic search space and various dynamic parameters (SBPSO). To identify malicious data flow in IoT networks, an IDS was developed using this methodology. The IoTID20 and UNSW-NB15 IoT network datasets were used to assess the proposed model. It was found that, even with less features, IDSBPSO typically attained accuracy that was either higher or comparable. Moreover, as compared to traditional IDSBPSO and PSO-based feature selection methods dramatically reduced computational cost and prediction time.

The size of Internet of Things (IoT) networks is increasing exponentially, and parallelly, the security threats are also escalating. As many of the IoT devices run on limited resources, any intrusion attack based on DoS, packet flooding, man-in-middle and probing is effective to disturb, distract and defunct the networks. A intrusion detection is always a challenging task for the network administrator or any automated software system. A machine learning network-based intrusion detection system (IDS) works efficiently and detects such attacks in any type of networks. It analyzes the packets transmitting over the networks without bothering the IoT devices. Hence, IDS systems are highly crucial and important for IoT network security. This paper proposes a machine learning network-based IDS for securing IoT networks. The proposed technique uses classification techniques to classify a network packet as normal or some kind of malicious attacks. The model was trained with a dataset which is a network logs collected from a network transmitting data from NodeMCU with ESP8266 wi-fi module to a server. The data was captured from the ultrasonic sensor with Arduino and NodeMCU used to monitor a network. For choosing the best detection model out of eight classification based models were studied. The decision tree and random forest are most accurate models as compared to other classification techniques. The comparative analysis of these models is analyzed and discussed in the result section.KeywordsIoTNetwork securityIntrusion detection systemMachine learningAttacks

With the rapid growth of the number of connected devices on the internet, a significant increase in internet and network applications in the last decade led to the appearance of function-based networks called the Internet of Things (IoT). Such interest and dependency come with exponentially increasing security threats. Those threats are very dynamic, and change continuously despite the fact that IoT devices may not go through the same speed for security fixes, updates, etc. As a result, research trends focus on utilizing data analytics to build intelligence and autonomous mechanisms to enable IoT systems to respond to threats in real time. To this end, our project goal is to evaluate methods to build fast and efficient intrusion detection systems (IDS) that meet the high scalability and dynamicity of IoT environments.In this research, we studied three different datasets used to represent IoT network traffic and used them as a benchmark to evaluate many IDSs’ performances. Results showed that features’ quality has an impact on classification models and thus IDS performance. Our results showed also that the optimum time-window of an IDS preferred to be long (decay factor 0.01 or 0.1) when evaluating the BotNet_IoT dataset.

The Internet of Things (IoT) is a fast-expanding network of smart heterogeneous objects. It refers to the physical devices that are capable of communicating with other physical devices. Unlike the wireless sensor networks (WSNs), IoT is connected to worldwide Internet that exposes it to global intrusion in addition to wireless attacks inside an IoT network. It is protected by cryptographic and network security techniques, but they are vulnerable to internal and external attacks. The IoT devices are resource constrained in terms of limited storage, battery, limited transmission range and processing. To protect these tiny devices from the inside and outside cyberattacks, we need a lightweight security system that can run efficiently and effectively on these IoT devices. We also need a system, which can identify the type of intrusion and trigger an alarm in intrusion scenario to take appropriate preventive measure. Hence, an Intrusion Detection System (IDS) plays an important role to prevent such cyberattacks in IoT. These devices can be static or mobile in an IoT environment; this must be considered while designing IDS for IoT system. This book chapter presents various IDSs for an IoT system and their comparisons in terms of detection rate, false positive and accuracy in both static and mobility of devices.