Experimental Analysis of Classification for Different Internet of Things (IoT) Network Attacks Using Machine Learning and Deep learning

With the increasing popularity of the Internet of Things (IoT) platforms, the cyber security of these platforms is a highly active area of research. One key technology underpinning smart IoT systems is machine learning, which classifies and predicts events from large-scale data in IoT networks. Machine learning is susceptible to cyber attacks, particularly data poisoning attacks that inject false data when training machine learning models. Data poisoning attacks degrade the performances of machine learning models. It is an ongoing research challenge to develop trustworthy machine learning models resilient and sustainable against data poisoning attacks in IoT networks. We studied the effects of data poisoning attacks on machine learning models, including the gradient boosting machine, random forest, naive Bayes, and feed-forward deep learning, to determine the levels to which the models should be trusted and said to be reliable in real-world IoT settings. In the training phase, a label modification function is developed to manipulate legitimate input classes. The function is employed at data poisoning rates of 5%, 10%, 20%, and 30% that allow the comparison of the poisoned models and display their performance degradations. The machine learning models have been evaluated using the ToN_IoT and UNSW NB-15 datasets, as they include a wide variety of recent legitimate and attack vectors. The experimental results revealed that the models’ performances will be degraded, in terms of accuracy and detection rates, if the number of the trained normal observations is not significantly larger than the poisoned data. At the rate of data poisoning of 30% or greater on input data, machine learning performances are significantly degraded.

Smart objects have grown in popularity and acceptance over the past period due to their decreasing size, greater intelligence, and lower costs. The Internet of Things (IoT) connects physical devices, including actuators, sensors, and cameras, to a network via the Internet. The widespread use of IoT devices has led to an exponential rise in network traffic volume and complexity, creating new challenges for real-time network security and threat detection. This study attempts to design an intrusion detection system which is scalable and capable of handling the vast number and variety of IoT traffic. It is based on improving the scalability and precision of the detection of threats by employing machine learning (ML) and deep learning (DL) techniques and hybrid model. The model is trained and tested on the CIC IoT DIAD 2024 dataset, a large high-volume dataset consisting of diversified IoT traffic, benign and malicious activity. It includes extensive data preprocessing, feature selection, and training of various models. Features were selected using an Analysis of Variance (ANOVA)–based feature selection technique to reduce computational overhead and time complexity while mitigating the curse of dimensionality and enhancing model accuracy. The resulting optimal feature subset was then used to train and evaluate several classifiers, including Decision Trees, K-Nearest Neighbors (KNN), Convolutional Neural Networks (CNN), Long Short-Term Memory (LSTM) networks, and a hybrid CNN–LSTM model. The models are compared using typical measures of performance such as accuracy, precision, recall, F1-score, and confusion matrix. The results indicate that hybrid deep learning models specifically the CNN-LSTM outperformed the other models in recognizing binary attacks achieving the highest performance with accuracy of 94.08% followed by CNN and LSTM with accuracies of 93.37% and 93.24% respectively. In contrast, the traditional machine learning model, Decision trees demonstrated superior performance in multi-class classification, achieving an accuracy of 98.25% defeating KNN (90%) as well as the hybrid deep learning model (CNN-LSTM – 88.30%). This, work paves the foundation for the implementation of scalable intrusion detection models in real IoT infrastructures. The future of the work is to integrate the developed models using massive data streaming infrastructures in support of real-time intrusion detection in large-scale, dynamic IoT infrastructures.

In the Internet of Things (IoT) technology, there are several issues to overcome, including network security. New attacks have been developed to target vulnerabilities in IoT devices, and the Internet of Things on a huge scale will exacerbate present network threats. Machine learning is becoming increasingly used in applications such as traffic classification and intrusion detection. This paper offers a technique for detecting network fault severity and identifying Internet of Things (IoT) devices based on several attributes. By pushing information to the network area, the proposed framework captures different features from each network flow in order to identify the source of traffic and the type of traffic generated is used to detect different network attacks. Different machine learning algorithms are tested to find the better suited algorithm that deliver best results. The following are some of the examples: Random Forest (RF) algorithm, decision tree, SVM, etc. After completing the experimentation, it was found that the random forest classifier and decision tree are the best performing ML algorithms to classify the network severity with an accuracy of about 96.98% and GNB is found as the least performing machine learning model with an accuracy of about 54.41%.

RETRACTED: Detection of attacks in IoT sensors networks using machine learning algorithm

The Internet of Things (IoT) has transformed various sectors by enabling connectivity and automation through smart devices. However, the expansion of IoT networks has introduced new security challenges, particularly concerning the detection and prevention of cyber threats. This study explores the application of machine learning (ML) models for enhancing network security in IoT-enabled smart systems. The primary objective was to evaluate the performance of different ML algorithms, including Convolutional Neural Networks (CNN), Random Forest (RF), Support Vector Machine (SVM), Decision Tree (DT), K-Means, and Autoencoder, in detecting and mitigating security threats in IoT environments. The study also aimed to identify the most effective model in terms of accuracy, precision, recall, and F1-score. The research methodology involved training and testing these models on publicly available IoT security datasets, followed by performance evaluation based on the key metrics. Statistical analysis, including One-Way ANOVA and post-hoc testing, was used to assess the significance of the performance differences across the models. The results revealed that CNN outperformed all other models, achieving the highest accuracy (96.7%), precision (95.8%), recall (97.2%), and F1-score (96.5%). Random Forest also demonstrated strong performance with an accuracy of 95.6% and a balanced evaluation across all metrics. In contrast, traditional models like SVM and DT showed comparatively lower performance, while Autoencoder struggled with classification tasks, particularly in real-time threat detection. Statistical analysis confirmed the significant differences in model performance. In conclusion, the study demonstrates the effectiveness of deep learning and ensemble models, particularly CNN and Random Forest, in enhancing IoT network security. The research highlights the importance of selecting the appropriate ML model based on the specific requirements of the IoT environment and computational constraints, and suggests that hybrid models and model optimization strategies may offer promising solutions for resource-constrained IoT systems.

The market for Electric Vehicles (EVs) has expanded tremendously as seen in the recent Conference of the Parties 27 (COP27) held at Sharm El Sheikh, Egypt in November 2022. This needs the creation of an ecosystem that is user-friendly and secure. Internet-connected Electric Vehicle Charging Stations (EVCSs) provide a rich user experience and add-on services. Eventually, the EVCSs are connected to a management system, which is the Electric Vehicle Charging Station Management System (EVCSMS). Attacking the EVCS ecosystem remotely via cyberattacks is rising at the same rate as physical attacks and vandalism happening on the physical EVCSs. The cyberattack is more severe than the physical attack as it may affect thousands of EVCSs at the same time. Intrusion Detection is vital in defending against diverse types of attacks and unauthorized activities. Fundamentally, the Intrusion Detection System’s (IDS) problem is a classification problem. The IDS tries to determine if each traffic stream is legitimate or malicious, that is, binary classification. Furthermore, the IDS can identify the type of malicious traffic, which is called multiclass classification. In this paper, we address IoT security issues in EVCS by using different machine learning techniques and using the native IoT dataset to discover fraudulent traffic in EVCSs, which has not been performed in any previous research. We also compare different machine learning classifier algorithms for detecting Distributed Denial of Service (DDoS) attacks in the EVCS network environment. A typical Internet of Things (IoT) dataset obtained from actual IoT traffic is used in the paper. We compare classification algorithms that are placed in line with the traffic and contain DDoS attacks targeting the EVCS network. The results obtained from this research improve the stability of the EVCS system and significantly reduce the number of cyberattacks that could disrupt the daily life activities associated with the EVCS ecosystem.

This study presents the development of a realistic and comprehensive SDN-ATK dataset designed to evaluate the effectiveness of machine learning (ML) and deep learning (DL) approaches for attack detection in Software-Defined Networking (SDN) environments. Unlike existing datasets, SDN-ATK explicitly includes attacks targeting key SDN components such as SDN controllers and OpenFlow switches, addressing a critical gap in current research. We evaluated three ML (XGBoost, Random Forest, and Decision Tree) and three DL (Convolutional Neural Network (CNN), Feed-forward Neural Network (FNN), and Long Short-Term Memory (LSTM)) algorithms across binary and multiclass classification tasks to assess detection performance. Our results demonstrate that DL models, particularly FNN and CNN outperform ML counterparts, achieving 98–99% accuracy, precision, and recall in binary classification. Explainability analyses were conducted using SHAP (SHapley Additive explanations) on the XGBoost model, offering valuable insights into the importance of feature and improving transparency in ML-based attack detection. The study’s findings provide critical guidance for both academia and industry, highlighting that within our Ryu-based SDN testbed, DL models demonstrated more reliable and balanced performance for large-scale attack detection. This work lays a solid foundation for future research, including developing real-time, intelligent, and explainable intrusion detection systems for SDN environments.

This paper examines the enhancement of security measures for the Internet of Things (IoT) systems through the application of Machine Learning (ML) techniques. As the number of IoT devices continues to rise, ensuring their security has become increasingly critical, given that conventional methods frequently struggle to identify advanced threats. This study explores the implementation of several ML algorithms, including Random Forest (RF), Decision Trees (DT), Support Vector Machines (SVM), and Convolutional Neural Networks (CNN), to identify anomalies and intrusions within IoT networks. By conducting a comprehensive review of existing research and experiments, it highlights the effectiveness of ML in enhancing IoT security, with high detection rates for various threats, including botnet attacks, Denial-of-Service (DoS) and Distributed Denial-of-Service (DDoS) incidents, and intrusion attempts. DoS/DDoS attacks and many types of botnets are the most devastating attacks that have been spreading for a long time, and they are still branching out in new ways against IoT networks. They can damage IoT services and prevent these services from being used by legitimate users. Therefore, securing IoT networks becomes a significant concern. The proposed model is used to increasingly monitor network traffic for any deviations from standard patterns IoT networks. This paper also stresses the necessity of utilising suitable datasets and feature selection techniques to enhance the efficacy of ML models. To train our model, we have utilized a dataset called the IoT23 dataset, which is one of the most recent datasets that has many IoT scenarios and anomalous activities. Further-more, we utilised two types of feature selection algorithms, the Correlation-based Feature Selection (CFS) algorithm and the Genetic Algorithm (GA), and then we compared the results of these algorithms when training our model. The best performances were obtained with DT and RF classifiers when they were trained with features selected by CFS However, for training and testing times metrics, DT performance was superior across both feature selection methods.

The Internet of Things (IoT) is reshaping our connected world as the number of lightweight devices connected to the Internet is rapidly growing. Therefore, high-quality research on intrusion detection in the IoT domain is essential. To this end, network intrusion data sets are fundamental, as many attack detection strategies have to be trained and evaluated using such data sets. In this article, we introduce the description, statistical analysis, and machine learning evaluation of the novel ToN_IoT data set. A comparison to other recent IoT data sets shows the importance of heterogeneity within these data sets, and how differences between data sets may have a huge impact on detection performance. In a cross-training experiment, we show that the inclusion of different data collection methods and a large diversity of the monitored features are of crucial importance for IoT network intrusion data sets to be useful for the industry. We also explain that the practical application of IoT data sets in operational environments requires the standardization of feature descriptions and cyberattack classes. This can only be achieved with a joint effort from the research community.

Detecting irregularities in Internet of Things (IoT) systems is essential due to the increasing dangers associated with cyber threats and irregular device behaviour. Current models frequently inadequately detect complex behavioural anomalies and struggle to adjust to evolving IoT contexts. The suggested study introduces an innovative hybrid model that integrates K-Means clustering with Random Forest classification for efficient behavioural pattern recognition and anomaly detection. K-Means facilitates the unsupervised clustering of device activity profiles derived from extracted characteristics, while Random Forest offers a strong and interpretable classification method for identifying abnormalities within clustered patterns. This hybrid method, compared to standard models, harmonises interpretability, accuracy, and scalability. The system was analysed utilising publicly available IoT datasets, demonstrating exceptional performance across all principal metrics: Accuracy (0.981), Precision (0.978), Recall (0.984), F1-Score (0.981), and AUC-ROC (0.992). The comparative investigation explains that the model outperforms baseline techniques including SVM, Isolation Forest, and Logistic Regression. The results confirm the efficiency of integrating behavioural pattern clustering with ensemble learning in anomaly detection tasks. This method provides practical applications for safeguarding real-time IoT implementations in smart homes, healthcare systems, and industrial control settings, while also establishing a foundation for future integration with deep learning and adaptive anomaly response strategies.

The Internet of Things (IoT) has emerged as a crucial expansion of Internet services, linking numerous devices that produce and exchange substantial quantities of data. Strong defense against evolving cyberattacks that jeopardize the confidentiality, integrity, and availability (CIA Triad) of IoT systems is necessary due to this interconnectedness. Therefore, by controlling network activity to stop invasions and identify odd data patterns, intrusion detection systems can offer a robust layer of security for IoT systems. With a focus on identifying less frequent Advanced Persistent Threats (APT), this study aims to detect attacks directed at the CIA Triad. We examined two popular and unbalanced data sets, TON-IoT and BoT-IoT, for anomaly detection in IoT networks. By examining the usefulness of the ensemble learning and deep learning models in anomaly detection inside the IoT network data, we were able to study the security element of the network. The ensemble learning models considered are the following. Random Forest, XGBoost, and Stacking. The considered deep learning models are as follows: BiLSTM, GRU, Autoencoder, and Self-Taught Learning (STL: AE-SVM). The performance metrics studied are as follows: Accuracy, False Alert Rate, Recall, Precision, and F1-score. Regrettably, there were instances in which anomalies could not be detected using conventional techniques. This is because labeled data is scarce, particularly for APT attacks, and attack traffic is frequently sparse and noisy. We suggested a deep self-taught learning system (STL: AE-XGB) based on Transfer Learning to detect anomalies in IoT network data to tackle these difficult issues. To enhance classification performance and capture the changing landscape of attack methods in IoT networks. Our models automatically augment annotated data. The results show that our proposed model (STL: AE-XGB) outperforms the conventional models studied and provides interesting results in binary and multiclass classification.

The proliferation of Internet of Things (IoT) devices has created unprecedented cybersecurity vulnerabilities, with botnets emerging as a critical threat to network infrastructure. This study focuses on traditional machine learning and deep learning approaches, proposes a novel ensemble framework to address these issues, integrating Convolutional Neural Network (CNN), Bidirectional Long Short-Term Memory (BiLSTM), Random Forest (RF), and Logistic Regression (LR) via a weighted soft-voting mechanism. Our approach introduces a Quantile Uniform transformation to reduce feature skewness, a multi-layered feature selection method to enhance discriminative power, an individual performance of deep learning-traditional machine learning and a hybrid models (ensemble models) for robust detection. Evaluated on BOT-IOT, CICIOT2023, and IOT23 datasets, the framework achieves 100% accuracy on BOT-IOT, 99.2% on CICIOT2023, and 91.5% on IOT23, outperforming state-of-the-art models by up to 6.2%. These contributions advance IoT security by enabling scalable, high-performance detection adaptable to diverse network scenarios, with practical optimizations for real-world deployment.

Monitoring water quality metrics of ponds with IoT sensors and machine learning to predict fish species survival

Recently, the Internet of Things (IoT) has been used in various applications such as manufacturing, transportation, agriculture, and healthcare that can enhance efficiency and productivity via an intelligent management console remotely. With the increased use of Industrial IoT (IIoT) applications, the risk of brutal cyber-attacks also increased. This leads researchers worldwide to work on developing effective Intrusion Detection Systems (IDS) for IoT infrastructure against any malicious activities. Therefore, this paper provides effective IDS to detect and classify unpredicted and unpredictable severe attacks in contradiction to the IoT infrastructure. A comprehensive evaluation examined on a new available benchmark TON_IoT dataset is introduced. The data-driven IoT/IIoT dataset incorporates a label feature indicating classes of normal and attack-targeting IoT/IIoT applications. Correspondingly, this data involves IoT/IIoT services-based telemetry data that involves operating systems logs and IoT-based traffic networks collected from a realistic medium-scale IoT network. This is to classify and recognize the intrusion activity and provide the intrusion detection objectives in IoT environments in an efficient fashion. Therefore, several machine learning algorithms such as Logistic Regression (LR), Linear Discriminant Analysis (LDA), K-Nearest Neighbors (KNN), Gaussian Naive Bayes (NB), Classification and Regression Tree (CART), Random Forest (RF), and AdaBoost (AB) are used for the detection intent on thirteen different intrusion datasets. Several performance metrics like accuracy, precision, recall, and F1-score are used to estimate the proposed framework. The experimental results show that the CART surpasses the other algorithms with the highest accuracy values like 0.97, 1.00, 0.99, 0.99, 1.00, 1.00, and 1.00 for effectively detecting the intrusion activities on the IoT/IIoT infrastructure on most of the employed datasets. In addition, the proposed work accomplishes high performance compared to other recent related works in terms of different security and detection evaluation parameters.

The paradigm of computing has completely altered as a result of the development of communication and Information technology. The Internet of Things (IoT) is a type of communication environment made up of web-enabled devices that can communicate, gather, assess, and send data across the network without the need for human participation. The IoT idea is widely established in numerous fields of application, and it has also been used in the medical industry. The Internet of Medical Things (IoMT) refers to the combination of IoT with medical technology. Even though IoMT applications have facilitated real time monitoring in the healthcare sector, it suffers from several security and privacy attacks. The presence of such security and privacy attacks can cause the alteration or disclosure of sensitive data or sometimes authorized users cannot access the data also. Hence, it is crucial to secure the IoMT environment from such malicious attacks. Therefore, this study aims in assessing harmful traffic in IoMT environment. In this research, XGBoost classification algorithm is proposed to classify malicious traffic in an IoMT environment. Further, the study has also implemented state-of-art machine learning algorithms such as DT (Decision Tree), RF (Random Forest), LR (Logistic Regression), SVM (Support Vector Machine), NB (Naive Bayes), MLP (Multilayer Perceptron), SGD (Stochastic Gradient Descent) to test the efficacy of the proposed model. The experimental outcomes indicate that the proposed XGBoost algorithm outperformed other conventional machine learning approaches in terms of predicting malicious traffic in an IoMT environment, with a 100-percentage accuracy rate. Furthermore, the XGBoost algorithm exhibits better performance in terms of precision, Fl-score, recall, and AUC as compared with traditional approaches.