Multi-objective PSO based feature selection for intrusion detection in IoT based wireless sensor networks

The Internet of Things (IoT) has become an integral part of everyday life, and plays a significant role in various sectors by enabling device-to-device communication without human intervention. However, the constant connectivity of these devices to the Internet exposes them to numerous cyberattacks, potentially leading to data breaches, device malfunctions, and unauthorized network access. The diverse range of threats targeting IoT systems highlights the need for robust security solutions, such as machine learning-based intrusion detection systems, which have attracted growing research interest. This study proposes a novel adaptive approach for intrusion detection in IoT environments by combining batch and incremental learning models. Our work overcomes the limitations of traditional machine learning-based intrusion detection methods, emphasizing the potential of incremental learning to develop more effective and resilient solutions. Unlike most existing approaches that rely solely on batch learning and lack adaptability to integrate new data for long-term security, our method offers a more flexible alternative. Specifically, we leverage the predictive power of LightGBM in batch mode to improve the performance of a Passive-Aggressive classifier as a meta-learner in incremental mode. This dual learning approach aims to enhance intrusion detection in two key ways: effectively capturing diverse attack patterns with batch learning and adapting to emerging attack patterns with incremental learning. Experiments conducted on the CICIoT2023 dataset demonstrate that the proposed approach successfully balances performance and adaptability. It maintains accurate detection capabilities across various classification tasks while remaining responsive to evolving attack patterns.

Internet of things (IoT) is penetrating into every aspect of our lives including our body, our home and our living environment along with numerous security challenges. With rapidly growing number of connected devices in IoT, the scope for cyber-attack also increases exponentially. Therefore an effective intrusion detection system (IDS) is needed to efficiently detect the attack at faster rate in highly scalable and dynamic IoT environment. In this paper, a novel intrusion detection technique is proposed based on fog computing using Online Sequential Extreme Learning Machine (OS-ELM) which can intelligently interpret the attacks from the IoT traffic. In the proposed system, the existing centralized cloud intelligence in detecting the attack is distributed to local fog nodes to detect the attack at faster rate for IoT application. The distributed architecture of fog computing enables distributed intrusion detection mechanism with scalability, flexibility and interoperability. The analysis of the proposed system proves to be efficient in terms of response time and detection accuracy.

Recent advances in Internet of Things (IoT) technologies require a new type of IoT security environment. Various heterogeneous smart devices have easy access to IoT environment, and as the number of users increases, they are exposed to various threats such as malicious attacks on IoT devices and IoT infrastructure, and data tampering by malicious code. Malware detection in IoT requires data and models for continuous and changing learning of smart devices. Methods/Statistical analysis: To minimize these security threats, various malware detection techniques in the field of IoT security have been studied. Malware detection in IoT environment is important for data derivation and learning model required for continuous and changing learning of smart devices. The metadata of malware detection can be normalized by the value of device id, time, behavior, location and state. This paper proposes behavior-based malware detection using deep learning (BMD-DL). Findings: BMD-DL was able to collect metadata about behavior-based malicious behavior and learn and detect malicious codes through deep learning. In addition, through the learned model, IoT Security is provided by disconnecting malicious devices that cause malicious behavior in the IoT environment. Improvements/Applications: BMD-DL collects behavioral data generated from multiple devices in the IoT and applies the results learned through deep learning to detect persistent malware.

Intrusion detection is a crucial aspect of maintaining the security of computer network devices.With the advancement of Internet of Things (IoT) technology, the need for intrusion detection has become even more critical due to the many IoT devices that remain inadequately protected due to resource constraints.Although various intrusion detection methods have been developed, many of them have not been optimized to address the resource limitations of IoT devices, such as limited computational capacity and low power consumption.Furthermore, existing feature selection methods often overlook the potential of combining various selection techniques to enhance accuracy and efficiency.This research introduces a novel intrusion detection framework that integrates multiple feature selection algorithms-Pearson Correlation, Spearman Correlation, and Mutual Information-during the pre-processing phase, aiming to reduce data complexity and improve classification accuracy.Unlike prior approaches that apply singlemethod feature selection, our method combines these techniques to capture both linear and non-linear dependencies, ensuring that only the most relevant features are retained.When evaluated on the UNSW-NB15 dataset, the proposed Deep Feedforward Neural Network (DFNN) classifier achieved an accuracy of 89.23%, outperforming other models in terms of accuracy and training efficiency.These improvements make the model better suited for real-world IoT environments with computational limitations.

The proliferating popularity of Internet of Things (IoT) devices has led to wide‐scale networked system implementations across multiple disciplines, including transportation, medicine, smart homes, and many others. This unprecedented level of interconnectivity has introduced new security vulnerabilities and threats. Ensuring security in these IoT settings is crucial for protecting against malicious activities and safeguarding data. Real‐time identification and response to potential intrusions and attacks are essential, and intrusion detection systems (IDS) are pivotal in this process. However, the dynamic and diverse nature of the IoT environment presents significant challenges to existing IDS solutions, which are often based on rule‐based or statistical approaches. Deep learning, a subset of artificial intelligence, has shown great potential to enhance IDS in IoT. Deep learning models can identify complex patterns and characteristics by utilizing artificial neural networks, automatically building hierarchical representations from data. This capability results in more precise and efficient intrusion detection in IoT‐based systems. The primary aim of this survey is to present an extensive overview of the current research on deep learning and IDS in the IoT domain. By examining existing literature, discussing mainstream datasets, and highlighting current challenges and potential prospects, this survey provides valuable insights into the prevailing scenario and future directions for using deep learning in IDS for IoT. The findings from this research aim to enhance intrusion detection techniques in IoT environments and promote the development of more effective antimalware solutions against cyber threats targeting IoT device systems.

The proliferation of Internet of Things (IoT) devices continues to expand the network attack surface while introducing stringent privacy requirements that challenge effective intrusion detection. Federated learning enables collaborative model training without centralizing raw network telemetry. However, existing federated intrusion detection approaches often degrade under statistical heterogeneity and remain vulnerable to zero-day attacks when they rely on labeled data or reconstruction-based objectives. This work proposes Fed-DTCN (Federated Dual Temporal Contrastive Network), an unsupervised federated framework for zero-day anomaly detection in IoT environments. Fed-DTCN learns robust representations of benign IoT traffic using contrastive learning with semantic-preserving augmentations. A dual-encoder architecture disentangles globally shared features from client-specific patterns, improving generalization under heterogeneous federated deployments. Personalization and privacy are preserved by selectively aggregating only the shared encoder parameters. The framework employs a compact temporal convolutional backbone together with a soft-weighted contrastive objective to constrain benign representations, thereby enabling reliable detection of out-of-distribution threats. Extensive experiments on the TON_IoT and CSE-CIC-IDS2018 benchmarks show that Fed-DTCN matches or surpasses a state-of-the-art supervised baseline on standard attacks, achieving an F1-score of 99.99% on TON_IoT. In a zero-day evaluation where the Botnet class is withheld during training, Fed-DTCN attains an F1-score of 96%, compared to 0.52% for the supervised baseline. Ablation studies validate the effectiveness of the proposed augmentations, while evaluations under heterogeneous client partitions demonstrate reduced inter-client variance and consistent per-client improvements, indicating suitability for realistic IoT deployments.

In view of most existing intrusion detection technologies that cannot meet the actual needs of the Internet of Things and facing the problems of poor detection effect of complex network intrusion methods, a network intrusion detection method based on deep learning algorithm in the environment of the Internet of Things is proposed. Firstly, the Internet of Things intrusion detection model is constructed based on edge computing, in which the concept of gated convolution is introduced to improve the convolution neural network model. Data passes through convolution layer, pooling, dropout, full connection, and Softmax function to realize multiclassification. Finally, the Focal Loss function is used to modulate the training ratio of positive and negative samples to solve the problem of uneven distribution of sample data. The proposed algorithm is demonstrated experimentally based on KDD99 data set. The results show that the accuracy, precision, recall, and F1 values are 92.14%, 95.97%, 90.89%, and 90.03%, which are better than other comparison algorithms. The proposed method can better meet the needs of Internet of Things intrusion detection.

The economic growth and information technology leads to the development of Internet of Things (IoT) industry and has become the emerging field of research. Several intrusion detection techniques are introduced but the detection of intrusion and malicious activities poses a challenging task. This paper devises a novel method, namely the Water Moth Search algorithm (WMSA) algorithm, for training Deep Recurrent Neural Network (Deep RNN) to detect malicious network activities. The WMSA algorithm is newly devised by combining Water Wave optimization (WWO) and the Moth Search Optimization (MSO). The pre-processing is employed for the removal of redundant data. Then, the feature selection is devised using the Wrapper approach, then using the selected features; the Deep RNN classifier effectively detects the intrusion using the selected features. The proposed WMSA-based Deep RNN showed improved results with maximal accuracy, specificity, and sensitivity of 0.96, 0.973 and 0.960.

This research introduces a comprehensive collaborative intrusion detection system (CIDS) framework aimed at bolstering the security of Internet of Things (IoT) environments by synergistically integrating lightweight architecture, trust management, and privacy-preserving mechanisms. The proposed hierarchical architecture spans edge, fog, and cloud layers, ensuring efficient and scalable collaborative intrusion detection. Trustworthiness is established through the incorporation of distributed ledger technology (DLT), leveraging blockchain frameworks to enhance the reliability and transparency of communication among IoT devices. Furthermore, the research adopts federated learning (FL) techniques to address privacy concerns, allowing devices to collaboratively learn from decentralized data sources while preserving individual data privacy. Validation of the proposed approach is conducted using the CICIoT2023 dataset, demonstrating its effectiveness in enhancing the security posture of IoT ecosystems. This research contributes to the advancement of secure and resilient IoT infrastructures, addressing the imperative need for lightweight, trust-managing, and privacy-preserving solutions in the face of evolving cybersecurity challenges. According to our experiments, the proposed model achieved an average accuracy of 97.65%, precision of 97.65%, recall of 100%, and F1-score of 98.81% when detecting various attacks on IoT systems with heterogeneous devices and networks. The system is a lightweight system when compared with traditional intrusion detection that uses centralized learning in terms of network latency and memory consumption. The proposed system shows trust and can keep private data in an IoT environment.

To classify sensor data correctly and quickly has a very sound impact on areas such as performance monitoring, user behavior analysis, and user accounting and intrusion detection in IoT (Internet of things). This work is an approach to reorganize the features in a dataset of 114 features depending on the relevancy and non-redundancy of an attribute or feature. Thus having a minimal set of 30 features can create a linear SVM classifier model to detect TCP attack in IoT botnet attack traffic.KeywordsFeature selectionIoTBotnetTCPSVM

The Internet of Things (IoT) represents a paradigm shift in which the Internet is connected to real objects in a range of areas, including home automation, industrial processes, human health, and environmental monitoring. The global market for IoT devices is booming, and it is estimated that there will be 50 billion connected devices by the end of 2025. This explosion of IoT devices, which can be expanded more easily than desktop PCs, has led to an increase in cyber-attacks involving IoT devices. To address this issue, it is necessary to create novel approaches for identifying attacks launched by hacked IoT devices. Due to the possibility that these attacks would succeed, Intrusion Detection Systems (IDS) are required. IDS' feature selection stage is widely regarded as the most essential stage. This stage is extremely time-consuming and labor-intensive. However, numerous machine learning (ML) algorithms have been proposed to enhance this stage to boost an IDS's performance. These approaches, however, did not produce desirable results in terms of accuracy and detection rate (DR). In this paper, we propose a novel hybrid Autoencoder and Modified Particle Swarm Optimization (HAEMPSO) for feature selection and deep neural network (DNN) for classification. The PSO with modification of inertia weight was utilized to optimize the parameters of DNN. The experimental analysis was performed on two realistic UNSW-NB15 and BoT-IoT datasets that are suitable for IoT environment. The findings obtained by analyzing the proposed HAEMPSO against the Generic attack in the UNSW-NB15 dataset gave an accuracy of 98.8%, and a DR of 99.9%. While the benign class revealed an accuracy of 99.9% and DR of 99.7%. In the BoT-IoT dataset, the DDoS HTTP attack revealed an accuracy of 99.22% and DR of 97.79%. While the benign class gave an accuracy of 97.54% and DR of 97.92%. In comparison with the state-of-the-art machine learning schemes, our proposed HAEMPSO-DNN achieved a competitive feat in terms of DR and accuracy.

The rapid development of Internet of Things (IoT) networks has significantly increased their vulnerability to cyberattacks, so it is essential to develop effective Intrusion Detection Systems (IDS). Traditional algorithms often struggle with a high false positive rate and scalability issues in dynamic IoT environments. For addressing these challenges, this article proposed Optimized Cascading Long Short-Term Memory with Latin Sampling Satin Bowerbird Optimization (OCLSTM-LSBO) algorithm to effectively identify intrusions. The deep cascading LSTM framework captures the deep temporal dependencies in network traffic and improves the identification of difficult intrusion patterns in IoT networks. Then, employed the LSBO algorithm to fine-tune the hyperparameters of the LSTM model, which improves classification accuracy and enhances the generalization ability of the model. In the pre-processing phase, the Min-Max normalization technique is used to normalise the features in a uniform range. The OCLSTM-LSBO algorithm obtained the highest accuracy of 98.97% using the CICIoT2023 dataset and 95.62% using ToNIoT dataset for multiclass classification when compared to existing algorithms like Federated Multi Layered Deep-Learning (Fed-MLDL).

In the face of constantly changing cyber threats, a variety of actions, tools, and regulations must be considered to safeguard information assets and guarantee the confidentiality, reliability, and availability of digital resources. The purpose of this research is to create an artificial intelligence (AI)-driven system to enhance sustainability for cyber threat detection in Internet of Things (IoT) environments. This study proposes a modern technique named Artificial Fish Swarm-driven Weight-normalized Adaboost (AF-WAdaBoost) for optimizing accuracy and sustainability in identifying attacks, thus contributing to heightening security in IoT environments. CICIDS2017, NSL-KDD, and UNSW-NB15 were used in this study. Min-max normalization is employed to pre-process the obtained raw information. The proposed model AF-WAdaBoost dynamically adjusts classifiers, enhancing accuracy and resilience against evolving threats. Python is used for model implementation. The effectiveness of the suggested AF-WAdaBoost model in identifying different kinds of cyber-threats in IoT systems is examined through evaluation metrics like accuracy (98.69%), F-measure (94.86%), and precision (95.72%). The experimental results unequivocally demonstrate that the recommended model performed better than other traditional approaches, showing essential enhancements in accuracy and strength, particularly in a dynamic environment. Integrating AI-driven detection balances offers sustainability in cybersecurity, ensuring the confidentiality, reliability, and availability of information assets, and also helps in optimizing the accuracy of systems.

The internet of things (IoT) greatly impacts daily life by enabling efficient data exchange between objects and servers. However, cyber-attacks pose a serious threat to IoT devices. Intrusion detection systems (IDS) are vital for safeguarding networks, and machine learning methods are increasingly used to enhance security. Continuous improvement in accuracy and performance is crucial for effective IoT security. Deep learning not only outshines traditional machine learning methods but also holds untapped potential in fortifying IDS systems. This paper introduces an innovative deep learning framework tailored for anomaly detection within IoT networks, leveraging bidirectional long short-term memory (BiLSTM) and gated recurrent unit (GRU) architectures. The hyper parameters of the proposed model are optimized using the JAYA optimization technique. These models are validated using IoT-23 and MQTTset datasets. Several performance metrics including accuracy, precision, recall, f-score, true negative rate (TNR), false positive rate (FPR), and false negative rate (FNR), have been selected to assess the effectiveness of the suggested model. The empirical results are scrutinized and juxtaposed with prevailing approaches in the realm of intrusion detection for IoT. Notably, the proposed method emerges as showcasing superior accuracy when contrasted with existing methods.

The substantial growth of Internet-connected devices within the Internet of Things (IoT) has given rise to significant security challenges. Among the various threats confronting these interconnected devices, Denial of Service (DoS)/Distributed Denial of Service (DDoS) attacks emerge as significant concerns. The attacks, which seek to disrupt IoT services by flooding networks with unnecessary traffic, there is a critical need for robust security measures. Intrusion Detection Systems (IDS) are vital in identifying suspicious activities, yet many existing systems lack real-time capabilities to address evolving attack strategies. This study investigates the vulnerabilities of IoT networks and the pressing need to detect and classify DoS/DDoS attacks in real time. Traditional IDS, while effective in recognizing known attack patterns, fall short in identifying new attack types due to their reliance on historical data. To bridge this gap, this research focuses on developing an enhanced hybrid network intrusion detection and classification system. This study seeks to make contribution to the advancement of resilient security measures within IoT environments. The framework uses the Kth Nearest Neighbor (KNN) algorithm and dense neural networks to efficiently detect and categorize DoS/DDoS attacks in real time. To achieve this, a simulation model implementing the proposed hybrid algorithm will be developed. The framework utilized the MQTT-IoT-IDS2020 dataset, and a comparison was presented with recent approaches found in the literature. The results demonstrated enhanced performance in terms of true positive rate, accuracy, speed of detection.