Scholarlink

<p>The combination of Artificial Intelligence (AI) and the Internet of Things (IoT), known as AIoT, has accelerated the development of smart environments but also expanded the surface for cyberattacks. Intrusion detection systems (IDS) are therefore essential for IoT cybersecurity. The main contributions of this paper are (i) a structured review of recent AI-based IDS approaches for IoT, analyzing their methodologies, datasets, performance, and limitations; and (ii) the proposal and validation of a novel ensemble IDS framework. More than thirty studies are systematically reviewed and categorized into binary and multi-class classifiers, with critical analysis of their performance on several benchmark datasets. A critical assessment of surveyed methods reveals clear trade-offs: deep hybrid models (e.g., CNN-LSTM, Transformer-based) which deliver high accuracy but suffer from scalability and resource constraints, while traditional ML classifiers (e.g., DT, RF, SVM) offer efficiency but struggle with unseen attacks. To address these gaps, we experimentally develop a lightweight ensemble IDS that integrates convolutional neural network (CNN), Decision Tree (DT), Random Forest (RF), and XGBoost through confidence-based soft voting and is validated across individual datasets CICIDS2017, NSL-KDD, IoTID20, CICIoT2023, and a constructed combined dataset for cross-dataset generalization. These dataset are chosen for their benchmark status, IoT relevance, and diversity of attack types. Results show up to 99.99% accuracy, precision, recall, and F1-score with AUC closed to 1 in both binary and multi-class settings, with superior scalability and cross-dataset robustness compared to state-of-the-art methods. The ensemble IDS developed is light and inexpensive, and can provide accurate intrusion detection while demanding low latency and memory overhead; thus, it is appropriate for deployment in IoT embedded edge sites. This twofold contribution makes this survey distinctive from the previous surveys and gives practical guidelines to develop scalable, adaptive, and resource-aware IDS solutions for heterogeneous IoT networks. In this paper, we find that ensemble approaches balance the trade-off between detection performance, efficiency, and scalability well, qualifying them to be a candidate for semi-real-time IoT intrusion defense support system. Temporal modeling, explainable AI, and standardized benchmarking protocols should be considered in future work to progress robustness and trust in IoT security.</p>

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

Scalable and generalizable AI-based intrusion detection in AIoT: a review and lightweight ensemble solution

  • 期刊论文

  • 发表日期：

    2025年12月18日

查看全文
  • Shayma Wail Nourildean,
  • Wafa Mefteh,
  • Ali Mohsen Frihida

摘要

The combination of Artificial Intelligence (AI) and the Internet of Things (IoT), known as AIoT, has accelerated the development of smart environments but also expanded the surface for cyberattacks. Intrusion detection systems (IDS) are therefore essential for IoT cybersecurity. The main contributions of this paper are (i) a structured review of recent AI-based IDS approaches for IoT, analyzing their methodologies, datasets, performance, and limitations; and (ii) the proposal and validation of a novel ensemble IDS framework. More than thirty studies are systematically reviewed and categorized into binary and multi-class classifiers, with critical analysis of their performance on several benchmark datasets. A critical assessment of surveyed methods reveals clear trade-offs: deep hybrid models (e.g., CNN-LSTM, Transformer-based) which deliver high accuracy but suffer from scalability and resource constraints, while traditional ML classifiers (e.g., DT, RF, SVM) offer efficiency but struggle with unseen attacks. To address these gaps, we experimentally develop a lightweight ensemble IDS that integrates convolutional neural network (CNN), Decision Tree (DT), Random Forest (RF), and XGBoost through confidence-based soft voting and is validated across individual datasets CICIDS2017, NSL-KDD, IoTID20, CICIoT2023, and a constructed combined dataset for cross-dataset generalization. These dataset are chosen for their benchmark status, IoT relevance, and diversity of attack types. Results show up to 99.99% accuracy, precision, recall, and F1-score with AUC closed to 1 in both binary and multi-class settings, with superior scalability and cross-dataset robustness compared to state-of-the-art methods. The ensemble IDS developed is light and inexpensive, and can provide accurate intrusion detection while demanding low latency and memory overhead; thus, it is appropriate for deployment in IoT embedded edge sites. This twofold contribution makes this survey distinctive from the previous surveys and gives practical guidelines to develop scalable, adaptive, and resource-aware IDS solutions for heterogeneous IoT networks. In this paper, we find that ensemble approaches balance the trade-off between detection performance, efficiency, and scalability well, qualifying them to be a candidate for semi-real-time IoT intrusion defense support system. Temporal modeling, explainable AI, and standardized benchmarking protocols should be considered in future work to progress robustness and trust in IoT security.