Machine Learning-Based IoT Intrusion Detection: A Survey and Performance Comparison
DOI:
https://doi.org/10.54097/kq5vtd46Keywords:
Machine Learning, Deep Learning, Internet of Things, Intrusion Detection SystemAbstract
As IoT devices multiply, the cyber attack surface has widened just as fast, and with it the need for intrusion detection systems (IDS) that are efficient, dependable, and protective of user privacy. This paper organizes IoT IDS methods into a taxonomy built around training architecture and reviews them under two main paradigms, misuse detection and anomaly detection, with the focus on centralized traditional machine learning and deep learning. Experiments on several public datasets point to a clear pattern: in centralized settings, tree-based ensemble models and the hybrid CNN-LSTM architecture give the strongest overall results, whereas Isolation Forest holds up better once the data is compressed at the edge. For federated deployment, tree-based ensembles stand out as the preferred local classifiers.
Downloads
References
[1] Sinha, S. (2026, April 29). Cellular IoT market update 2026: Connections grew 13% in 2025, slowest since 2020. IoT Analytics. https://iot-analytics.com/cellular-iot-market-update-spring-2026/.
[2] StormWall. (2025). The evolving DDoS threat: StormWall’s H1 2025 report. https://stormwall.network/resources/blog/ddos-attack-statistics-h1-2025.
[3] Bitdefender. (2025). New Bitdefender and NETGEAR report reveals rising threats across the connected home landscape. https://www.bitdefender.com/en-us/news/new-bitdefender-and-netgear-report-reveals-rising-threats-across-the-connected-home-landscape.
[4] Tavallaee, M., Bagheri, E., Lu, W., & Ghorbani, A. A. (2009). A detailed analysis of the KDD CUP 99 data set. In 2009 IEEE Symposium on Computational Intelligence for Security and Defense Applications (pp. 1–6). Ottawa. DOI: https://doi.org/10.1109/CISDA.2009.5356528
[5] Moustafa, N., & Slay, J. (2015). UNSW-NB15: A comprehensive data set for network intrusion detection systems (UNSW-NB15 network data set). In 2015 Military Communications and Information Systems Conference (MilCIS) (pp. 1–6). Canberra. DOI: https://doi.org/10.1109/MilCIS.2015.7348942
[6] Sharafaldin, I., Habibi Lashkari, A., & Ghorbani, A. A. (2018). Toward generating a new intrusion detection dataset and intrusion traffic characterization. In 4th International Conference on Information Systems Security and Privacy (pp. 108–116). Funchal. DOI: https://doi.org/10.5220/0006639801080116
[7] Koroniotis, N., Moustafa, N., Sitnikova, E., & Turnbull, B. (2019). Towards the development of realistic botnet dataset in the Internet of Things for network forensic analytics: Bot-IoT dataset. Future Generation Computer Systems, 100, 779–796. DOI: https://doi.org/10.1016/j.future.2019.05.041
[8] Moustafa, N. (2021). A new distributed architecture for evaluating AI-based security systems at the edge: Network TON_IoT datasets. Sustainable Cities and Society, 72, 102994. DOI: https://doi.org/10.1016/j.scs.2021.102994
[9] Ullah, I., & Mahmoud, Q. H. (2020). A scheme for generating a dataset for anomalous activity detection in IoT networks. In Advances in Artificial Intelligence (pp. 508–520). Ottawa. DOI: https://doi.org/10.1007/978-3-030-47358-7_52
[10] Ferrag, M. A., Friha, O., Hamouda, D., Maglaras, L., & Janicke, H. (2022). Edge-IIoTset: A new comprehensive realistic cyber security dataset of IoT and IIoT applications for centralized and federated learning. IEEE Access, 10, 40281–40306. DOI: https://doi.org/10.1109/ACCESS.2022.3165809
[11] Buczak, A. L., & Guven, E. (2016). A survey of data mining and machine learning methods for cyber security intrusion detection. IEEE Communications Surveys & Tutorials, 18, 1153–1176. DOI: https://doi.org/10.1109/COMST.2015.2494502
[12] Abrar, I., Ayub, Z., Masoodi, F., & Bamhdi, A. M. (2020). A machine learning approach for intrusion detection system on NSL-KDD dataset. In 2020 International Conference on Smart Electronics and Communication (ICOSEC) (pp. 919–924). Trichy. DOI: https://doi.org/10.1109/ICOSEC49089.2020.9215232
[13] Alosaimi, S., & Almutairi, S. M. (2023). An intrusion detection system using BoT-IoT. Applied Sciences, 13, 5427. DOI: https://doi.org/10.3390/app13095427
[14] Maseer, Z., Yusof, R., Bahaman, N., Mostafa, S. A., & Foozy, C. F. M. (2021). Benchmarking of machine learning for anomaly based intrusion detection systems in the CICIDS2017 dataset. IEEE Access, 9, 22351–22370. DOI: https://doi.org/10.1109/ACCESS.2021.3056614
[15] Hamidou, S. T., & Mehdi, A. (2025). Enhancing IDS performance through a comparative analysis of Random Forest, XGBoost, and Deep Neural Networks. Machine Learning with Applications, 22, 100738. DOI: https://doi.org/10.1016/j.mlwa.2025.100738
[16] Doghramachi, D. F., & Ameen, S. Y. (2023). Internet of Things (IoT) security enhancement using XGboost machine learning techniques. Computers, Materials & Continua, 77, 717–732. DOI: https://doi.org/10.32604/cmc.2023.041186
[17] Liu, D., Zhen, H., Kong, D., Chen, X., Zhang, L., Yuan, M., & Wang, H. (2021). Sensors anomaly detection of industrial Internet of Things based on isolated forest algorithm and data compression. Scientific Programming, 2021, 1–9. DOI: https://doi.org/10.1155/2021/6699313
[18] Ahmed, M., Seraj, R., & Islam, S. M. S. (2020). The k-means algorithm: A comprehensive survey and performance evaluation. Electronics, 9, 1295. DOI: https://doi.org/10.3390/electronics9081295
[19] Kareem, M. S., & Muhammed, L. A. (2024). Anomaly detection in streaming data using Isolation Forest. In 2024 Seventh International Women in Data Science Conference at Prince Sultan University (WiDS PSU) (pp. 223–228). Riyadh. DOI: https://doi.org/10.1109/WiDS-PSU61003.2024.00052
[20] Perumal, T., Mustapha, N., Mohamed, R., & Shiri, F. M. (2024). A comprehensive overview and comparative analysis on deep learning models. Journal on Artificial Intelligence, 6, 301–360. DOI: https://doi.org/10.32604/jai.2024.054314
[21] Neto, E. C. P., Iqbal, S., Buffett, S., Sultana, M., & Taylor, A. (2025). Deep learning for intrusion detection in emerging technologies: A comprehensive survey and new perspectives. Artificial Intelligence Review, 58, 340. DOI: https://doi.org/10.1007/s10462-025-11346-z
[22] Ab Razak, M. F., Firdaus, A., Tahaei, H., & Gheisari, M. (2026). A hybrid CNN–LSTM model for IoT intrusion detection: A robustness analysis across datasets. Future Internet, 18, 345. DOI: https://doi.org/10.3390/fi18070345
[23] Bond-Taylor, S., Leach, A., Long, Y., & Willcocks, C. G. (2022). Deep generative modelling: A comparative review of VAEs, GANs, normalizing flows, energy-based and autoregressive models. IEEE Transactions on Pattern Analysis and Machine Intelligence, 44, 7327–7347. DOI: https://doi.org/10.1109/TPAMI.2021.3116668
[24] Cherukuri, A. K. (2026). Comparative evaluation of VAE, GAN, and SMOTE for Tor detection in encrypted network traffic. arXiv preprint arXiv:2601.01183.
[25] Nguyen, C., Ding, M., Pathirana, N., Seneviratne, A., Li, J., & Vincent Poor, H. (2021). Federated learning for Internet of Things: A comprehensive survey. IEEE Communications Surveys & Tutorials, 23, 1622–1658. DOI: https://doi.org/10.1109/COMST.2021.3075439
[26] McMahan, B., Moore, E., Ramage, D., Hampson, S., & y Arcas, B. A. (2017). Communication-efficient learning of deep networks from decentralized data. In Artificial Intelligence and Statistics (pp. 1273–1282). Fort Lauderdale.
[27] Baich, M., & Sael, N. (2025). A federated learning-based intrusion detection system using dynamic ensemble aggregation for IoT networks. IEEE Access, 13, 205826–205839. DOI: https://doi.org/10.1109/ACCESS.2025.3640521
Downloads
Published
Issue
Section
License
Copyright (c) 2026 Frontiers in Computing and Intelligent Systems
This work is licensed under a Creative Commons Attribution-NonCommercial 4.0 International License.
