SH-IDS: a resilient self-healing intrusion detection framework against DoS and DDoS attacks in IoT systems

The rapid proliferation of Internet of Things (IoT) devices and advanced obfuscation techniques has led to increasingly sophisticated Denial of Service (DoS) and Distributed Denial of Service (DDoS) attacks. Traditional intrusion detection systems (IDS) without adaptive capabilities often fail to detect such attacks, resulting in a rising success rate of DoS/DDoS incidents each year. To address these limitations, this study proposes a self-healing intrusion detection system (SH-IDS), a machine learning (ML)-based IDS that enhances IoT network security through collaborative and autonomous adaptation. Unlike existing solutions, the threshold values in SH-IDS are adaptive and computed based on IoT device configurations. When an IoT device detects resource usage exceeding these thresholds, it sends a danger signal that triggers a self-healing process to update the detection model, thereby blocking malicious traffic. Six ML algorithms are evaluated to assess SH-IDS performance. Results show that Random Forest (RF) achieves 59.6% accuracy before self-healing and 99.9% after self-healing, with the highest true positive and true negative rates in detecting emerging DoS/DDoS attacks. Overall, the findings demonstrate that SH-IDS is an effective, adaptive, and flexible solution for mitigating both existing and emerging DoS/DDoS threats.