Guard IoT: A Hybrid Intrusion Detection System for Secure IoT

The global IoT ecosystem links millions of devices, enabling intelligent automation across fields like healthcare, smart metropolitan systems and industrial automation. Yet, this widespread adoption also opens the door to severe cybersecurity risks such as botnet attacks, zero-day intrusions, and emerging malware variants. Traditional IDSs are often unable to cope due to static detection logic, high false-alarm levels, and limited flexibility in dynamic IoT environments. To address these shortcomings, we present GuardIoT, a hybrid intrusion detection framework tailored for IoT security. The system merges ensemble anomaly-detection techniquesAutoencoders and Isolation Forest-with clustering approaches such as K-Means and DBSCAN, complemented by classification models like SVM, Decision Tree, Random Forest, and LSTM to ensure accurate, real-time threat identification. It evaluates performance on the IoT23-dataset containing both normal activities and a range of various attacks, such as botnets, DDoS, brute-force attempts, and port scans. For validation, an 80-20 stratified split was used to divide training and testing data, reported metrics included accuracy, precision, recall, and F1-score. With a scalable Spring Boot backend and dual alerting via SMS and email, GuardIoT delivers resilient performance, fewer false positives, and strong adaptability to evolving cyber threats, achieving an accuracy of 94.5 %.