An Improved Anomaly-based Intrusion Detection System for IoT Applications using Machine Learning Methods

The emergence of the Internet of Things (IoT) aimed to enhance people’s way of life by providing a range of smart, networked applications across multiple industries. Due to security vulnerabilities, devices operating in an IoT context encounter several problems. Although several strategies have been proposed to enhance the security and privacy of IoT devices, further work is still required. Machine learning (ML) has become a permanent fixture as a method for efficiently identifying anomalies in IoT networks. Hence, this study focusses on the challenges posed by heterogeneous IoT systems. It proposes a novel hybrid multi-algorithm system that uniquely combines four complementary ML algorithms to enhance anomaly detection in IoT. Unlike existing approaches that rely on single datasets or computationally intensive deep learning (DL), this study introduces a lightweight, yet highly effective framework that combines k-nearest neighbour (KNN), decision tree (DT), random forest (RF), and stacking classifier (SC) algorithms trained on an integrated multi-source dataset to address real-world IoT heterogeneity. The training and testing of the proposed system were conducted using the comprehensive NetFlow-University of Queensland-Network Intrusion Detection System (NF-UQ-NIDS) dataset, which uniquely combines four benchmark datasets: UNSW-NB15, BoT-IoT, ToN-IoT, and CSE-CIC-IDS2018, enabling superior generalisation across diverse IoT environments. The system achieved 99.9% and 96% accuracy rates in binary and multi-class classifications, outperforming state-of-the-art approaches while maintaining computational efficiency suitable for resource-constrained IoT devices.