Development of a Homogeneous Hybrid Machine Learning for Intrusion Detection in the IOT Network - Ibrahim mirza, Kosar; Jaafar Hussein, Dalshad; Muhammed Sidqi , Haval; Aziz Ali, Nyaz (The Scientific Journal of Cihan University– Sulaimaniya, 2025)
In the rapidly evolving landscape of the Internet of Things (IoT), which underpins advancements in e-health, smart homes, e-commerce, and various other digital domains, fog computing emerges as a pivotal IoT platform, bringing to the forefront significant cybersecurity challenges. Traditional intrusion detection mechanisms falter in the IoT context, hindered by the unique constraints of IoT environments, such as limited-resource devices, data imbalance, and specialized protocol stacks and standards. Particularly, the prevalence of unbalanced data in IoT-related network attack datasets compromises the efficacy of conventional intrusion detection systems. Addressing these challenges, this study introduces a novel Group Intrusion Detection Mechanism (Group-based Machine Learning Mechanism for Enhanced Security) GMMES tailored for IoT networks, specifically designed to mitigate malicious activities, with a focus on botnet attacks targeting DNS, HTTP, and MQTT protocols. The GMMES model innovatively integrates correlation-based feature selection, Gaussian mixture model clustering, and ensemble stacking techniques. When benchmarked against contemporary IoT intrusion detection models using the UNSW-NB 15 dataset, based on Attack Detection Precision (ADP) and Early Warning Precision (EWP) metrics, the GMMES model demonstrates superior performance in identifying Dos, Exploits, and Generic attacks compared to other models, including deep neural networks and Adaboost learning algorithms. However, its efficacy in detecting Worms remains consistent with previous models. Furthermore, the incorporation of correlation-based feature selection and parallel processing in the(Group Intrusion Detection Mechanism GMMES model significantly enhances training efficiency, presenting a promising avenue for efficient and effective IoT cybersecurity measures, and the study of the training time of the proposed model also showed that it could reduce the training time by using correlation-based feature selection and parallel processing. The limitations are incorporating, heterogeneity, optimization, dynamic learning and adversarial Training.