Trustworthy and Adaptive Intrusion Detection for Imbalanced IoT Traffic
DOI:
https://doi.org/10.68307/k9pxqe13Keywords:
internet of thing, intrusion detection, class imbalance, concept drift, explainable ai, ensemble learning, calibration, dataset leakage, cross-dataset generalizationAbstract
Internet of Things (IoT) intrusion detection is frequently reported as a near-solved classification problem, yet operational deployments remain vulnerable to class imbalance, distribution shift, dataset leakage, poor probability calibration, unstable explanations, and cross-network failure. This review synthesizes 28 verified sources spanning benchmark datasets, adaptive learning, generalization, explainable artificial intelligence, imbalance handling, ensemble models, probability quality, and review methodology. It develops a unified taxonomy in which data integrity, model intelligence, temporal resilience, human trust, and evaluation rigor are treated as interdependent design requirements. Mathematical foundations are provided for class-weighted risk, macro-averaged performance, Matthews correlation coefficient, calibration error, drift detection, soft voting, and additive explanations. Major findings are that random record splits can materially overstate readiness; accuracy alone obscures minority-class failure; oversampling must be confined to training folds; post-hoc explanations need stability tests; and drift adaptation requires governance, not only retraining. A reproducibility case study using an audited RT-IoT2022 copy illustrates how index leakage, duplicates, conflicting labels, and extreme skew can coexist with apparently excellent scores. The review concludes with an evidence-driven architecture and a research agenda for device-aware evaluation, calibrated uncertainty, explanation monitoring, and safe rollback. The article is intended as both a critical survey and a practical blueprint for thesis-level experimental work.
References
[1] B. S. Sharmila and R. Nagapadma, 'Quantized autoencoder intrusion detection system for anomaly detection in resource-constrained IoT devices using RT-IoT2022 dataset,' Cybersecurity, vol. 6, art. 41, 2023, doi: 10.1186/s42400-023-00178-5.
[2] B. S. and R. Nagapadma, RT-IoT2022 [Dataset], UCI Machine Learning Repository, 2023, doi: 10.24432/C5P338.
[3] Y. Meidan et al., 'N-BaIoT: Network-Based Detection of IoT Botnet Attacks Using Deep Autoencoders,' IEEE Pervasive Computing, vol. 17, no. 3, pp. 12-22, 2018, doi: 10.1109/MPRV.2018.03367731.
[4] Y. Mirsky, T. Doitshman, Y. Elovici, and A. Shabtai, 'Kitsune: An Ensemble of Autoencoders for Online Network Intrusion Detection,' NDSS Symposium, 2018, doi: 10.14722/ndss.2018.23204.
[5] A. Alsaedi, N. Moustafa, Z. Tari, A. Mahmood, and A. Anwar, 'TON_IoT telemetry dataset,' IEEE Access, vol. 8, pp. 165130-165150, 2020, doi: 10.1109/ACCESS.2020.3022862.
[6] N. Koroniotis, N. Moustafa, E. Sitnikova, and B. Turnbull, 'Towards the development of realistic botnet dataset in the Internet of Things,' Future Generation Computer Systems, vol. 100, pp. 779-796, 2019, doi: 10.1016/j.future.2019.05.041.
[7] E. C. P. Neto et al., 'CICIoT2023: A real-time dataset and benchmark for large-scale attacks in IoT environment,' Sensors, vol. 23, no. 13, art. 5941, 2023, doi: 10.3390/s23135941.
[8] N. Moustafa, 'A new distributed architecture for evaluating AI-based security systems at the edge,' Sustainable Cities and Society, vol. 72, art. 102994, 2021, doi: 10.1016/j.scs.2021.102994.
[9] O. Abdel Wahab, 'Intrusion Detection in the IoT Under Data and Concept Drifts,' IEEE Internet of Things Journal, vol. 9, no. 20, pp. 19706-19716, 2022, doi: 10.1109/JIOT.2022.3167005.
[10] A. Bifet and R. Gavalda, 'Learning from Time-Changing Data with Adaptive Windowing,' Proc. SIAM Int. Conf. Data Mining, pp. 443-448, 2007, doi: 10.1137/1.9781611972771.42.
[11] M. Verkerken, L. D'hooge, T. Wauters, B. Volckaert, and F. De Turck, 'Inter-dataset generalization strength of supervised machine learning methods for intrusion detection,' J. Information Security and Applications, vol. 54, art. 102564, 2020, doi: 10.1016/j.jisa.2020.102564.
[12] K. Kostas, M. Just, and M. A. Lones, 'IoTGeM: Generalizable models for behaviour-based IoT attack detection,' Computer Networks, art. 111550, 2025, doi: 10.1016/j.comnet.2025.111550.
[13] F. Cerasuolo, G. Bovenzi, and A. Pescape, 'Cross-network transferability of AI-based network intrusion detection systems in heterogeneous Internet of Things environments,' Computer Networks, vol. 286, art. 112434, 2026, doi: 10.1016/j.comnet.2026.112434.
[14] S. M. Lundberg and S.-I. Lee, 'A Unified Approach to Interpreting Model Predictions,' Advances in Neural Information Processing Systems, vol. 30, 2017.
[15] M. T. Ribeiro, S. Singh, and C. Guestrin, 'Why Should I Trust You?: Explaining the Predictions of Any Classifier,' Proc. ACM SIGKDD, pp. 1135-1144, 2016, doi: 10.1145/2939672.2939778.
[16] M. M. Ahsan et al., 'Explainable artificial intelligence for intrusion detection in IoT networks,' Expert Systems with Applications, vol. 238, art. 121751, 2024, doi: 10.1016/j.eswa.2023.121751.
[17] F. Ebrahimi, R. Javidan, R. Akbari, et al., 'Intrusion detection in the internet of things using convolutional neural networks: An explainable AI approach,' Cybersecurity, vol. 8, art. 66, 2025, doi: 10.1186/s42400-025-00369-2.
[18] A. Ghorbani, A. Abid, and J. Zou, 'Interpretation of Neural Networks Is Fragile,' Proc. AAAI, vol. 33, no. 1, pp. 3681-3688, 2019, doi: 10.1609/aaai.v33i01.33013681.
[19] D. Arp et al., 'Pitfalls in Machine Learning for Computer Security,' Communications of the ACM, 2024, doi: 10.1145/3643456.
[20] N. V. Chawla, K. W. Bowyer, L. O. Hall, and W. P. Kegelmeyer, 'SMOTE: Synthetic Minority Over-sampling Technique,' J. Artificial Intelligence Research, vol. 16, pp. 321-357, 2002, doi: 10.1613/jair.953.
[21] A. Fernandez, S. Garcia, F. Herrera, and N. V. Chawla, 'SMOTE for Learning from Imbalanced Data: Progress and Challenges,' J. Artificial Intelligence Research, vol. 61, pp. 863-905, 2018, doi: 10.1613/jair.1.11192.
[22] L. Breiman, 'Random Forests,' Machine Learning, vol. 45, pp. 5-32, 2001, doi: 10.1023/A:1010933404324.
[23] T. Chen and C. Guestrin, 'XGBoost: A Scalable Tree Boosting System,' Proc. ACM SIGKDD, pp. 785-794, 2016, doi: 10.1145/2939672.2939785.
[24] C. Guo, G. Pleiss, Y. Sun, and K. Q. Weinberger, 'On Calibration of Modern Neural Networks,' Proc. ICML, vol. 70, pp. 1321-1330, 2017.
[25] D. Chicco and G. Jurman, 'The advantages of the Matthews correlation coefficient over F1 score and accuracy,' BMC Genomics, vol. 21, art. 6, 2020, doi: 10.1186/s12864-019-6413-7.
[26] M. J. Page et al., 'The PRISMA 2020 statement: An updated guideline for reporting systematic reviews,' BMJ, vol. 372, n71, 2021, doi: 10.1136/bmj.n71.
[27] M. L. Rethlefsen et al., 'PRISMA-S: An extension to the PRISMA Statement for Reporting Literature Searches,' Systematic Reviews, vol. 10, art. 39, 2021, doi: 10.1186/s13643-020-01542-z.
[28] A. Thakkar and R. Lohiya, 'Internet of Things security dataset evolution: Challenges and future directions,' Internet of Things, vol. 22, art. 100780, 2023, doi: 10.1016/j.iot.2023.100780.
[29] M. K. Bagwani, S. Dwivedi, V. Kumar, and P. Koshti, "Transmitting malware through QR codes: Risk analysis and a hybrid detection method," International Journal for Multidisciplinary Research, vol. 8, no. 3, pp. 1-25, 2026.
[30] A. M. K. Bagwani and V. K. Tiwari, "Preventing malware spread through QR codes: A detection and analysis approach," Journal of Engineering and Technology Management, vol. 73, pp. 1260-1268, 2024.
[31] A. M. K. Bagwani, V. K. Tiwari, and N. Singh, "Integrating GrapesJS with AWS: Building an educational platform for web development training," An Overview of Literature, Language and Education research, vol. 10, pp. 106124, 2025.
[32] M. Bagwani, "Building a cloud-native microservices based web application with GraphQL and Docker," School of Advanced Computing, Sanjeev Agrawal Global Educational University, 2024.
Additional Files
Published
Issue
Section
License
Copyright (c) 2026 Aanchal khare
This work is licensed under a Creative Commons Attribution 4.0 International License.
Articles published in the International Journal of Artificial Intelligence, Cybersecurity and Emerging Technologies (IJAICET) are licensed under the Creative Commons Attribution 4.0 International License (CC BY 4.0).
Under this license, users are free to share, copy, redistribute, adapt, and build upon the published material for any purpose, including commercial use, provided appropriate credit is given to the original author(s) and the source, a link to the license is provided, and any changes made are indicated.
Authors retain copyright of their work while granting IJAICET the right to publish, archive, distribute, and index the article. The journal supports the free exchange of scientific knowledge through open access publishing and encourages the widest possible dissemination of research.
