A feature-level ensemble machine learning approach for attack detection in IoT networks

Abstract The rapid adoption of Internet-of-Things (IoT) technologies in smart cities has enabled efficient data exchange among interconnected devices, enhancing automation and real-time decision-making. However, the proliferation of IoT applications and devices has also introduced significant cybersecurity risks, including Denial-of-Service (DoS), Distributed-DoS (DDoS), phishing, and spoofing attacks. Traditional AI-based intrusion detection models often struggle to maintain high accuracy over time due to Concept Drift (CD) and Class Imbalance (CI), which hinders their ability to detect evolving threats effectively. To address these limitations, this study proposes a feature-level ensemble machine learning approach called Weight-Optimized Extreme Gradient Boosting (WO-XGB). The proposed model incorporates a dynamic weight adjustment mechanism to mitigate CD and utilizes a reweighting strategy to handle CI, while integrating k-fold Cross-Validation (CV) to enhance generalization and prevent overfitting. WO-XGB was rigorously evaluated using two benchmark IoT intrusion detection datasets, i.e., Edge-IIoTset and CICIoT2023. The model achieved better results, with 99.98% accuracy on the Edge-IIoT set and 99.81% on CICIoT2023, outperforming several state-of-the-art ML and DL models. The experimental results demonstrate that WO-XGB is not only highly accurate but also resilient to evolving attack behaviors. In conclusion, WO-XGB offers a robust and adaptable solution for intrusion detection in IoT environments, effectively addressing critical challenges posed by CD and CI.