Lightweight Multilayer IoT Attack Detection: An Evaluation of the Semi‐Automated Intrusion Detection System ( SAIDS ) Framework on Simulated and Real‐World Traffic

ABSTRACT The rapid growth of the Internet of Things (IoT) creates concern around multilayer cyber‐attacks that exploit interactions between physical, network, and application layers. Traditional Intrusion Detection Systems (IDS) often utilize outdated datasets, high dimensional features, or computationally heavy deep learning models, which are not practical for low‐power IoT environments. This study extends previous research on the Semi‐Automated Intrusion Detection System (SAIDS) framework by evaluating its performance using a hybrid dataset constructed from both simulated and real‐world IoT attack scenarios. The dataset combines Denial of Service (UDP flood) traffic generated using the Cooja simulator with a real‐time ARP‐based Man‐in‐the‐Middle (MITM) attack executed on a smart home IoT testbed. A cross‐layer feature analysis was conducted to identify behavioral features shared across the selected attack types. From an initial set of 35 features, 21 common features were identified, and a reduced subset of seven lightweight features was selected using multiple feature selection and weighting methods supported by a semi‐automated analysis process. Five machine learning models, KNN, DT, ANN, RF, and NB, were evaluated using both binary and multiclass classification approaches. The results show that DT, ANN, and KNN achieved strong performance, with accuracy ranging from 84% to 100%, demonstrating the effectiveness of the reduced feature set in detecting representative multilayer attack scenarios involving DoS and MITM. In contrast to existing studies that rely primarily on benchmark datasets or high‐complexity models, this work demonstrates that lightweight feature subsets can maintain strong detection performance across heterogeneous IoT environments. The findings highlight the practical applicability of the SAIDS framework for real‐world IoT intrusion detection, particularly in scenarios where computational efficiency and adaptability are required.