A hierarchical ensemble learning framework for cyberthreat detection in IoT platforms

The proliferation of Internet of Things (IoT) and Internet of Medical Things (IoMT) devices has dramatically escalated the risk of cyberattacks, necessitating robust and highly responsive Intrusion Detection Systems (IDS). However, existing solutions frequently struggle with severe class imbalance and high-dimensional data, leading to a suboptimal trade-off between detection accuracy and computational efficiency. To address these challenges, this paper introduces a novel hierarchical machine learning-based IDS optimized for real-time multiclass attack detection. We construct a comprehensive unified dataset by integrating the recent CICIoT2023 and CICIoMT2024 datasets. Our framework first employs a Genetic Algorithm (GA) for feature selection, extracting a lightweight subset of critical features to minimize computational overhead. The core classification engine utilizes a two-stage hierarchical Random Forest architecture coupled with selective SMOTE oversampling. The first stage identifies major attack categories while grouping minority instances into a meta-class, which are then precisely classified by the second stage. Experimental evaluations demonstrate that the proposed hierarchical framework establishes an optimal accuracy-efficiency trade-off and improves the classification performance on minority attack classes compared to traditional flat classifiers. While simple data undersampling methods achieve fast runtimes at the cost of severe performance degradation, our hierarchical approach preserves exceptional detection capabilities and operates faster than conventional models trained on full datasets. The framework achieves robust F1-scores of 90% on the unified dataset and 89% on CICIoT2023 . Finally, the integration of Explainable AI (XAI) techniques, including SHAP and LIME, ensures model transparency and interpretability, making the proposed IDS a highly practical, reliable, and scalable solution for deployment in resource-constrained IoT environments.