Search for Articles:
Title / Keyword
Author / Affiliation / Email
Journal
Article Type
 
 
Advanced Search
 
Section
Special Issue
Volume
Issue
Number
Page
 
8.2
4.3
Journals
Information
Special Issues
Intrusion Detection Systems in IoT Networks
share announcement

Intrusion Detection Systems in IoT Networks

A special issue of Information (ISSN 2078-2489). This special issue belongs to the section "Information Security and Privacy".

Deadline for manuscript submissions: closed (13 March 2026) | Viewed by 35034

Editor

Dr. Jian Tang

E-Mail Website
Guest Editor
Department of Computer Science, Memorial University of Newfoundland, St. John's, NL A1B 3X5, Canada
Interests: machine learning; data mining; IDS in IoT
Special Issues, Collections and Topics in MDPI journals

Special Issue Information

Dear Colleagues,

We are pleased to announce a forthcoming Special Issue, upcoming for publication in the journal of Information. We aim to cover a broad range of subjects related to intrusion detection systems (IDS) in IoT networks, and hope that we will be joined in this endeavor by research leaders in this field.

IoT is a type of network that connects all sorts of different applications based
on the convergence of smart objects and the Internet. In recent years, IoT has penetrated every aspect of life, including the human body, home, and the living environment. Moreover, it is increasingly being adapted to a higher level of usage by various private and public sectors, such as military and nuclear facilities, civilian institutions/organizations, and governmental bodies. The aim is to improve their capacity in terms of environmental management, decision making, intelligence, among other goals. Such vast and vital applications come with security risks and threats.

An IoT network provides powerful computations, as well as valuable and sensitive data collected from interconnected devices within the corresponding IoT network. These devices are usually developed based on specific types of functionalities, which are based in turn on low cost and limited resources in computational capabilities, power, and storage. As a result, such networks are vulnerable to a wide array of security threats. Securing IoT networks is vital due to the importance and sensitivity of the data they collect.

The nature of IoT networks, such as interconnecting a large number of devices with limited resources, and heterogeneity between various IoT networks, raises security challenges. As a result, traditional security methods, such as cryptography, are less effective against IoT cyberattacks. Accordingly, different methodologies and technologies are needed for detecting cyberattacks in IoT networks.

We invite researchers to submit scholarly articles on a range of topics including, but not limited to the following topics:

  • Data confidentiality and authentication in IoT networks
  • Access control within the IoT networks
  • Privacy and trust among users and things
  • Enforcement of security and privacy policies
  • Strategies for hosting IDS agents in IoT devices
  • Methodologies of adapting IDS to IoT architectures
  • Taxonomy of IDS for IoT networks
  • Placement of IDS in IoT networks
  • Comparison of different IDSs
  • Validation strategies
  • Secure alert traffic and management
  • Network administrations for IoT in the presence of IDS
  • Autonomic IDSs
  • Incorporating machine learning strategies for IDS in IoT networks

Dr. Jian Tang
Guest Editor

Manuscript Submission Information

Manuscripts should be submitted online at www.mdpi.com by registering and logging in to this website. Once you are registered, click here to go to the submission form. Manuscripts can be submitted until the deadline. All submissions that pass pre-check are peer-reviewed. Accepted papers will be published continuously in the journal (as soon as accepted) and will be listed together on the special issue website. Research articles, review articles as well as short communications are invited. For planned papers, a title and short abstract (about 250 words) can be sent to the Editorial Office for assessment.

Submitted manuscripts should not have been published previously, nor be under consideration for publication elsewhere (except conference proceedings papers). All manuscripts are thoroughly refereed through a single-anonymized peer-review process. A guide for authors and other relevant information for submission of manuscripts is available on the Instructions for Authors page. Information is an international peer-reviewed open access monthly journal published by MDPI.

Please visit the Instructions for Authors page before submitting a manuscript. The Article Processing Charge (APC) for publication in this open access journal is 1800 CHF (Swiss Francs). Submitted papers should be well formatted and use good English. Authors may use MDPI's English editing service prior to publication or during author revisions.

Benefits of Publishing in a Special Issue

  • Ease of navigation: Grouping papers by topic helps scholars navigate broad scope journals more efficiently.
  • Greater discoverability: Special Issues support the reach and impact of scientific research. Articles in Special Issues are more discoverable and cited more frequently.
  • Expansion of research network: Special Issues facilitate connections among authors, fostering scientific collaborations.
  • External promotion: Articles in Special Issues are often promoted through the journal's social media, increasing their visibility.
  • Reprint: MDPI Books provides the opportunity to republish successful Special Issues in book format, both online and in print.

Further information on MDPI's Special Issue policies can be found here.

Related Special Issue

Published Papers (7 papers)

Download All Papers
Order results
Result details
Show export options expand_more Show export options expand_less
Select all
Export citation of selected articles as:

Research

31 pages, 2800 KB  
Article
Intelligent Fusion: A Resilient Anomaly Detection Framework for IoMT Health Devices
by Flavio Pastore, Raja Waseem Anwar, Nafaa Hadi Jabeur and Saqib Ali
Information 2026, 17(2), 117; https://doi.org/10.3390/info17020117 - 26 Jan 2026
Cited by 3 | Viewed by 1561
Abstract
Modern healthcare systems increasingly depend on wearable Internet of Medical Things (IoMT) devices for the continuous monitoring of patients’ physiological parameters. It remains challenging to differentiate between genuine physiological anomalies, sensor faults, and malicious cyber interference. In this work, we propose a hybrid [...] Read more.
Modern healthcare systems increasingly depend on wearable Internet of Medical Things (IoMT) devices for the continuous monitoring of patients’ physiological parameters. It remains challenging to differentiate between genuine physiological anomalies, sensor faults, and malicious cyber interference. In this work, we propose a hybrid fusion framework designed to attribute the most plausible source of an anomaly, thereby supporting more reliable clinical decisions. The proposed framework is developed and evaluated using two complementary datasets: CICIoMT2024 for modelling security threats and a large-scale intensive care cohort from MIMIC-IV for analysing key vital signs and bedside interventions. The core of the system combines a supervised XGBoost classifier for attack detection with an unsupervised LSTM autoencoder for identifying physiological and technical deviations. To improve clinical realism and avoid artefacts introduced by quantised or placeholder measurements, the physiological module incorporates quality-aware preprocessing and missingness indicators. The fusion decision policy is calibrated under prudent, safety-oriented constraints to limit false escalation. Rather than relying on fixed fusion weights, we train a lightweight fusion classifier that combines complementary evidence from the security and clinical modules, and we select class-specific probability thresholds on a dedicated calibration split. The security module achieves high cross-validated performance, while the clinical model captures abnormal physiological patterns at scale, including deviations consistent with both acute deterioration and data-quality faults. Explainability is provided through SHAP analysis for the security module and reconstruction-error attribution for physiological anomalies. The integrated fusion framework achieves a final accuracy of 99.76% under prudent calibration and a Matthews Correlation Coefficient (MCC) of 0.995, with an average end-to-end inference latency of 84.69 ms (p95 upper bound of 107.30 ms), supporting near real-time execution in edge-oriented settings. While performance is strong, clinical severity labels are operationalised through rule-based proxies, and cross-domain fusion relies on harmonised alignment assumptions. These aspects should be further evaluated using realistic fault traces and prospective IoMT data. Despite these limitations, the proposed framework offers a practical and explainable approach for IoMT-based patient monitoring. Full article
(This article belongs to the Special Issue Intrusion Detection Systems in IoT Networks)
►▼ Show Figures

Graphical abstract

24 pages, 8014 KB  
Article
Efficient Detection of XSS and DDoS Attacks with Bent Functions
by Shahram Miri Kelaniki and Nikos Komninos
Information 2026, 17(1), 80; https://doi.org/10.3390/info17010080 - 13 Jan 2026
Viewed by 1054
Abstract
In this paper, we investigate the use of Bent functions, particularly the Maiorana–McFarland (M–M) construction, as a nonlinear preprocessing method to enhance machine learning-based detection systems for Distributed Denial of Service (DDoS) and Cross-Site Scripting (XSS) attacks. Experimental results demonstrated consistent improvements in [...] Read more.
In this paper, we investigate the use of Bent functions, particularly the Maiorana–McFarland (M–M) construction, as a nonlinear preprocessing method to enhance machine learning-based detection systems for Distributed Denial of Service (DDoS) and Cross-Site Scripting (XSS) attacks. Experimental results demonstrated consistent improvements in classification performance following the M–M Bent transformation. In labeled DDoS data, classification performance was maintained at 100% accuracy, with improved Kappa statistics and lower misclassification rates. In labeled XSS data, classification accuracy was reduced from 100% to 87.19% to reduce overfitting. The transformed classifier also mitigated overfitting by increasing feature diversity. In DDoS and XSS unlabeled data, accuracy improved from 99.85% to 99.92% in unsupervised learning cases for DDoS, and accuracy improved from 98.94% to 100% in unsupervised learning cases for XSS, with improved cluster separation also being noted. In summary, the results suggest that Bent functions significantly improve DDoS and XSS detection by enhancing the separation of benign and malicious traffic. All of these aspects, along with increased dataset quality, increase our confidence in resilience detection in a cyber detection pipeline. Full article
(This article belongs to the Special Issue Intrusion Detection Systems in IoT Networks)
►▼ Show Figures

Graphical abstract

27 pages, 7212 KB  
Article
Multi-View Intrusion Detection Framework Using Deep Learning and Knowledge Graphs
by Min Li, Yuansong Qiao and Brian Lee
Information 2025, 16(5), 377; https://doi.org/10.3390/info16050377 - 1 May 2025
Cited by 12 | Viewed by 3114
Abstract
Traditional intrusion detection systems (IDSs) rely on static rules and one-dimensional features, and they have difficulty dealing with zero-day attacks and highly concealed threats; furthermore, mainstream deep learning models cannot capture the correlation between multiple views of attacks due to their single perspective. [...] Read more.
Traditional intrusion detection systems (IDSs) rely on static rules and one-dimensional features, and they have difficulty dealing with zero-day attacks and highly concealed threats; furthermore, mainstream deep learning models cannot capture the correlation between multiple views of attacks due to their single perspective. This paper proposes a knowledge graph-enhanced multi-view deep learning framework, considering the strategy of integrating network traffic, host behavior, and semantic relationships; and evaluates the impact of the secondary fusion strategy on feature fusion to identify the optimal multi-view model configuration. The primary objective is to verify the superiority of multi-view feature fusion technology and determine whether incorporating knowledge graphs (KGs) can further enhance model performance. First, we introduce the knowledge graph (KG) as one of the feature views and neural networks as additional views, forming a multi-view feature fusion strategy that emphasizes the integration of spatial and relational features. The KG represents relational features combined with spatial features extracted by neural networks, enabling a more comprehensive representation of attack patterns through the synergy of both feature types. Secondly, based on this foundation, we propose a two-level fusion strategy. During the representation learning of spatial features, primary fusion is performed of each view, followed by secondary fusion with relational features from KG, thereby deepening and broadening feature integration. These strategies for understanding and deploying the multi-view concept improve the model’s expressive power and detection performance and also demonstrate strong generalization and robustness across three datasets, including TON_IoT and UNSW-NB15, marking a contribution of this study. After experimental evaluation, the F1 scores of multi-view models outperformed single-view models across all three datasets. Specifically, the F1 score of the multi-view approach (Model 6) improved by 10.57% on the TON_IoT Network+Win10 dataset compared with the best single-view model. In contrast, improvements of 5.53% and 3.21% were observed on the TON_IoT network and UNSW-NB15 datasets. In terms of feature fusion strategies, the secondary fusion strategy (Model 6) outperformed primary fusion (Model 5). Furthermore, incorporating KG-based relational features as a separate view improved model performance, a finding validated by ablation studies. Experimental results show that the deep fusion strategy of multi-dimensional data overcomes the limitations of traditional single-view models, enables collaborative multi-dimensional analysis of network attack behaviors, and significantly enhances detection capabilities in complex attack scenarios. This approach establishes a scalable multimodal analysis framework for intelligent cybersecurity, advancing intrusion detection beyond traditional rule-based methods toward semantic understanding. Full article
(This article belongs to the Special Issue Intrusion Detection Systems in IoT Networks)
►▼ Show Figures

Figure 1

31 pages, 13449 KB  
Article
Development of an In-Vehicle Intrusion Detection Model Integrating Federated Learning and LSTM Networks
by Miriam Zambudio Martínez, Rafael Marin-Perez and Antonio Fernando Skarmeta Gomez
Information 2025, 16(4), 292; https://doi.org/10.3390/info16040292 - 4 Apr 2025
Cited by 12 | Viewed by 3888
Abstract
Introduction: Ensuring vehicular cybersecurity is a critical challenge due to the increasing connectivity of modern vehicles, and traditional centralised learning approaches for intrusion detection pose significant privacy risks, as they require sensitive data to be shared from multiple vehicles to a central server. [...] Read more.
Introduction: Ensuring vehicular cybersecurity is a critical challenge due to the increasing connectivity of modern vehicles, and traditional centralised learning approaches for intrusion detection pose significant privacy risks, as they require sensitive data to be shared from multiple vehicles to a central server. Objective: The aim of this study is therefore to develop an in-vehicle intrusion detection system (IVIDS) that integrates federated learning (FL) with neural networks, enabling decentralised and privacy-preserving detection of cyberattacks in vehicular networks. The proposed system extends previous research by detecting a broader range of attacks (eight types) and exploring different deep learning architectures. Methods: This study employs an extended version of the publicly available VeReMi dataset to train and evaluate multiple neural network architectures, including Multilayer Perceptrons (MLPs), Gated Recurrent Units (GRUs), and Long Short-Term Memory (LSTM) networks. Federated learning is utilised to enable collaborative model training across multiple vehicles without sharing raw data. Various data preprocessing techniques and differential privacy mechanisms are also explored. Results and Conclusions: The experimental results demonstrate that LSTM networks outperform both MLP and GRU architectures in classifying vehicular cyberattacks. The best LSTM model, trained with two previous message lags and standard normalisation, achieved a classification accuracy of 96.75% in detecting eight types of attacks, surpassing previous studies, and demonstrating the potential of applying neural networks designed to work with time series data. Full article
(This article belongs to the Special Issue Intrusion Detection Systems in IoT Networks)
►▼ Show Figures

Figure 1

20 pages, 3271 KB  
Article
Smart Collaborative Intrusion Detection System for Securing Vehicular Networks Using Ensemble Machine Learning Model
by Mostafa Mahmoud El-Gayar, Faheed A. F. Alrslani and Shaker El-Sappagh
Information 2024, 15(10), 583; https://doi.org/10.3390/info15100583 - 24 Sep 2024
Cited by 23 | Viewed by 4231
Abstract
The advent of the Fourth Industrial Revolution has positioned the Internet of Things as a pivotal force in intelligent vehicles. With the source of vehicle-to-everything (V2X), Internet of Things (IoT) networks, and inter-vehicle communication, intelligent connected vehicles are at the forefront of this [...] Read more.
The advent of the Fourth Industrial Revolution has positioned the Internet of Things as a pivotal force in intelligent vehicles. With the source of vehicle-to-everything (V2X), Internet of Things (IoT) networks, and inter-vehicle communication, intelligent connected vehicles are at the forefront of this transformation, leading to complex vehicular networks that are crucial yet susceptible to cyber threats. The complexity and openness of these networks expose them to a plethora of cyber-attacks, from passive eavesdropping to active disruptions like Denial of Service and Sybil attacks. These not only compromise the safety and efficiency of vehicular networks but also pose a significant risk to the stability and resilience of the Internet of Vehicles. Addressing these vulnerabilities, this paper proposes a Dynamic Forest-Structured Ensemble Network (DFSENet) specifically tailored for the Internet of Vehicles (IoV). By leveraging data-balancing techniques and dimensionality reduction, the DFSENet model is designed to detect a wide range of cyber threats effectively. The proposed model demonstrates high efficacy, with an accuracy of 99.2% on the CICIDS dataset and 98% on the car-hacking dataset. The precision, recall, and f-measure metrics stand at 95.6%, 98.8%, and 96.9%, respectively, establishing the DFSENet model as a robust solution for securing the IoV against cyber-attacks. Full article
(This article belongs to the Special Issue Intrusion Detection Systems in IoT Networks)
►▼ Show Figures

Graphical abstract

20 pages, 2708 KB  
Article
Investigating Credit Card Payment Fraud with Detection Methods Using Advanced Machine Learning
by Victor Chang, Basit Ali, Lewis Golightly, Meghana Ashok Ganatra and Muhidin Mohamed
Information 2024, 15(8), 478; https://doi.org/10.3390/info15080478 - 12 Aug 2024
Cited by 31 | Viewed by 13216
Abstract
In the cybersecurity industry, where legitimate transactions far outnumber fraudulent ones, detecting fraud is of paramount significance. In order to evaluate the accuracy of detecting fraudulent transactions in imbalanced real datasets, this study compares the efficacy of two approaches, random under-sampling and oversampling, [...] Read more.
In the cybersecurity industry, where legitimate transactions far outnumber fraudulent ones, detecting fraud is of paramount significance. In order to evaluate the accuracy of detecting fraudulent transactions in imbalanced real datasets, this study compares the efficacy of two approaches, random under-sampling and oversampling, using the synthetic minority over-sampling technique (SMOTE). Random under-sampling aims for fairness by excluding examples from the majority class, but this compromises precision in favor of recall. To strike a balance and ensure statistical significance, SMOTE was used instead to produce artificial examples of the minority class. Based on the data obtained, it is clear that random under-sampling achieves high recall (92.86%) at the expense of low precision, whereas SMOTE achieves a higher accuracy (86.75%) and a more even F1 score (73.47%) at the expense of a slightly lower recall. As true fraudulent transactions require at least two methods for verification, we investigated different machine learning methods and made suitable balances between accuracy, F1 score, and recall. Our comparison sheds light on the subtleties and ramifications of each approach, allowing professionals in the field of cybersecurity to better choose the approach that best meets the needs of their own firm. This research highlights the need to resolve class imbalances for effective fraud detection in cybersecurity, as well as the need for constant monitoring and the investigation of new approaches to increase applicability. Full article
(This article belongs to the Special Issue Intrusion Detection Systems in IoT Networks)
►▼ Show Figures

Figure 1

15 pages, 2488 KB  
Article
Extended Isolation Forest for Intrusion Detection in Zeek Data
by Fariha Moomtaheen, Sikha S. Bagui, Subhash C. Bagui and Dustin Mink
Information 2024, 15(7), 404; https://doi.org/10.3390/info15070404 - 12 Jul 2024
Cited by 8 | Viewed by 5889
Abstract
The novelty of this paper is in determining and using hyperparameters to improve the Extended Isolation Forest (EIF) algorithm, a relatively new algorithm, to detect malicious activities in network traffic. The EIF algorithm is a variation of the Isolation Forest algorithm, known for [...] Read more.
The novelty of this paper is in determining and using hyperparameters to improve the Extended Isolation Forest (EIF) algorithm, a relatively new algorithm, to detect malicious activities in network traffic. The EIF algorithm is a variation of the Isolation Forest algorithm, known for its efficacy in detecting anomalies in high-dimensional data. Our research assesses the performance of the EIF model on a newly created dataset composed of Zeek Connection Logs, UWF-ZeekDataFall22. To handle the enormous volume of data involved in this research, the Hadoop Distributed File System (HDFS) is employed for efficient and fault-tolerant storage, and the Apache Spark framework, a powerful open-source Big Data analytics platform, is utilized for machine learning (ML) tasks. The best results for the EIF algorithm came from the 0-extension level. We received an accuracy of 82.3% for the Resource Development tactic, 82.21% for the Reconnaissance tactic, and 78.3% for the Discovery tactic. Full article
(This article belongs to the Special Issue Intrusion Detection Systems in IoT Networks)
►▼ Show Figures

Figure 1

Show export options expand_more Show export options expand_less
Select all
Export citation of selected articles as:
 
Displaying articles 1-7
Back to TopTop