Next Article in Journal
CPCROK: A Communication-Efficient and Privacy-Preserving Scheme for Low-Density Vehicular Ad Hoc Networks
Previous Article in Journal
A Systematic Review on the Combination of VR, IoT and AI Technologies, and Their Integration in Applications
 
 
Font Type:
Arial Georgia Verdana
Font Size:
Aa Aa Aa
Line Spacing:
Column Width:
Background:
Article

A Transformer-Based Autoencoder with Isolation Forest and XGBoost for Malfunction and Intrusion Detection in Wireless Sensor Networks for Forest Fire Prediction

Department of Computer Science, New Mexico Tech, Socorro, NM 87801, USA
*
Author to whom correspondence should be addressed.
These authors contributed equally to this work.
Future Internet 2025, 17(4), 164; https://doi.org/10.3390/fi17040164
Submission received: 27 February 2025 / Revised: 27 March 2025 / Accepted: 7 April 2025 / Published: 9 April 2025
(This article belongs to the Special Issue Wireless Sensor Networks and Internet of Things)

Abstract

:
Wireless Sensor Networks (WSNs) play a critical role in environmental monitoring and early forest fire detection. However, they are susceptible to sensor malfunctions and network intrusions, which can compromise data integrity and lead to false alarms or missed detections. This study presents a hybrid anomaly detection framework that integrates a Transformer-based Autoencoder, Isolation Forest, and XGBoost to effectively classify normal sensor behavior, malfunctions, and intrusions. The Transformer Autoencoder models spatiotemporal dependencies in sensor data, while adaptive thresholding dynamically adjusts sensitivity to anomalies. Isolation Forest provides unsupervised anomaly validation, and XGBoost further refines classification, enhancing detection precision. Experimental evaluation using real-world sensor data demonstrates that our model achieves 95% accuracy, with high recall for intrusion detection, minimizing false negatives. The proposed approach improves the reliability of WSN-based fire monitoring by reducing false alarms, adapting to dynamic environmental conditions, and distinguishing between hardware failures and security threats.

1. Introduction

Wireless Sensor Networks (WSNs) have become indispensable for monitoring and detecting critical environmental events such as forest fires, earthquakes, tsunamis, and border intrusions. These networks consist of distributed sensor nodes that continuously collect and transmit environmental data, enabling real-time decision making and rapid emergency response [1]. In the case of forest fire detection, WSNs offer a cost-effective and scalable solution by monitoring key environmental parameters—such as temperature, humidity, smoke, and light—in remote and often inaccessible locations. By detecting early warning signs such as sudden temperature spikes or abnormal smoke levels, WSNs can trigger timely alerts and help prevent large-scale disasters [2].
However, as WSNs become more widespread and integral to critical applications, ensuring their security and reliability has become a major challenge. Sensor malfunctions and network intrusions pose serious threats to data integrity, leading to false alarms or, worse, missed detections. Large-scale WSNs, often composed of hundreds or thousands of sensor nodes, are particularly vulnerable. These nodes are typically deployed in unprotected environments, making them susceptible to physical tampering, environmental damage, and cyberattacks [3,4]. Additionally, the wireless communication medium exposes these networks to interception, jamming, and false data injection attacks, which can compromise the accuracy of forest fire detection systems [5,6]. Therefore, an effective anomaly detection framework must not only identify deviations from normal sensor behavior but also distinguish between sensor malfunctions and external intrusions to ensure accurate classification and mitigation.
Traditional anomaly detection methods in WSNs rely on statistical models, clustering algorithms, and rule-based systems, but they often struggle to adapt to dynamic environmental conditions and large-scale sensor deployments [7]. Recent advances in machine learning and deep learning, particularly Autoencoders, have shown great promise in learning complex patterns from sensor data and detecting anomalies. Transformer-based Autoencoders, in particular, leverage self-attention mechanisms to capture spatiotemporal dependencies, making them well-suited for processing time-series data in WSNs [8,9]. However, while Autoencoders effectively detect anomalies, they do not inherently distinguish between malfunctions and intrusions, which is a crucial requirement for reliable WSN security and fire detection [10].
To address this gap, we propose a hybrid anomaly detection framework that integrates:
A Transformer-based Autoencoder to learn normal sensor behavior and detect anomalies based on reconstruction errors. Adaptive thresholding to dynamically adjust anomaly sensitivity based on recent data trends. Isolation Forest, an unsupervised anomaly detection model, to validate anomalies and provide an initial classification. And XGBoost, a supervised learning classifier, to refine anomaly classification and differentiate between sensor malfunctions and intrusions. By combining these techniques, our approach not only detects anomalies more effectively but also ensures precise classification, reducing false positives and improving real-time decision making. Experimental results demonstrate that our hybrid framework achieves 95% accuracy, significantly improving intrusion detection and malfunction identification compared to conventional methods.
The insights gained from this research extend beyond forest fire monitoring and can be applied to other domains such as IoT security, industrial process monitoring, and healthcare anomaly detection, where identifying both hardware failures and external cyber threats is crucial [11,12].
The remainder of this paper is organized as follows: Section 2 reviews previous research on WSN intrusion and malfunction classification; Section 3 describes our approach, including data collection, preprocessing steps, and the use of Transformer-based Autoencoder, Isolation Forest, and XGBoost; Section 4 presents the simulation results; Section 5 discussed the outcome of current work; and Section 6 is the conclusion and future directions.

2. Related Works

Recent advancements in anomaly detection for Wireless Sensor Networks (WSNs) have leveraged deep learning, self-supervised methods, and hybrid optimizations to improve detection accuracy and scalability. However, many of these approaches face challenges in handling multimodal data, ensuring real-time performance, and reducing computational overhead. This section reviews recent works in WSN anomaly detection, categorizing them based on their methodologies and highlighting key strengths and limitations.

2.1. Graph-Based and Self-Supervised Approaches

Graph-based learning techniques have gained traction for anomaly detection in WSNs due to their ability to capture spatial relationships between sensor nodes. The authors in [13] introduced a self-supervised learning approach that integrates temporal, spatial, and intermodal features into an Autoencoder-based model. Their method extracts temporal dependencies using fully connected networks, while graph neural networks (GNNs) incorporate WSN topology, capturing both local and global node interactions. The study demonstrates high detection accuracy (90.6%), outperforming conventional models. However, the method struggles with scalability, as processing multimodal data introduces computational bottlenecks, making real-time deployment challenging.
Similarly, the authors in [14] explored deep learning models for WSN-based anomaly detection, emphasizing energy-efficient processing and real-time inference. Their research discusses challenges such as limited memory, energy-intensive computations, and network latency—issues that are particularly relevant for large-scale deployments. While the study highlights solutions like model compression, federated learning, and edge computing, these techniques often come at the cost of reduced detection precision. Unlike the authors in [13], who rely on centralized graph learning, the authors in [14] propose distributed deep learning frameworks, making their approach more scalable but potentially less accurate for fine-grained anomaly detection.
Both approaches offer valuable insights, yet they share a common limitation: reliance on unsupervised learning for feature extraction. This often results in high false positive rates, as the models fail to distinguish between intrusions (malicious attacks) and sensor malfunctions. In contrast, our proposed work integrates a Transformer-based Autoencoder with a hybrid classification model (Isolation Forest + XGBoost) to improve the differentiation of anomaly types.

2.2. AI-Driven Anomaly Detection in IoT and WSN Security

With the rise in IoT-based WSNs, security threats have become more complex, requiring intelligent intrusion detection systems (IDSs). The authors in [15] reviewed machine learning (ML) and deep learning (DL) techniques for anomaly detection in IoT networks, discussing their effectiveness in detecting brute force attacks, SQL injections, and DDoS attacks. The paper highlights the need for real-time detection and diverse datasets, as many ML-based IDSs struggle to generalize beyond training conditions.
The study points out that while AI-driven IDSs improve intrusion detection accuracy, they suffer from scalability issues and high computational overhead. Their conclusion emphasizes the need for dynamic, adaptive models, such as reinforcement learning and blockchain-based IDS solutions. However, the reliance on static training data limits their ability to adapt to evolving attack patterns in real time. Our work addresses this by integrating real-time anomaly detection with an adaptive classification system, allowing it to distinguish between cyber intrusions and sensor malfunctions dynamically.

2.3. Hybrid Optimization and Anomaly Detection in Sensor Networks

Hybrid approaches that combine optimization techniques with machine learning have been explored to enhance anomaly detection accuracy and efficiency. The authors in [16] proposed a hybrid AI optimization method (AHGFFA) for MANET-IoT sensor networks, integrating unsupervised learning for threat detection with a secure group-based routing algorithm. Their work effectively mitigates risks like Blackhole and Grayhole attacks, improving network security. However, their system relies on predefined trust thresholds, making it less adaptable to new attack patterns.
Similarly, the authors in [17] introduced a convolutional Autoencoder combined with Bi-Directional Gated Recurrent Units (GRUs) for monitoring heat pump anomalies in industrial systems. Their work shows promising results, particularly in detecting anomalies without labeled data. However, challenges such as noisy labels and limited generalization to different sensor types remain significant. Unlike these methods, our proposed approach focuses on real-time adaptability and low-latency classification, making it more suitable for high-risk environments like forest fire monitoring.

2.4. Summary and Key Takeaways

Across these related works, several key trends emerge:
  • Graph-based anomaly detection ([13,14]) improves detection accuracy but suffers from scalability issues.
  • AI-driven IDSs ([15]) enhance network security but lack real-time adaptability.
  • Hybrid ML approaches ([16,17]) show promise in anomaly detection but require optimization for large-scale deployment.
Unlike previous studies, our Transformer Autoencoder + Hybrid Classifier (Isolation Forest + XGBoost) model does the following:
  • Learns both spatial and temporal patterns for anomaly detection.
  • Differentiates between sensor malfunctions and cyber intrusions in real time.
  • Optimizes computational efficiency for large-scale WSN deployments.
This hybrid methodology bridges the gap between existing deep-learning-based anomaly detection and real-time classification, making it a novel and practical approach for Wireless Sensor Network security.

3. Materials and Methods

Wireless Sensor Networks (WSNs) play a critical role in environmental monitoring, particularly for early forest fire detection. However, these networks are susceptible to sensor malfunctions and malicious intrusions that can compromise the accuracy of the collected data. In this study, we develop a robust anomaly detection and classification framework that integrates a Transformer-based Autoencoder with Isolation Forest and XGBoost classifiers. This section details the methodology adopted in the research, including data preprocessing, anomaly detection, classification, and visualization.

3.1. Dataset Description

3.1.1. Data Collection Environment

The dataset utilized in this study was collected from an emulated environment designed to mimic real-world forest conditions. A total of 15 sensor nodes were deployed within this controlled setting, each responsible for continuously capturing environmental parameters relevant to forest fire prediction. The emulation allowed us to simulate various fire scenarios, sensor malfunctions, and intrusion attempts while ensuring data integrity and reproducibility [4].

3.1.2. Sensor Configuration and Parameters

Each sensor node in the network recorded multiple environmental parameters at predefined intervals, capturing the temporal and spatial variations essential for anomaly detection. The recorded features include the following:
  • Temperature (°C)—measures the ambient temperature variations.
  • Smoke density—indicates the concentration of smoke particles.
  • Light intensity—measures variations in natural and artificial light sources.
  • Sound levels (dB)—monitors abnormal noise patterns that may indicate external disturbances.
Each sensor node was strategically placed to ensure comprehensive coverage of the emulated environment. The collected data were timestamped, enabling temporal analysis and sequence-based learning models.

3.2. Dataset Statistics

The final dataset consists of multiple time-series records, with each instance representing a 10 s window of collected data from 15 sensor nodes. A summary of the dataset characteristics is provided in Table 1.
The dataset is the foundation for training and evaluating the hybrid anomaly detection model. By leveraging both unsupervised learning (Autoencoder and Isolation Forest) and supervised learning (XGBoost with SMOTE), our approach ensures robustness in detecting both sensor faults and network intrusions while minimizing false positives.

3.3. Feature Engineering

We derived additional features beyond the raw sensor readings to improve the model’s ability to detect anomalies.

Rate of Change

To capture sudden fluctuations in sensor readings, we computed the first-order difference:
Δ X t = X t X t 1
where X t represents the sensor value at time t. This was calculated for the following:
  • Temperature (temp_change).
  • Smoke (smoke_change).
  • Sound (sound_change).

3.4. Data Preprocessing and Augmentation

To improve the dataset quality and enhance model performance, several preprocessing techniques [18] were applied:
  • Handling missing values: missing data points were handled using forward and backward filling interpolation to ensure continuity in sensor readings.
  • Feature engineering: Additional statistical and temporal features were computed to capture hidden patterns in sensor behavior [19], including the following:
    -
    Rate of change: first-order differences for sensor values to detect abrupt fluctuations.
    -
    Rolling window statistics: Short-term variability indicators such as standard deviation over a 5 time step window [20]. A rolling window approach was applied to compute short-term fluctuations. The standard deviation over a window of N = 5 time steps was computed as:
    σ t = 1 N i = t N t ( X i X ¯ ) 2
    where X ¯ is the mean over the window. These features helped capture sensor variability over time.
    -
    Z-score normalization: Standardization of sensor readings to account for scale differences. To normalize the feature values and make them comparable across sensors, we applied Z-score normalization:
    Z i = X i μ σ
    where μ and σ represent the mean and standard deviation, respectively.
  • Unsupervised anomaly labeling: Since the dataset did not contain predefined labels for anomalies, a hybrid anomaly detection framework was used to categorize data into the following:
    -
    Normal data: Regular environmental conditions with no detected anomalies.
    -
    Malfunctions: Sensor faults or hardware failures, detected using reconstruction error from the Transformer Autoencoder and further validated by Isolation Forest.
    -
    Intrusions: external interferences or false data injections, identified based on Isolation Forest classification and XGBoost refinement.
  • Min–max scaling: finally, all features were rescaled to the range [ 0 , 1 ] using min–max normalization, ensuring that no feature dominated the model’s learning process.

3.5. Hybrid Anomaly Detection Model

Transformer-Based Autoencoder for Anomaly Detection

The Transformer-based Autoencoder [21] was implemented using Python and the TensorFlow 2.x library with the Keras API [22]. The model is designed to capture temporal dependencies in multi-sensor time series and detect deviations from normal behavior. This subsection details the architecture, training parameters, and tools used to ensure full reproducibility. The Transformer-based Autoencoder was implemented using Python 3.11.11 (Python Software Foundation, Wilmington, DE, USA) and TensorFlow 2.18.0 (Google LLC, Mountain View, CA, USA) with the Keras API [22].
  • Input shape: ( 10 , 15 ) , representing 10 time steps of 15 engineered features per window. These features include raw sensor readings (temperature, smoke, sound, and light), their first-order differences (the rate of change), rolling window variability (the standard deviation), and z-score normalized values. The full feature list is detailed in the Feature Engineering subsection.
  • Encoder:
    -
    A GRU layer with 64 units and ReLU activation (return_sequences=True) to capture short-term dependencies.
    -
    An LSTM layer with 32 units and ReLU activation (return_sequences=False) for long-term feature encoding.
  • Bottleneck: a RepeatVector(10) layer expands the latent representation across the time dimension for decoding.
  • Decoder:
    -
    An LSTM layer with 32 units (return_sequences=True).
    -
    A GRU layer with 64 units (return_sequences=True).
    -
    A TimeDistributed(Dense) layer to reconstruct the original feature dimensions.
  • Loss function: the Mean Squared Error (MSE), computed between the input and the reconstructed output.
  • Optimizer: the Adam optimizer with a learning rate of 0.001.
  • Training Configuration: Fifty epochs with a batch size of 32.
  • Training and Prediction: The Autoencoder was trained on sequences of 10 time steps to learn the normal operating conditions of the sensors. Once trained, it was used to predict sensor readings, and the reconstruction error was computed.

3.6. Anomaly Detection and Classification

3.6.1. Dynamic Anomaly Thresholding

The Transformer-based Autoencoder was trained to reconstruct normal sensor behavior. The reconstruction error was used to detect anomalies using an adaptive threshold. Data points exceeding the threshold were classified as anomalies and further processed using the Isolation Forest and XGBoost classifiers.
To further refine anomaly detection, a dynamic thresholding [23] approach was applied:
T adaptive = μ rec + k σ rec
where μ rec and σ rec represent the rolling mean and standard deviation of the reconstruction errors, respectively, and k is an adjustable sensitivity factor. This method improves robustness against fluctuating sensor readings.

3.6.2. Isolation Forest for Initial Anomaly Classification

To distinguish between intrusions and malfunctions, we applied the Isolation Forest algorithm, which identifies anomalies based on how quickly they can be isolated in the feature space [24]. The model classified the following:
  • Class 1 (intrusions): anomalies caused by unauthorized access or external interference.
  • Class 2 (malfunctions): sensor faults or hardware failures.

3.6.3. Oversampling with SMOTE

Since the dataset was imbalanced, we applied the Synthetic Minority Oversampling Technique (SMOTE) to balance the classes. This method generated synthetic samples for anomalies (intrusions and malfunctions) to improve model training [25].

3.6.4. XGBoost for Final Classification

To refine anomaly classification, we trained an XGBoost model on labeled anomaly data [26]. The model was optimized with the following:
  • Learning rate: 0.05.
  • Max depth: 8.
  • Estimators: 200.
The classifier was trained and evaluated using an 80:20 train–test split.

4. Results

This section presents the experimental results obtained from our proposed hybrid model for intrusion and malfunction detection in Wireless Sensor Networks (WSNs). The results demonstrate the effectiveness of our Transformer-based Autoencoder combined with Isolation Forest and XGBoost classifiers.

4.1. Model Evaluation

4.1.1. Evaluation Metrics

The performance of the classification model was assessed using [27]:
  • Accuracy ( A c c ):
    A c c = T P + T N T P + T N + F P + F N
  • Precision, recall, and F1-score:
    P r e c i s i o n = T P T P + F P , R e c a l l = T P T P + F N , F 1 = 2 × P r e c i s i o n × R e c a l l P r e c i s i o n + R e c a l l
Table 2 summarizes the model’s classification performance.

4.1.2. Performance Metrics

To evaluate the model’s effectiveness, we computed [27]:
  • Precision, recall, and F1-score: these metrics assess the classification accuracy and misclassification rates for different anomaly types.
  • Confusion matrix: this metric helps analyze false positives, false negatives, and overall model performance.
The model achieved an overall accuracy of 95%, with high precision, recall, and F1-scores across all three classes, indicating a robust classification performance. The classifier correctly identified intrusions with a recall of 100%, ensuring minimal false negatives for intrusion detection.

4.1.3. Counting Detected Intrusions and Malfunctions

The number of detected intrusions and malfunctions was determined based on the final XGBoost model’s predictions. Table 3 provides the actual distribution of detected anomalies.

4.2. Visualization

To better understand the model’s performance, we visualized reconstruction errors using scatter plots shown in Figure 1. The identified anomalies are categorized as follows:
  • Normal data: represented in gray, which are below the dotted threshold lines which are identified as normal data.
  • Malfunctions: represented in blue, which are anomalies but very close to the dotted threshold lines, so marked as malfunction.
  • Intrusions: represented in magenta, which are anomalies but far from the dotted threshold lines, so marked as intrusions.

4.3. Key Findings and Impact

  • Robust anomaly detection: the hybrid model effectively detected anomalies with high recall, minimizing false negatives.
  • Adaptive thresholding: the dynamic anomaly thresholding approach improved robustness against environmental variations.
  • Intrusion vs. malfunction differentiation: the combination of Isolation Forest and XGBoost effectively classified anomalies into their respective categories.
  • Classifier sensitivity: some malfunction points (blue dots) appeared above the threshold, suggesting that the classifier identified them based on subtle feature patterns beyond reconstruction error.
The results highlight the potential of using hybrid AI-based anomaly detection frameworks in forest fire monitoring. Future research will explore further refinements in real-time detection, sensor fusion techniques, and improved generalization under diverse environmental conditions.

5. Discussion

The proposed Transformer-based Autoencoder framework effectively models normal sensor behavior while distinguishing between sensor malfunctions and network intrusions. The concentration of reconstruction errors near zero for normal data confirms that the model efficiently captures normal sensor patterns. By integrating Isolation Forest and XGBoost with adaptive thresholding, our hybrid anomaly detection approach outperforms static threshold-based methods in detecting intrusions and malfunctions in Wireless Sensor Networks (WSNs).

5.1. Comparison with Related Work

To highlight the effectiveness of our approach, we compare it with recent anomaly detection and network security methods for WSNs. Table 4 summarizes the key differences between our framework and existing approaches.

5.2. Key Observations

  • Effective malfunction identification: The model reliably detected faulty sensors—such as those producing constant or zero values over time—by leveraging the reconstruction error profile from the Transformer Autoencoder and confirming with Isolation Forest. This prevents the propagation of corrupted data across the network.
  • Improved intrusion discrimination: By integrating Isolation Forest with XGBoost, the system was able to distinguish between sensor malfunctions and external intrusions more accurately. This dual-stage classification significantly reduced the confusion between hardware failures and malicious behavior.
  • Benefit of adaptive thresholding: The use of dynamic, data-driven thresholding (based on rolling mean and standard deviation) provided robust anomaly sensitivity while minimizing false positives. This approach is particularly effective in handling the inherent noise and variability in WSN data streams.

5.3. Areas for Further Improvement

  • Reinforcement learning for dynamic thresholding: while our current adaptive method uses statistical boundaries, future enhancements could involve reinforcement learning to learn optimal threshold adjustments in real time, tailored to evolving sensor behavior.
  • Temporal modeling extension: Although the hybrid Autoencoder already captures short-term dependencies, incorporating additional layers of GRUs or bidirectional LSTMs may further improve its capability to learn long-term temporal patterns, especially under subtle or gradual anomalies.
  • Ensemble-based hybrid detection: the classification phase could be enhanced by ensembling multiple classifiers (e.g., SVM, Random Forest, Deep Neural Networks) alongside XGBoost, using majority voting or stacking to boost anomaly classification robustness in diverse deployment scenarios.
In summary, the proposed hybrid framework—integrating a Transformer-based Autoencoder with Isolation Forest and XGBoost—demonstrates strong potential for anomaly classification in real-time Wireless Sensor Network applications. It supports high granularity in distinguishing malfunctioning nodes from intrusion attempts, which is critical for reliable forest fire monitoring. The architecture’s modular design and use of open-source tools also ensure its reproducibility and extensibility in future deployments.

6. Conclusions

This study proposed a hybrid anomaly detection framework tailored for Wireless Sensor Networks (WSNs) in forest fire monitoring scenarios. By combining a Transformer-based Autoencoder with Isolation Forest and XGBoost, the model effectively captured temporal patterns and classified anomalies into sensor malfunctions and intrusions with high precision. The integration of adaptive thresholding further enhanced robustness by reducing false positives under varying sensor dynamics. The framework achieved a classification accuracy of 95%, demonstrating its capability to improve the reliability of critical environmental monitoring systems. Unlike conventional methods that focus solely on anomaly detection, our approach emphasizes fine-grained anomaly classification, which is essential for early warning systems and network resilience. Future work will focus on real-world deployment, computational optimization for edge devices, and self-adaptive learning to enable continuous improvement without retraining. Additionally, the proposed architecture has the potential to be generalized across domains such as industrial IoT, disaster prediction, and healthcare monitoring, which we plan to explore through transfer learning strategies.

Author Contributions

Conceptualization, H.S. and A.H.; methodology, A.H. and H.S.; software, A.H.; validation, A.H. and H.S.; formal analysis, H.S. and A.H.; investigation, A.H.; resources, A.H.; data curation, A.H.; writing—original draft preparation, A.H.; writing—review and editing, H.S.; visualization, A.H. and H.S.; supervision, H.S.; project administration, H.S.; funding acquisition, H.S. and A.H. All authors have read and agreed to the published version of the manuscript.

Funding

This research received no external funding.

Data Availability Statement

The raw data supporting the conclusions of this article will be made available by the authors upon request.

Conflicts of Interest

On behalf of all authors, the corresponding author states that there are no conflicts of interest.

References

  1. Selvam, A.P.; Al-Humairi, S.N.S. Environmental impact evaluation using smart real-time weather monitoring systems: A systematic review. Innov. Infrastruct. Solut. 2025, 10, 13. [Google Scholar] [CrossRef]
  2. Talukder, M.A.; Khalid, M.; Sultana, N. A hybrid machine learning model for intrusion detection in wireless sensor networks leveraging data balancing and dimensionality reduction. Sci. Rep. 2025, 15, 4617. [Google Scholar] [CrossRef]
  3. Birahim, S.A.; Paul, A.; Rahman, F.; Islam, Y.; Roy, T.; Hasan, M.A.; Haque, F.; Chowdhury, M.E. Intrusion Detection for Wireless Sensor Network Using Particle Swarm Optimization Based Explainable Ensemble Machine Learning Approach. IEEE Access 2025, 13, 13711–13730. [Google Scholar] [CrossRef]
  4. Soliman, H.; Haque, A. A Smart and Secure Wireless Sensor Network for Early Forest Fire Prediction: An Emulated Scenario Approach. In Advances in Information and Communication (FICC 2025); Lecture Notes in Networks and Systems; Arai, K., Ed.; Springer: Cham, Switzerland, 2025; Volume 1284. [Google Scholar] [CrossRef]
  5. Haque, A.; Soliman, H. Smart Wireless Sensor Networks with Virtual Sensors for Forest Fire Evolution Prediction Using Machine Learning. Electronics 2025, 14, 223. [Google Scholar] [CrossRef]
  6. Mittal, M.; de Prado, R.P.; Kawai, Y.; Nakajima, S.; Muñoz-Expósito, J.E. Machine Learning Techniques for Energy Efficiency and Anomaly Detection in Hybrid Wireless Sensor Networks. Energies 2021, 14, 3125. [Google Scholar] [CrossRef]
  7. Haque, A.; Chowdhury, N.U.R.; Soliman, H.; Hossen, M.S.; Fatima, T.; Ahmed, I. Wireless Sensor Networks Anomaly Detection Using Machine Learning: A Survey. In Intelligent Systems and Applications (IntelliSys 2023); Lecture Notes in Networks and Systems; Arai, K., Ed.; Springer: Cham, Switzerland, 2024; Volume 824. [Google Scholar] [CrossRef]
  8. Sadia, H.; Farhan, S.; Haq, Y.U.; Sana, R.; Mahmood, T.; Bahaj, S.A.O.; Khan, A.R. Intrusion Detection System for Wireless Sensor Networks: A Machine Learning Based Approach. IEEE Access 2024, 12, 52565–52582. [Google Scholar] [CrossRef]
  9. Ghadi, Y.Y.; Mazhar, T.; Al Shloul, T.; Shahzad, T.; Salaria, U.A.; Ahmed, A.; Hamam, H. Machine Learning Solutions for the Security of Wireless Sensor Networks: A Review. IEEE Access 2024, 12, 12699–12719. [Google Scholar] [CrossRef]
  10. Sharma, H.; Haque, A.; Blaabjerg, F. Machine Learning in Wireless Sensor Networks for Smart Cities: A Survey. Electronics 2021, 10, 1012. [Google Scholar] [CrossRef]
  11. Dwivedi, R.K.; Pandey, S.; Kumar, R. A Study on Machine Learning Approaches for Outlier Detection in Wireless Sensor Network. In Proceedings of the 8th International Conference on Cloud Computing, Data Science & Engineering (Confluence), Noida, India, 11–12 January 2018; pp. 189–192. [Google Scholar] [CrossRef]
  12. Ayadi, H.; Zouinkhi, A.; Boussaid, B.; Abdelkrim, M.N. A machine learning methods: Outlier detection in WSN. In Proceedings of the 16th International Conference on Sciences and Techniques of Automatic Control and Computer Engineering (STA), Monastir, Tunisia, 21–23 December 2015; pp. 722–727. [Google Scholar] [CrossRef]
  13. Ye, M.; Zhang, Q.; Xue, X.; Wang, Y.; Jiang, Q.; Qiu, H. A Novel Self-Supervised Learning-Based Anomalous Node Detection Method Based on an Autoencoder for Wireless Sensor Networks. IEEE Syst. J. 2024, 18, 256–267. [Google Scholar] [CrossRef]
  14. Qiu, Y.; Ma, L.; Priyadarshi, R. Deep Learning Challenges and Prospects in Wireless Sensor Network Deployment. Arch. Computat. Methods Eng. 2024, 31, 3231–3254. [Google Scholar] [CrossRef]
  15. Rafique, S.H.; Abdallah, A.; Musa, N.S.; Murugan, T. Machine Learning and Deep Learning Techniques for Internet of Things Network Anomaly Detection—Current Research Trends. Sensors 2024, 24, 1968. [Google Scholar] [CrossRef] [PubMed]
  16. Alangari, S. An Unsupervised Machine Learning Algorithm for Attack and Anomaly Detection in IoT Sensors. Wireless Pers. Commun. 2024, 138, 1–23. [Google Scholar] [CrossRef]
  17. John, L.S.; Yoon, S.; Li, J.; Wang, P. Anomaly detection using convolutional autoencoder with residual gated recurrent unit and weak supervision for photovoltaic thermal heat pump system. J. Build. Eng. 2025, 100, 111694. [Google Scholar] [CrossRef]
  18. Fernández, A.; García, S.; Galar, M.; Prati, R.C.; Krawczyk, B.; Herrera, F. Data level preprocessing methods. In Learning from Imbalanced Data Sets; Springer: Cham, Switzerland, 2018. [Google Scholar] [CrossRef]
  19. Uddin, M.F.; Lee, J.; Rizvi, S.; Hamada, S. Proposing Enhanced Feature Engineering and a Selection Model for Machine Learning Processes. Appl. Sci. 2018, 8, 646. [Google Scholar] [CrossRef]
  20. Zivot, E.; Wang, J. Rolling Analysis of Time Series. In Modeling Financial Time Series with S-Plus®; Springer: New York, NY, USA, 2003. [Google Scholar] [CrossRef]
  21. Wu, Z.; Wang, B. Transformer-Based Autoencoder Framework for Nonlinear Hyperspectral Anomaly Detection. IEEE Trans. Geosci. Remote. Sens. 2024, 62, 5508015. [Google Scholar] [CrossRef]
  22. Ertam, F.; Aydın, G. Data classification with deep learning using Tensorflow. In Proceedings of the International Conference on Computer Science and Engineering (UBMK), Antalya, Turkey, 5–8 October 2017; pp. 755–758. [Google Scholar] [CrossRef]
  23. Hundman, K.; Constantinou, V.; Laporte, C.; Colwell, I.; Soderstrom, T. Detecting Spacecraft Anomalies Using LSTMs and Nonparametric Dynamic Thresholding. In Proceedings of the 24th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining (KDD ’18), London, UK, 19–23 August 2018; Association for Computing Machinery: New York, NY, USA, 2018; pp. 387–395. [Google Scholar] [CrossRef]
  24. Liu, F.T.; Ting, K.M.; Zhou, Z.-H. Isolation Forest. In Proceedings of the 8th IEEE International Conference on Data Mining, Pisa, Italy, 15–19 December 2008; pp. 413–422. [Google Scholar] [CrossRef]
  25. Blagus, R.; Lusa, L. SMOTE for high-dimensional class-imbalanced data. BMC Bioinform. 2013, 14, 106. [Google Scholar] [CrossRef] [PubMed]
  26. Chen, T.; Guestrin, C. XGBoost: A Scalable Tree Boosting System. In Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining (KDD ’16), San Francisco, CA, USA, 13–17 August 2016; Association for Computing Machinery: New York, NY, USA, 2016; pp. 785–794. [Google Scholar] [CrossRef]
  27. Rainio, O.; Teuho, J.; Klén, R. Evaluation metrics and statistical tests for machine learning. Sci. Rep. 2024, 14, 6086. [Google Scholar] [CrossRef] [PubMed]
Figure 1. Intrusion vs. malfunction classification (optimized hybrid model).
Figure 1. Intrusion vs. malfunction classification (optimized hybrid model).
Futureinternet 17 00164 g001
Table 1. Summary of dataset statistics.
Table 1. Summary of dataset statistics.
FeatureCount
Total sensor nodes15
Total data points14,776
Sampling interval10 s
Table 2. XGBoost classification performance.
Table 2. XGBoost classification performance.
ClassPrecisionRecallF1-ScoreSupport
Normal (0)0.950.900.923005
Intrusion (1)0.991.000.992899
Malfunction (2)0.910.950.932955
Accuracy0.95
Macro Avg0.950.950.948859
Weighted Avg0.950.950.948859
Table 3. Detected intrusions and malfunctions.
Table 3. Detected intrusions and malfunctions.
Anomaly TypeCount
Malfunctions3093
Intrusions2926
Table 4. Comparison of related works with our approach.
Table 4. Comparison of related works with our approach.
Aspect [13] [14] [15] [16] [17]Our Work
Core objectiveDetect anomalies in WSN dataApply deep learning in WSN environmentsIdentify intrusions in IoT trafficOptimize MANET-based IoT securityDetect anomalies in heat pump operationsClassify anomalies (malfunction vs. intrusion) in WSNs for forest fire monitoring
Method overviewAutoencoder + GNN fusionFederated deep learning with edge devicesML/DL-based intrusion detection systemsEnsemble classifiers with filteringCNN-BiGRU for time-series predictionTransformer Autoencoder + Isolation Forest + XGBoost with adaptive thresholding
Anomaly classificationNo (detection only)NoNo (intrusion only)NoNoYes—separates sensor malfunction and intrusions
AdaptivityLearns spatiotemporal correlationsModel optimization across devicesLearns IDS modelsStatic ML-based decisionsTime-series-driven CNN learningAdaptive thresholding and hybrid classification pipeline
Deployment contextWSN data streamsIndustrial WSNsIoT device trafficMANET + IoT mixEnergy systemsEnvironmental WSN (forest fire prediction and emulated testbed)
Limitations statedHigh compute overheadHeavy memory useLacks real-time supportNo dynamic behaviorImpacted by sensor noiseSensitive to extreme forest fire scenarios
ReproducibilityModerate—model onlyNo code releaseReview paperSimulation-basedModel specificDetailed architecture + open-source libraries (TensorFlow, Scikit-learn, XGBoost)
Disclaimer/Publisher’s Note: The statements, opinions and data contained in all publications are solely those of the individual author(s) and contributor(s) and not of MDPI and/or the editor(s). MDPI and/or the editor(s) disclaim responsibility for any injury to people or property resulting from any ideas, methods, instructions or products referred to in the content.

Share and Cite

MDPI and ACS Style

Haque, A.; Soliman, H. A Transformer-Based Autoencoder with Isolation Forest and XGBoost for Malfunction and Intrusion Detection in Wireless Sensor Networks for Forest Fire Prediction. Future Internet 2025, 17, 164. https://doi.org/10.3390/fi17040164

AMA Style

Haque A, Soliman H. A Transformer-Based Autoencoder with Isolation Forest and XGBoost for Malfunction and Intrusion Detection in Wireless Sensor Networks for Forest Fire Prediction. Future Internet. 2025; 17(4):164. https://doi.org/10.3390/fi17040164

Chicago/Turabian Style

Haque, Ahshanul, and Hamdy Soliman. 2025. "A Transformer-Based Autoencoder with Isolation Forest and XGBoost for Malfunction and Intrusion Detection in Wireless Sensor Networks for Forest Fire Prediction" Future Internet 17, no. 4: 164. https://doi.org/10.3390/fi17040164

APA Style

Haque, A., & Soliman, H. (2025). A Transformer-Based Autoencoder with Isolation Forest and XGBoost for Malfunction and Intrusion Detection in Wireless Sensor Networks for Forest Fire Prediction. Future Internet, 17(4), 164. https://doi.org/10.3390/fi17040164

Note that from the first issue of 2016, this journal uses article numbers instead of page numbers. See further details here.

Article Metrics

Back to TopTop