A Transformer-Based Autoencoder with Isolation Forest and XGBoost for Malfunction and Intrusion Detection in Wireless Sensor Networks for Forest Fire Prediction
Abstract
:1. Introduction
2. Related Works
2.1. Graph-Based and Self-Supervised Approaches
2.2. AI-Driven Anomaly Detection in IoT and WSN Security
2.3. Hybrid Optimization and Anomaly Detection in Sensor Networks
2.4. Summary and Key Takeaways
- AI-driven IDSs ([15]) enhance network security but lack real-time adaptability.
- Learns both spatial and temporal patterns for anomaly detection.
- Differentiates between sensor malfunctions and cyber intrusions in real time.
- Optimizes computational efficiency for large-scale WSN deployments.
3. Materials and Methods
3.1. Dataset Description
3.1.1. Data Collection Environment
3.1.2. Sensor Configuration and Parameters
- Temperature (°C)—measures the ambient temperature variations.
- Smoke density—indicates the concentration of smoke particles.
- Light intensity—measures variations in natural and artificial light sources.
- Sound levels (dB)—monitors abnormal noise patterns that may indicate external disturbances.
3.2. Dataset Statistics
3.3. Feature Engineering
Rate of Change
- Temperature (temp_change).
- Smoke (smoke_change).
- Sound (sound_change).
3.4. Data Preprocessing and Augmentation
- Handling missing values: missing data points were handled using forward and backward filling interpolation to ensure continuity in sensor readings.
- Feature engineering: Additional statistical and temporal features were computed to capture hidden patterns in sensor behavior [19], including the following:
- -
- Rate of change: first-order differences for sensor values to detect abrupt fluctuations.
- -
- Rolling window statistics: Short-term variability indicators such as standard deviation over a 5 time step window [20]. A rolling window approach was applied to compute short-term fluctuations. The standard deviation over a window of time steps was computed as:
- -
- Z-score normalization: Standardization of sensor readings to account for scale differences. To normalize the feature values and make them comparable across sensors, we applied Z-score normalization:
- Unsupervised anomaly labeling: Since the dataset did not contain predefined labels for anomalies, a hybrid anomaly detection framework was used to categorize data into the following:
- -
- Normal data: Regular environmental conditions with no detected anomalies.
- -
- Malfunctions: Sensor faults or hardware failures, detected using reconstruction error from the Transformer Autoencoder and further validated by Isolation Forest.
- -
- Intrusions: external interferences or false data injections, identified based on Isolation Forest classification and XGBoost refinement.
- Min–max scaling: finally, all features were rescaled to the range using min–max normalization, ensuring that no feature dominated the model’s learning process.
3.5. Hybrid Anomaly Detection Model
Transformer-Based Autoencoder for Anomaly Detection
- Input shape: , representing 10 time steps of 15 engineered features per window. These features include raw sensor readings (temperature, smoke, sound, and light), their first-order differences (the rate of change), rolling window variability (the standard deviation), and z-score normalized values. The full feature list is detailed in the Feature Engineering subsection.
- Encoder:
- -
- A GRU layer with 64 units and ReLU activation (return_sequences=True) to capture short-term dependencies.
- -
- An LSTM layer with 32 units and ReLU activation (return_sequences=False) for long-term feature encoding.
- Bottleneck: a RepeatVector(10) layer expands the latent representation across the time dimension for decoding.
- Decoder:
- -
- An LSTM layer with 32 units (return_sequences=True).
- -
- A GRU layer with 64 units (return_sequences=True).
- -
- A TimeDistributed(Dense) layer to reconstruct the original feature dimensions.
- Loss function: the Mean Squared Error (MSE), computed between the input and the reconstructed output.
- Optimizer: the Adam optimizer with a learning rate of 0.001.
- Training Configuration: Fifty epochs with a batch size of 32.
- Training and Prediction: The Autoencoder was trained on sequences of 10 time steps to learn the normal operating conditions of the sensors. Once trained, it was used to predict sensor readings, and the reconstruction error was computed.
3.6. Anomaly Detection and Classification
3.6.1. Dynamic Anomaly Thresholding
3.6.2. Isolation Forest for Initial Anomaly Classification
- Class 1 (intrusions): anomalies caused by unauthorized access or external interference.
- Class 2 (malfunctions): sensor faults or hardware failures.
3.6.3. Oversampling with SMOTE
3.6.4. XGBoost for Final Classification
- Learning rate: 0.05.
- Max depth: 8.
- Estimators: 200.
4. Results
4.1. Model Evaluation
4.1.1. Evaluation Metrics
- Accuracy ():
- Precision, recall, and F1-score:
4.1.2. Performance Metrics
- Precision, recall, and F1-score: these metrics assess the classification accuracy and misclassification rates for different anomaly types.
- Confusion matrix: this metric helps analyze false positives, false negatives, and overall model performance.
4.1.3. Counting Detected Intrusions and Malfunctions
4.2. Visualization
- Normal data: represented in gray, which are below the dotted threshold lines which are identified as normal data.
- Malfunctions: represented in blue, which are anomalies but very close to the dotted threshold lines, so marked as malfunction.
- Intrusions: represented in magenta, which are anomalies but far from the dotted threshold lines, so marked as intrusions.
4.3. Key Findings and Impact
- Robust anomaly detection: the hybrid model effectively detected anomalies with high recall, minimizing false negatives.
- Adaptive thresholding: the dynamic anomaly thresholding approach improved robustness against environmental variations.
- Intrusion vs. malfunction differentiation: the combination of Isolation Forest and XGBoost effectively classified anomalies into their respective categories.
- Classifier sensitivity: some malfunction points (blue dots) appeared above the threshold, suggesting that the classifier identified them based on subtle feature patterns beyond reconstruction error.
5. Discussion
5.1. Comparison with Related Work
5.2. Key Observations
- Effective malfunction identification: The model reliably detected faulty sensors—such as those producing constant or zero values over time—by leveraging the reconstruction error profile from the Transformer Autoencoder and confirming with Isolation Forest. This prevents the propagation of corrupted data across the network.
- Improved intrusion discrimination: By integrating Isolation Forest with XGBoost, the system was able to distinguish between sensor malfunctions and external intrusions more accurately. This dual-stage classification significantly reduced the confusion between hardware failures and malicious behavior.
- Benefit of adaptive thresholding: The use of dynamic, data-driven thresholding (based on rolling mean and standard deviation) provided robust anomaly sensitivity while minimizing false positives. This approach is particularly effective in handling the inherent noise and variability in WSN data streams.
5.3. Areas for Further Improvement
- Reinforcement learning for dynamic thresholding: while our current adaptive method uses statistical boundaries, future enhancements could involve reinforcement learning to learn optimal threshold adjustments in real time, tailored to evolving sensor behavior.
- Temporal modeling extension: Although the hybrid Autoencoder already captures short-term dependencies, incorporating additional layers of GRUs or bidirectional LSTMs may further improve its capability to learn long-term temporal patterns, especially under subtle or gradual anomalies.
- Ensemble-based hybrid detection: the classification phase could be enhanced by ensembling multiple classifiers (e.g., SVM, Random Forest, Deep Neural Networks) alongside XGBoost, using majority voting or stacking to boost anomaly classification robustness in diverse deployment scenarios.
6. Conclusions
Author Contributions
Funding
Data Availability Statement
Conflicts of Interest
References
- Selvam, A.P.; Al-Humairi, S.N.S. Environmental impact evaluation using smart real-time weather monitoring systems: A systematic review. Innov. Infrastruct. Solut. 2025, 10, 13. [Google Scholar] [CrossRef]
- Talukder, M.A.; Khalid, M.; Sultana, N. A hybrid machine learning model for intrusion detection in wireless sensor networks leveraging data balancing and dimensionality reduction. Sci. Rep. 2025, 15, 4617. [Google Scholar] [CrossRef]
- Birahim, S.A.; Paul, A.; Rahman, F.; Islam, Y.; Roy, T.; Hasan, M.A.; Haque, F.; Chowdhury, M.E. Intrusion Detection for Wireless Sensor Network Using Particle Swarm Optimization Based Explainable Ensemble Machine Learning Approach. IEEE Access 2025, 13, 13711–13730. [Google Scholar] [CrossRef]
- Soliman, H.; Haque, A. A Smart and Secure Wireless Sensor Network for Early Forest Fire Prediction: An Emulated Scenario Approach. In Advances in Information and Communication (FICC 2025); Lecture Notes in Networks and Systems; Arai, K., Ed.; Springer: Cham, Switzerland, 2025; Volume 1284. [Google Scholar] [CrossRef]
- Haque, A.; Soliman, H. Smart Wireless Sensor Networks with Virtual Sensors for Forest Fire Evolution Prediction Using Machine Learning. Electronics 2025, 14, 223. [Google Scholar] [CrossRef]
- Mittal, M.; de Prado, R.P.; Kawai, Y.; Nakajima, S.; Muñoz-Expósito, J.E. Machine Learning Techniques for Energy Efficiency and Anomaly Detection in Hybrid Wireless Sensor Networks. Energies 2021, 14, 3125. [Google Scholar] [CrossRef]
- Haque, A.; Chowdhury, N.U.R.; Soliman, H.; Hossen, M.S.; Fatima, T.; Ahmed, I. Wireless Sensor Networks Anomaly Detection Using Machine Learning: A Survey. In Intelligent Systems and Applications (IntelliSys 2023); Lecture Notes in Networks and Systems; Arai, K., Ed.; Springer: Cham, Switzerland, 2024; Volume 824. [Google Scholar] [CrossRef]
- Sadia, H.; Farhan, S.; Haq, Y.U.; Sana, R.; Mahmood, T.; Bahaj, S.A.O.; Khan, A.R. Intrusion Detection System for Wireless Sensor Networks: A Machine Learning Based Approach. IEEE Access 2024, 12, 52565–52582. [Google Scholar] [CrossRef]
- Ghadi, Y.Y.; Mazhar, T.; Al Shloul, T.; Shahzad, T.; Salaria, U.A.; Ahmed, A.; Hamam, H. Machine Learning Solutions for the Security of Wireless Sensor Networks: A Review. IEEE Access 2024, 12, 12699–12719. [Google Scholar] [CrossRef]
- Sharma, H.; Haque, A.; Blaabjerg, F. Machine Learning in Wireless Sensor Networks for Smart Cities: A Survey. Electronics 2021, 10, 1012. [Google Scholar] [CrossRef]
- Dwivedi, R.K.; Pandey, S.; Kumar, R. A Study on Machine Learning Approaches for Outlier Detection in Wireless Sensor Network. In Proceedings of the 8th International Conference on Cloud Computing, Data Science & Engineering (Confluence), Noida, India, 11–12 January 2018; pp. 189–192. [Google Scholar] [CrossRef]
- Ayadi, H.; Zouinkhi, A.; Boussaid, B.; Abdelkrim, M.N. A machine learning methods: Outlier detection in WSN. In Proceedings of the 16th International Conference on Sciences and Techniques of Automatic Control and Computer Engineering (STA), Monastir, Tunisia, 21–23 December 2015; pp. 722–727. [Google Scholar] [CrossRef]
- Ye, M.; Zhang, Q.; Xue, X.; Wang, Y.; Jiang, Q.; Qiu, H. A Novel Self-Supervised Learning-Based Anomalous Node Detection Method Based on an Autoencoder for Wireless Sensor Networks. IEEE Syst. J. 2024, 18, 256–267. [Google Scholar] [CrossRef]
- Qiu, Y.; Ma, L.; Priyadarshi, R. Deep Learning Challenges and Prospects in Wireless Sensor Network Deployment. Arch. Computat. Methods Eng. 2024, 31, 3231–3254. [Google Scholar] [CrossRef]
- Rafique, S.H.; Abdallah, A.; Musa, N.S.; Murugan, T. Machine Learning and Deep Learning Techniques for Internet of Things Network Anomaly Detection—Current Research Trends. Sensors 2024, 24, 1968. [Google Scholar] [CrossRef] [PubMed]
- Alangari, S. An Unsupervised Machine Learning Algorithm for Attack and Anomaly Detection in IoT Sensors. Wireless Pers. Commun. 2024, 138, 1–23. [Google Scholar] [CrossRef]
- John, L.S.; Yoon, S.; Li, J.; Wang, P. Anomaly detection using convolutional autoencoder with residual gated recurrent unit and weak supervision for photovoltaic thermal heat pump system. J. Build. Eng. 2025, 100, 111694. [Google Scholar] [CrossRef]
- Fernández, A.; García, S.; Galar, M.; Prati, R.C.; Krawczyk, B.; Herrera, F. Data level preprocessing methods. In Learning from Imbalanced Data Sets; Springer: Cham, Switzerland, 2018. [Google Scholar] [CrossRef]
- Uddin, M.F.; Lee, J.; Rizvi, S.; Hamada, S. Proposing Enhanced Feature Engineering and a Selection Model for Machine Learning Processes. Appl. Sci. 2018, 8, 646. [Google Scholar] [CrossRef]
- Zivot, E.; Wang, J. Rolling Analysis of Time Series. In Modeling Financial Time Series with S-Plus®; Springer: New York, NY, USA, 2003. [Google Scholar] [CrossRef]
- Wu, Z.; Wang, B. Transformer-Based Autoencoder Framework for Nonlinear Hyperspectral Anomaly Detection. IEEE Trans. Geosci. Remote. Sens. 2024, 62, 5508015. [Google Scholar] [CrossRef]
- Ertam, F.; Aydın, G. Data classification with deep learning using Tensorflow. In Proceedings of the International Conference on Computer Science and Engineering (UBMK), Antalya, Turkey, 5–8 October 2017; pp. 755–758. [Google Scholar] [CrossRef]
- Hundman, K.; Constantinou, V.; Laporte, C.; Colwell, I.; Soderstrom, T. Detecting Spacecraft Anomalies Using LSTMs and Nonparametric Dynamic Thresholding. In Proceedings of the 24th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining (KDD ’18), London, UK, 19–23 August 2018; Association for Computing Machinery: New York, NY, USA, 2018; pp. 387–395. [Google Scholar] [CrossRef]
- Liu, F.T.; Ting, K.M.; Zhou, Z.-H. Isolation Forest. In Proceedings of the 8th IEEE International Conference on Data Mining, Pisa, Italy, 15–19 December 2008; pp. 413–422. [Google Scholar] [CrossRef]
- Blagus, R.; Lusa, L. SMOTE for high-dimensional class-imbalanced data. BMC Bioinform. 2013, 14, 106. [Google Scholar] [CrossRef] [PubMed]
- Chen, T.; Guestrin, C. XGBoost: A Scalable Tree Boosting System. In Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining (KDD ’16), San Francisco, CA, USA, 13–17 August 2016; Association for Computing Machinery: New York, NY, USA, 2016; pp. 785–794. [Google Scholar] [CrossRef]
- Rainio, O.; Teuho, J.; Klén, R. Evaluation metrics and statistical tests for machine learning. Sci. Rep. 2024, 14, 6086. [Google Scholar] [CrossRef] [PubMed]
Feature | Count |
---|---|
Total sensor nodes | 15 |
Total data points | 14,776 |
Sampling interval | 10 s |
Class | Precision | Recall | F1-Score | Support |
---|---|---|---|---|
Normal (0) | 0.95 | 0.90 | 0.92 | 3005 |
Intrusion (1) | 0.99 | 1.00 | 0.99 | 2899 |
Malfunction (2) | 0.91 | 0.95 | 0.93 | 2955 |
Accuracy | 0.95 | |||
Macro Avg | 0.95 | 0.95 | 0.94 | 8859 |
Weighted Avg | 0.95 | 0.95 | 0.94 | 8859 |
Anomaly Type | Count |
---|---|
Malfunctions | 3093 |
Intrusions | 2926 |
Aspect | [13] | [14] | [15] | [16] | [17] | Our Work |
---|---|---|---|---|---|---|
Core objective | Detect anomalies in WSN data | Apply deep learning in WSN environments | Identify intrusions in IoT traffic | Optimize MANET-based IoT security | Detect anomalies in heat pump operations | Classify anomalies (malfunction vs. intrusion) in WSNs for forest fire monitoring |
Method overview | Autoencoder + GNN fusion | Federated deep learning with edge devices | ML/DL-based intrusion detection systems | Ensemble classifiers with filtering | CNN-BiGRU for time-series prediction | Transformer Autoencoder + Isolation Forest + XGBoost with adaptive thresholding |
Anomaly classification | No (detection only) | No | No (intrusion only) | No | No | Yes—separates sensor malfunction and intrusions |
Adaptivity | Learns spatiotemporal correlations | Model optimization across devices | Learns IDS models | Static ML-based decisions | Time-series-driven CNN learning | Adaptive thresholding and hybrid classification pipeline |
Deployment context | WSN data streams | Industrial WSNs | IoT device traffic | MANET + IoT mix | Energy systems | Environmental WSN (forest fire prediction and emulated testbed) |
Limitations stated | High compute overhead | Heavy memory use | Lacks real-time support | No dynamic behavior | Impacted by sensor noise | Sensitive to extreme forest fire scenarios |
Reproducibility | Moderate—model only | No code release | Review paper | Simulation-based | Model specific | Detailed architecture + open-source libraries (TensorFlow, Scikit-learn, XGBoost) |
Disclaimer/Publisher’s Note: The statements, opinions and data contained in all publications are solely those of the individual author(s) and contributor(s) and not of MDPI and/or the editor(s). MDPI and/or the editor(s) disclaim responsibility for any injury to people or property resulting from any ideas, methods, instructions or products referred to in the content. |
© 2025 by the authors. Licensee MDPI, Basel, Switzerland. This article is an open access article distributed under the terms and conditions of the Creative Commons Attribution (CC BY) license (https://creativecommons.org/licenses/by/4.0/).
Share and Cite
Haque, A.; Soliman, H. A Transformer-Based Autoencoder with Isolation Forest and XGBoost for Malfunction and Intrusion Detection in Wireless Sensor Networks for Forest Fire Prediction. Future Internet 2025, 17, 164. https://doi.org/10.3390/fi17040164
Haque A, Soliman H. A Transformer-Based Autoencoder with Isolation Forest and XGBoost for Malfunction and Intrusion Detection in Wireless Sensor Networks for Forest Fire Prediction. Future Internet. 2025; 17(4):164. https://doi.org/10.3390/fi17040164
Chicago/Turabian StyleHaque, Ahshanul, and Hamdy Soliman. 2025. "A Transformer-Based Autoencoder with Isolation Forest and XGBoost for Malfunction and Intrusion Detection in Wireless Sensor Networks for Forest Fire Prediction" Future Internet 17, no. 4: 164. https://doi.org/10.3390/fi17040164
APA StyleHaque, A., & Soliman, H. (2025). A Transformer-Based Autoencoder with Isolation Forest and XGBoost for Malfunction and Intrusion Detection in Wireless Sensor Networks for Forest Fire Prediction. Future Internet, 17(4), 164. https://doi.org/10.3390/fi17040164