A Review of Intrusion Detection Systems Using Machine and Deep Learning in Internet of Things: Challenges, Solutions and Future Directions
Open accessAbstract
The Internet of Things (IoT) is poised to impact several aspects of our lives with its fast proliferation in many areas such as wearable devices, smart sensors and home appliances. IoT devices are characterized by their connectivity, pervasiveness and limited processing capability. The number of IoT devices in the world is increasing rapidly and it is expected that there will be 50 billion devices connected to the Internet by the end of the year 2020. This explosion of IoT devices, which can be easily increased compared to desktop computers, has led to a spike in IoT-based cyber-attack incidents. To alleviate this challenge, there is a requirement to develop new techniques for detecting attacks initiated from compromised IoT devices. Machine and deep learning techniques are in this context the most appropriate detective control approach against attacks generated from IoT devices. This study aims to present a comprehensive review of IoT systems-related technologies, protocols, architecture and threats emerging from compromised IoT devices along with providing an overview of intrusion detection models. This work also covers the analysis of various machine learning and deep learning-based techniques suitable to detect IoT systems related to cyber-attacks.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Security systems may generate false alarms in order to improve attack detection.
“Among the open challenges related to AD in IoT networks, they highlight that the security system may generate false alarms in order to improve the attack detection.”
From Deepfakes: current and future trends (2024) · cites this paper as Asharf et al. 2020
DL methods are good at prediction of new attacks, which are often different from previous ones.
“Furthermore, DL methods are good at prediction of new attacks, which are often different from previous ones (Asharf et al. 2020).”
From Deepfakes: current and future trends (2024) · cites this paper as Asharf et al. 2020
Completely avoiding or minimizing false-positive and false-negative is a research challenge.
“Moreover, they claim completely avoiding or minimizing false-positive and false-negative is another research challenge.”
From Deepfakes: current and future trends (2024) · cites this paper as Asharf et al. 2020
Cites
Quinlan, J. R. (1986) · Machine Learning · doi:10.1007/bf00116251 · Cited by 21,439 · see citing works
Toward Generating a New Intrusion Detection Dataset and Intrusion Traffic Characterization
Sharafaldin, I., Habibi Lashkari, A., & Ghorbani, A. A. (2018) · Proceedings of the 4th International Conference on Information Systems Security and Privacy · doi:10.5220/0006639801080116 · Cited by 5,318 · cited 2× · see citing works
“This organization has three different datasets: (1) the CAIDA OC48, covering various types of data observed on an OC48 link, (2) the CAIDA DDOS, which comprises of one-hour DDoS attack traffic that happened in August 2007, and (3) the CAIDA Internet traces 2016, which is passive traffic traces from CAIDA’s Equinix-Chi…”
BackgroundMethodRandom forests for classification in ecology
Cutler, D. R., Edwards, T. C., Beard, K. H., Cutler, A., Hess, K. T., Gibson, J., & Lawler, J. J. (2007) · Ecology · doi:10.1890/07-0539.1 · Cited by 4,950 · see citing works
A Survey of Data Mining and Machine Learning Methods for Cyber Security Intrusion Detection
Buczak, A. L., & Guven, E. (2016) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2015.2494502 · Cited by 3,332 · cited 3× · see citing works
“There are other studies [35,36], which discussed the feasibility of both ML and data mining techniques to detect intrusions in IoT networks by implementing these techniques in IDSs either through detecting anomalies or classification of traffic.”
BackgroundContext Aware Computing for The Internet of Things: A Survey
Perera, C., Zaslavsky, A., Christen, P., & Georgakopoulos, D. (2014) · IEEE Communications Surveys & Tutorials · doi:10.1109/surv.2013.042313.00197 · Cited by 2,861 · cited 1× · see citing works
“When they are integrated with conventional networks services, they cause regression in the security of conventional networks [72,73].”
BackgroundA Survey of Machine and Deep Learning Methods for Internet of Things (IoT) Security
Al-Garadi, M. A., Mohamed, A., Al-Ali, A. K., Du, X., Ali, I., & Guizani, M. (2020) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2020.2988293 · Cited by 1,392 · see citing works
Fadlullah, Z. M., Tang, F., Mao, B., Kato, N., Akashi, O., Inoue, T., & Mizutani, K. (2017) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2017.2707140 · Cited by 810 · see citing works
Security Tradeoffs in Cyber Physical Systems: A Case Study Survey on Implantable Medical Devices
Altawy, R., & Youssef, A. M. (2016) · IEEE Access · doi:10.1109/access.2016.2521727 · Cited by 139 · see citing works
Flagged first, then by citations
Cited by
Sorted by citations
Deepfakes: current and future trends
Gambín, Á. F., Yazidi, A., Vasilakos, A., Haugerud, H., & Djenouri, Y. (2024) · Artificial Intelligence Review · doi:10.1007/s10462-023-10679-x · Cited by 145 · see citing works
One-Class Anomaly Detection for Industrial Applications: A Comparative Survey and Experimental Study
Paolini, D., Dini, P., Soldaini, E., & Saponara, S. (2025) · Computers · doi:10.3390/computers14070281 · Cited by 21 · see citing works
- Authors
- Asharf, J., Moustafa, N., Khurshid, H., Debie, E., Haider, W., & Wahab, A.
- Affiliations
- National University of Sciences and Technology (PK)
- UNSW Sydney (AU)
- Department of computer Science, Riphah University, Islamabad 44000, Pakistan
- Corresponding author
- Moustafa, Nour
- Venue
- Electronics
- Publisher
- MDPI AG
- Published
- 2020-07-20
- Volume
- 9
- Issue
- 7
- Pages
- 1177
- ISSN
- 2079-9292 (ISSN-L)
- OpenAlex
- W3043799819
- Cited by
- 378
- References
- 8
- Citations by year
- 2026: 44 · 2025: 88 · 2024: 93 · 2023: 61 · 2022: 55 · 2021: 34 · 2020: 3
- FWCI
- 17.97
- Type
- journal article
- Language
- en
- Open access
- gold
- doi.org
- Licence
- Locations
- Electronics (publishedVersion, cc-by)
- DOAJ (DOAJ: Directory of Open Access Journals) (submittedVersion, cc-by-sa)
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Computer Science › Information Systems › Internet of Things and AI
- Physical Sciences › Computer Science › Artificial Intelligence › Internet Traffic Analysis and Secure E-voting
- Keywords
- intrusion detection, Internet of Things, Internet of Things security, cyberattacks, machine learning, deep learning, IoT threats, IoT protocols, IoT architecture
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
