A Lightweight Intrusion Detection System for Internet of Things: Clustering and Monte Carlo Cross-Entropy Approach
Open accessAbstract
Our modern lives are increasingly shaped by the Internet of Things (IoT), as IoT devices monitor and manage everything from our homes to our workplaces, becoming an essential part of health systems and daily infrastructure. However, this rapid growth in IoT has introduced significant security challenges, leading to increased vulnerability to cyber attacks. To address these challenges, machine learning-based intrusion detection systems (IDSs)-traditionally considered a primary line of defense-have been deployed to monitor and detect malicious activities in IoT networks. Despite this, these IDS solutions often struggle with the inherent resource constraints of IoT devices, including limited computational power and memory. To overcome these limitations, we propose an approach to enhance intrusion detection efficiency. First, we introduce a recursive clustering method for data condensation, integrating compactness and entropy-driven sampling to select a highly representative subset from the larger dataset. Second, we adopt a Monte Carlo Cross-Entropy approach combined with a stability metric of features to consistently select the most stable and relevant features, resulting in a lightweight, efficient, and high-accuracy IoT-based IDS. Evaluation of our proposed approach on three IoT datasets from real devices (N-BaIoT, Edge-IIoTset, CICIoT2023) demonstrates comparable classification accuracy while significantly reducing training and testing times by 45× and 15×, respectively, and lowering memory usage by 18×, compared to competitor approaches.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Detectors that achieve >99% accuracy on a single dataset routinely lose 10-20 percentage points when transferred cross-dataset.
“detectors that achieve >99% accuracy on a single dataset routinely lose 10-20 percentage points when transferred cross-dataset”
From Agentic AI and Large Language Models for Autonomous IoT Cybersecurity: A Systematic Survey, Taxonomy, and Research Roadmap (2026) · cites this paper as [77]
Section 5 compares full, condensed, and feature-selected versions of each dataset, not detectors trained on one dataset and tested on another. The Section 5.1 passages report class-specific changes in precision and recall, but do not establish a routine 10–20 percentage-point loss in cross-dataset accuracy. Searches for cross-dataset transfer and training on one dataset while testing on another found no supporting passage; page numbers were unavailable in our copy. (LLM, conf=0.76)
Experimental — accuracy not yet measured
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
(1967) · Cited by 23,719 · see citing works
An Introduction to Support Vector Machines and Other Kernel-based Learning Methods
Cristianini, N., & Shawe-Taylor, J. (2000) · doi:10.1017/cbo9780511801389 · Cited by 13,855 · see citing works
Geurts, P., Ernst, D., & Wehenkel, L. (2006) · Machine Learning · doi:10.1007/s10994-006-6226-1 · Cited by 9,300 · see citing works
Lin, J., Yu, W., Zhang, N., Yang, X., Zhang, H., & Zhao, W. (2017) · IEEE Internet of Things Journal · doi:10.1109/jiot.2017.2683200 · Cited by 2,793 · see citing works
CICIoT2023: A Real-Time Dataset and Benchmark for Large-Scale Attacks in IoT Environment
Neto, E. C. P., Dadkhah, S., Ferreira, R., Zohourian, A., Lu, R., & Ghorbani, A. A. (2023) · Sensors · doi:10.3390/s23135941 · Cited by 1,368 · see citing works
Ferrag, M. A., Friha, O., Hamouda, D., Maglaras, L. A., & Janicke, H. (2022) · IEEE Access · doi:10.1109/access.2022.3165809 · Cited by 1,308 · see citing works
A survey of intrusion detection in Internet of Things
Zarpelão, B. B., Miani, R. S., Kawakani, C. T., & de Alvarenga, S. C. (2017) · Journal of Network and Computer Applications · doi:10.1016/j.jnca.2017.02.009 · Cited by 1,022 · see citing works
IoT malicious traffic identification using wrapper-based feature selection mechanisms
Shafiq, M., Tian, Z., Bashir, A. K., Du, X., & Guizani, M. (2020) · Computers & Security · doi:10.1016/j.cose.2020.101863 · Cited by 272 · see citing works
Finding compact and well-separated clusters: Clustering using silhouette coefficients
Bagirov, A., Aliguliyev, R. M., & Sultanova, N. (2022) · Pattern Recognition · doi:10.1016/j.patcog.2022.109144 · Cited by 238 · see citing works
MapReduce based intelligent model for intrusion detection using machine learning technique
Asif, M. K., Abbas, S., Khan, M. A., Fatima, A., Khan, M. A., & Lee, S.-W. (2021) · Journal of King Saud University - Computer and Information Sciences · doi:10.1016/j.jksuci.2021.12.008 · Cited by 213 · see citing works
Feature selection for intrusion detection system in Internet-of-Things (IoT)
Nimbalkar, P. R., & Kshirsagar, D. D. (2021) · ICT Express · doi:10.1016/j.icte.2021.04.012 · Cited by 199 · see citing works
A comprehensive survey on IoT attacks: Taxonomy, detection mechanisms and challenges
Sasi, T., Lashkari, A. H., Lu, R., Xiong, P., & Iqbal, S. (2023) · Journal of Information and Intelligence · doi:10.1016/j.jiixd.2023.12.001 · Cited by 165 · see citing works
Lightweight Cryptographic Protocols for IoT-Constrained Devices: A Survey
Khan, M. N., Rao, A., & Camtepe, S. A. (2020) · IEEE Internet of Things Journal · doi:10.1109/jiot.2020.3026493 · Cited by 159 · see citing works
Jamalipour, A., & Murali, S. (2021) · IEEE Internet of Things Journal · doi:10.1109/jiot.2021.3126811 · Cited by 132 · see citing works
Saheed, Y. K., Abdulganiyu, O. H., & Tchakoucht, T. A. (2023) · Journal of King Saud University - Computer and Information Sciences · doi:10.1016/j.jksuci.2023.03.010 · Cited by 107 · see citing works
Meng, W., Li, W., Su, C., Zhou, J., & Lu, R. (2017) · IEEE Access · doi:10.1109/access.2017.2772294 · Cited by 89 · see citing works
Machine learning and the Internet of Things security: Solutions and open challenges
Farooq, U., Tariq, N., Asim, M., Baker, T., & Al-Shamma'a, A. I. (2022) · Journal of Parallel and Distributed Computing · doi:10.1016/j.jpdc.2022.01.015 · Cited by 80 · see citing works
Thakkar, A., & Lohiya, R. (2023) · Archives of Computational Methods in Engineering · doi:10.1007/s11831-023-09943-8 · Cited by 73 · see citing works
Azimjonov, J., & Kim, T. (2023) · Expert Systems with Applications · doi:10.1016/j.eswa.2023.121493 · Cited by 65 · see citing works
HaddadPajouh, H., Mohtadi, A., Dehghantanha, A., Karimipour, H., Lin, X., & Choo, K. R. (2020) · IEEE Internet of Things Journal · doi:10.1109/jiot.2020.3026660 · Cited by 63 · see citing works
Feature Subset Selection for Malware Detection in Smart IoT Platforms
Abawajy, J., Darem, A. A., & Alhashmi, A. A. (2021) · Sensors · doi:10.3390/s21041374 · Cited by 53 · see citing works
$k$ NNVWC: An Efficient $k$ -Nearest Neighbors Approach Based on Various-Widths Clustering
Almalawi, A., Fahad, A., Tari, Z., Cheema, M. A., & Khalil, I. (2015) · IEEE Transactions on Knowledge and Data Engineering · doi:10.1109/tkde.2015.2460735 · Cited by 45 · see citing works
Self-citationQuyen, N. H., Duy, P. T., Nguyen, N. T., Khoa, N. H., & Pham, V.-H. (2024) · Information Fusion · doi:10.1016/j.inffus.2024.102807 · Cited by 40 · see citing works
Cost-Aware Feature Selection for IoT Device Classification
Chakraborty, B., Divakaran, D. M., Nevat, I., Peters, G. W., & Gurusamy, M. (2021) · IEEE Internet of Things Journal · doi:10.1109/jiot.2021.3051480 · Cited by 37 · see citing works
Cross-Layer Federated Learning for Lightweight IoT Intrusion Detection Systems
Hajj, S., Azar, J., Abdo, J. B., Demerjian, J., Guyeux, C., Makhoul, A., & Dominique Ginhac, B. (2023) · Sensors · doi:10.3390/s23167038 · Cited by 35 · see citing works
ControlChain: A new stage on the IoT access control authorization
Pinno, O. J. A., Gregio, A. R. A., & Bona, L. C. E. (2019) · Concurrency and Computation Practice and Experience · doi:10.1002/cpe.5238 · Cited by 32 · see citing works
Jiang, W., Han, H., Zhang, Y., Mu, J., & Shankar, A. (2024) · Mobile Networks and Applications · doi:10.1007/s11036-024-02435-4 · Cited by 31 · see citing works
Fatima, M., Rehman, O. M. H., Ali, S., & Niazi, M. F. (2024) · Future Generation Computer Systems · doi:10.1016/j.future.2024.05.013 · Cited by 29 · see citing works
Li, P., Wang, H., Tian, G., & Fan, Z. (2024) · Sensors · doi:10.3390/s24154766 · Cited by 21 · see citing works
Secure and scalable access control protocol for IoT environment
Iqbal, U., & Mir, A. H. (2020) · Internet of Things · doi:10.1016/j.iot.2020.100291 · Cited by 20 · see citing works
Multi-Criteria Feature Selection Based Intrusion Detection for Internet of Things Big Data
Wang, J., Xiong, X., Chen, G., Ouyang, R., Gao, Y., & Alfarraj, O. (2023) · Sensors · doi:10.3390/s23177434 · Cited by 8 · see citing works
Taxonomy of Security Attacks on Internet of Things
Bhardwaj, A., Kaushik, K., & Kumar, M. (2022) · Blockchain technologies · doi:10.1007/978-981-19-1960-2_1 · Cited by 7 · see citing works
Xu, J. (2011) · Computer science and information technology · doi:10.5121/csit.2011.1302 · Cited by 6 · see citing works
Cryptography based Identity Management for IoT Devices
Nair, J. N., & Jain, K. (2023) · International Conference on Augmented Intelligence and Sustainable Systems (ICAISS) · doi:10.1109/icaiss58487.2023.10250641 · Cited by 2 · see citing works
Flagged first, then by citations
Research works printed but not linked: 4
- [35]Cover T.M. Thomas J.A. Entropy, Relative Entropy, and Mutual Information Wiley-Interscience Hoboken, NJ, USA 1991 Volume 2 12 13
- [38]Vapnik V. The Nature of Statistical Learning Theory Springer Science & Business Media Berlin/Heidelberg, Germany 2013
- [39]Russell S. Norvig P. Artificial Intelligence: A Modern Approach Pearson Boston, MA, USA 2016
- [40]Quinlan J.R. C4.5: Programs for Machine Learning Elsevier Amsterdam, The Netherlands 2014
Cited by
Sorted by citations
Vladov, S., Vysotska, V., Vashchenko, S., Bolvinov, S., Glubochenko, S., Repchonok, A. Y., Korniienko, M., Nazarkevych, M., & Herasymchuk, R. V. (2025) · Big Data and Cognitive Computing · doi:10.3390/bdcc9110267 · Cited by 6 · see citing works
Jaddoa, A., Alharbi, H., Hommadi, A., & Ismael, H. A. (2025) · IoT · doi:10.3390/iot6040062 · Cited by 5 · see citing works
Nageshwaran, V., & Ezekiel, S. (2026) · Electronics · doi:10.3390/electronics15122740 · Cited by 4 · see citing works
Shirley, J. J., & Priya, M. (2025) · Scientific Reports · doi:10.1038/s41598-025-20175-7
Dey, M., & Sharma, S. (2026) · Security and Privacy · doi:10.1002/spy2.70192
A Technical approach for Protecting IoT Environments with IDS
Lokesh.D, Teja, K. G., Kumari, S. K., & Rasool.Md (2025) · IEEE International Symposium on Sustainable Energy, Signal Processing and Cyber Security (iSSSC) · doi:10.1109/isssc66652.2025.11388541
Nugraha, A., Luthfiarta, A., Dewi, I. N., Winarno, S., & ., A. (2026) · International Journal of Computer Networks And Applications · doi:10.22247/ijcna/2026/21
AI-Driven Secure Multipath Routing With Energy-Efficient Lifetime Optimization For Iot Networks
Manoharan, L., & Shekhar, H. (2026) · International Journal of Artificial Intelligence and Machine Learning · doi:10.51483/ijaiml.6.2.2026.34-47
Khashan, O. A. (2026) · Discover Internet of Things · doi:10.1007/s43926-026-00513-5
SecureFL-IoV: Differentially Private Federated Intrusion Detection for IoV Using a Two-Stage RF
Le, H., Hossain, M. T., & Alsmadi, I. (2026) · IEEE Conference on Communications and Network Security · doi:10.1109/cns69863.2026.11720883
LITH: A Lightweight Behavioral Anomaly-to-Hunt-Lead Framework for IoT Sensor Ecosystems
Bamashmoos, F., & Khairullah, E. F. (2026) · Sensors · doi:10.3390/s26206618
A Detailed Analysis of Features in the Edge-IIoTset Dataset
Yildiz, A., & Ulutaş, M. (2026) · International Artificial Intelligence and Data Processing Symposium (IDAP) · doi:10.1109/idap71869.2026.11728234
- Authors
- Almalawi, A.
- Affiliations
- King Abdulaziz University (SA)
- Corresponding author
- Almalawi, Abdulmohsen
- Venue
- Sensors
- Publisher
- MDPI AG
- Published
- 2025-04-02
- Volume
- 25
- Issue
- 7
- Pages
- 2235
- ISSN
- 1424-8220 (ISSN-L)
- PMC
- PMC11991034
- OpenAlex
- W4409109961
- Cited by
- 10
- References
- 34
- Citations by year
- 2026: 6 · 2025: 4
- FWCI
- 4.20
- Type
- journal article
- Language
- en
- Open access
- gold
- doi.org
- Licence
- Locations
- Sensors (publishedVersion, cc-by)
- PubMed Central (publishedVersion, cc-by)
- PubMed (publishedVersion)
- DOAJ (DOAJ: Directory of Open Access Journals) (submittedVersion, cc-by-sa)
- Funders
- Deanship of Scientific Research (DSR), King Abdulaziz University, Jeddah (G: 464-611-1443)
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Computer Science › Information Systems › Internet of Things and AI
- Physical Sciences › Engineering › Biomedical Engineering › Artificial Immune Systems Applications
- Keywords
- intrusion detection, Internet of Things security, lightweight machine learning, recursive clustering, data condensation, feature selection, feature stability, resource-constrained devices, N-BaIoT, Edge-IIoTset, CICIoT2023
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
