Intrusion Detection System For Internet Of Things Research Articles

A comprehensive survey on deep learning‐based intrusion detection systems in Internet of Things (IoT)

AbstractThe proliferating popularity of Internet of Things (IoT) devices has led to wide‐scale networked system implementations across multiple disciplines, including transportation, medicine, smart homes, and many others. This unprecedented level of interconnectivity has introduced new security vulnerabilities and threats. Ensuring security in these IoT settings is crucial for protecting against malicious activities and safeguarding data. Real‐time identification and response to potential intrusions and attacks are essential, and intrusion detection systems (IDS) are pivotal in this process. However, the dynamic and diverse nature of the IoT environment presents significant challenges to existing IDS solutions, which are often based on rule‐based or statistical approaches. Deep learning, a subset of artificial intelligence, has shown great potential to enhance IDS in IoT. Deep learning models can identify complex patterns and characteristics by utilizing artificial neural networks, automatically building hierarchical representations from data. This capability results in more precise and efficient intrusion detection in IoT‐based systems. The primary aim of this survey is to present an extensive overview of the current research on deep learning and IDS in the IoT domain. By examining existing literature, discussing mainstream datasets, and highlighting current challenges and potential prospects, this survey provides valuable insights into the prevailing scenario and future directions for using deep learning in IDS for IoT. The findings from this research aim to enhance intrusion detection techniques in IoT environments and promote the development of more effective antimalware solutions against cyber threats targeting IoT device systems.

Defence against adversarial attacks on IoT detection systems using deep belief network

An Adversarial attack is a technique used to deceive machine learning models to make incorrect predictions by providing slightly modified inputs from the original. Intrusion detection system (IDS) is a crucial tool in computer network security for the detection of adversarial attacks. Deep learning is a trending method in both research and industry, and this study proposes the use of a deep belief network (DBN). DBN can recognize data with small differences, but is also vulnerable to adversarial attacks. Therefore, this research suggests an internet of things-intrusion detection system (IoT-IDS) architecture using a DBN that can counter adversarial attacks. The chosen adversarial attack for this study is the fast gradient sign method (FGSM) used to evaluate the IoT IDS using the DBN model. Testing was conducted in two scenarios: first, the model was trained without adversarial attacks; second, the model was trained with adversarial attacks. The test results indicate that the DBN model struggles to detect FGSM attacks, achieving an accuracy of only 46% when it is not trained with adversarial attacks. However, after training with the FGSM dataset, the DBN model successfully detected adversarial attacks with an accuracy of 97%.

Towards intrusion detection in IoT using Few-shot learning

The Internet of Things (IoT) is an emerging technology that covers various domains and has become an essential part of the upcoming technological revolution. IoT applications include healthcare, smart-cities, smart-cars, industries, quality of life, and several other fields. IoT typically consists of lightweight sensor devices that facilitate procedures such as automation, real-time trackable data collection, and data-driven decisions. However, securing IoT networks is an accessible research area for several reasons. The main security challenges are limited resources that are incapable of dealing with complex and advanced security tools; and lack of required data for training the security systems like Intrusion detection systems as a result of their heterogeneous nature. This research proposed a Few-shot learning IoT intrusion detection system model based on a Siamese network to overcome the above limitation. The model aims to classify and distinguish normal and attacked traffic. The experiment utilized an IoT dataset in different scenarios to analyze and validate the behavior with three categories with different numbers of data in each. The performance result achieves more than 99% accuracy and shows an efficient detection ability using only less than 1% of the dataset.

Hybrid CNN Approach for Unknown Attack Detection in Edge-Based IoT Networks

INTRODUCTION: In the constantly growing Internet of Things (IoT), device security is crucial. As IoT gadgets pervade our lives, detecting unforeseen assaults is crucial to protecting them. Behavioral analysis, machine learning, and collaborative intelligence may be needed to protect against new dangers. This short discusses the need of detecting unexpected IoT attacks and essential security strategies for these interconnected environments.OBJECTIVES: This research uses the BoT-IoT dataset to create an enhanced IoT intrusion detection system. The goals are to optimize a CNN architecture for effective pattern recognition, address imbalanced data, and evaluate model performance using precision, recall, F1-score, and AUC-ROC measures. Improving IoT ecosystem reliability and security against unknown assaults is the ultimate goal.METHODS: The proposed methods use the BoT-IoT dataset to create a comprehensive IoT intrusion detection system. This involves tuning a Convolutional Neural Network (CNN) architecture to improve pattern recognition. Oversampling and class weighting address imbalanced data issues. RESULTS: The comprehensive evaluation of our innovative unknown attack detection method shows promise, suggesting it may be better than existing methods. A high accuracy, precision, recall, and f-measure of 98.23% were attained using an advanced model and feature selection methods. This achievement was achieved by using features designed to identify unknown attacks in the dataset, proving the proposed methodology works.CONCLUSION: This research presents an improved IoT Intrusion Detection System using the BoT-IoT dataset. The optimised Convolutional Neural Network architecture and imbalanced data handling approaches achieved 98.23% accuracy.

Optimizing IoT intrusion detection system: feature selection versus feature extraction in machine learning

Internet of Things (IoT) devices are widely used but also vulnerable to cyberattacks that can cause security issues. To protect against this, machine learning approaches have been developed for network intrusion detection in IoT. These often use feature reduction techniques like feature selection or extraction before feeding data to models. This helps make detection efficient for real-time needs. This paper thoroughly compares feature extraction and selection for IoT network intrusion detection in machine learning-based attack classification framework. It looks at performance metrics like accuracy, f1-score, and runtime, etc. on the heterogenous IoT dataset named Network TON-IoT using binary and multiclass classification. Overall, feature extraction gives better detection performance than feature selection as the number of features is small. Moreover, extraction shows less feature reduction compared with that of selection, and is less sensitive to changes in the number of features. However, feature selection achieves less model training and inference time compared with its counterpart. Also, more space to improve the accuracy for selection than extraction when the number of features changes. This holds for both binary and multiclass classification. The study provides guidelines for selecting appropriate intrusion detection methods for particular scenarios. Before, the TON-IoT heterogeneous IoT dataset comparison and recommendations were overlooked. Overall, the research presents a thorough comparison of feature reduction techniques for machine learning-driven intrusion detection in IoT networks.

IoT Intrusion Detection System Based on Machine Learning

With the rapid development of the Internet of Things (IoT), the number of IoT devices is increasing dramatically, making it increasingly important to identify intrusions on these devices. Researchers are using machine learning techniques to design effective intrusion detection systems. In this study, we propose a novel intrusion detection system that efficiently detects network anomalous traffic. To reduce the feature dimensions of the data, we employ the binary grey wolf optimizer (BGWO) heuristic algorithm and recursive feature elimination (RFE) to select the most relevant feature subset for the target variable. The synthetic minority oversampling technique (SMOTE) is used to oversample the minority class and mitigate the impact of data imbalance on the classification results. The preprocessed data are then classified using XGBoost, and the hyperparameters of the model are optimized using Bayesian optimization with tree-structured Parzen estimator (BO-TPE) to achieve the highest detection performance. To validate the effectiveness of the proposed method, we conduct binary and multiclass experiments on five commonly used IoT datasets. The results show that our proposed method outperforms state-of-the-art methods in four out of the five datasets. It is noteworthy that our proposed method achieves perfect accuracy, precision, recall, and an F1 score of 1.0 on the BoT-Iot and WUSTL-IIOT-2021 datasets, further validating the effectiveness of our approach.

Enhanced Lion Optimization Algorithm and deep belief network for intrusion detection with SDN enabled IoT networks

A severe problem that regularly affects cloud systems are intrusions. Ignore how the expansion of Internet of Things (IoT) devices will result in enormous intrusions. To distinguish intrusions from authorized network activity, detection is a crucial procedure. An Enhanced Lion Optimization Algorithm (ELOA) is utilized in this research, IoT intrusion detection system. Intrusions are classified using the Deep Belief Network (DBN) and an SDN controller technique. The proposed ELOA-based Intrusion Detection System uses the optimal weight in DBN to train the neurons to categorize the data in a network as normal and attacked during the training phase. In the testing step that follows training, data from nodes are examined, and by contrasting the training results, they are categorized as normal and attacked data. By using the proposed ELOA and DBN algorithms, our intrusion detection system can successfully identify intrusions. Based on the creation of blacklists for detecting IoT intrusions, the (SDN) Software Defined Networking controller can effectively prohibit harmful devices. In order to demonstrate that the proposed ELOA finds network intrusions more successfully, its performance is compared to that of other existing techniques. The node sizes of the algorithms are run and evaluated for 1000, 2000, 3000, 4000, and 5000 respectively. At highest node 5000, the Proposed ELOA and DPN have precision, recall, f-score and accuracy becomes as 97.8, 96.22, 97.5 and 98.67 respectively.

An intelligent IoT intrusion detection system using HeInit-WGAN and SSO-BNMCNN based multivariate feature analysis

Devices connected to the Internet of Things (IoT) are growing in popularity across multiple industries. IoT links intelligent homes, buildings, businesses, and communities, and also links computers and mobile devices. Cybersecurity in IoT networks remains challenging, although many intrusion detection services for assault avoidance systems have been developed. Because of enormous growth in computing resources, attack surfaces, communications infrastructure, and attack rates, IoT services encounter substantial security issues. Innovative intrusion-detection systems ensuring data security, availability, and integrity have been developed to mitigate security problems; these systems are recommended for preventing common internal and external assaults and managing IoT environments. To clearly understand any impending attacks, the data are first preprocessed. Missing values are categorized with the concordance connection coefficient, and preprocessing is applied before handling of the missing values. The unevenly distributed and overlapping data are then handled through maximum likelihood estimation-based robust scalar (MLE-RS) scaling followed by random oversampling-based cluster-initialized divisive clustering (ROS-CInitDC). This study conceptualizes a Squirrel search optimization-based Bengio Nesterov momentum convolutional neural network (SSO-BNMCNN)-based approach, which indicates the relationships among information by considering causation. It keeps an optimal processing time and correctness to get data understanding. The selected features are then tested against the categorization of a He initialization-based Wasserstein gradient penalty loss generative adversarial network (HeInit-WGAN). The HeInit-WGAN technique identifies attacks more reliably and accurately than existing methods, reducing false alarms. The proposed strategy had an F-measure of 0.91, and scores of 0.96 for precision, 0.91 for awareness, and 0.98 for explicitness. Moreover, it decreased the false acceptance rate, achieving a 0.02 false positive rate and 0.09 false negative rate.

A distributed SDN-based intrusion detection system for IoT using optimized forests.

Along with the expansion of Internet of Things (IoT), the importance of security and intrusion detection in this network also increases, and the need for new and architecture-specific intrusion detection systems (IDS) is felt. In this article, a distributed intrusion detection system based on a software defined networking (SDN) is presented. In this method, the network structure is divided into a set of sub-networks using the SDN architecture, and intrusion detection is performed in each sub-network using a controller node. In order to detect intrusion in each sub-network, a decision tree optimized by black hole optimization (BHO) algorithm is used. Thus, the decision tree deployed in each sub-network is pruned by BHO, and the split points in its decision nodes are also determined in such a way that the accuracy of each tree in detecting sub-network attacks is maximized. The performance of the proposed method is evaluated in a simulated environment and its performance in detecting attacks using the NSLKDD and NSW-NB15 databases is examined. The results show that the proposed method can identify attacks in the NSLKDD and NSW-NB15 databases with an accuracy of 99.2% and 97.2%, respectively, which indicates an increase compared to previous methods.

A novel dimensionality reduction and optimal deep learning based intrusion detection system for internet of things

The internet of things (IoT) has significantly influenced day-to-day life in large industrial systems. The Internet of Things (IoT) offers a platform for information systems to integrate effectively with network servers. In contrast, cyber threats are becoming critical, especially for IoT servers. A strong strategy must be in place to protect the network system from multiple attacks. In order to detect malicious behaviors that deteriorate network performance, an intrusion detection system (IDS) is crucial. An IDS use a detection method to monitor network activity to alert IoT users regularly. This paper proposes a novel IDS for IoT using log-sigmoid kernel principal component analysis (LSK-PCA) and activation updated deep feed-forward neural network (AU-DFFNN) based dimensionality reduction (DR) and classification technique. Initially, the input data is taken from the NSLKDD dataset and undergoes pre-processing. Afterwards, attribute extraction is carried out, followed by Fisher’s Yates Adapted Golden Eagle Optimizer (FY-GEO) based feature selection. Then, DR of the feature selected data is done using the LSK-PCA model. Finally, the reduced dataset is given as an input to the classifier for classifying the data as attacked and normal data. As a final point, experimental analysis is performed using performance metrics like precision (PR), recall (RC), f-score (FS), accuracy (AC), false alarm rate (FAR) and computational time (CT). The results proved that the proposed work detects intrusion effectively compared to state-of-art techniques.

Federated Learning for IoT Intrusion Detection

The number of Internet of Things (IoT) devices has increased considerably in the past few years, resulting in a large growth of cyber attacks on IoT infrastructure. As part of a defense in depth approach to cybersecurity, intrusion detection systems (IDSs) have acquired a key role in attempting to detect malicious activities efficiently. Most modern approaches to IDS in IoT are based on machine learning (ML) techniques. The majority of these are centralized, which implies the sharing of data from source devices to a central server for classification. This presents potentially crucial issues related to privacy of user data as well as challenges in data transfers due to their volumes. In this article, we evaluate the use of federated learning (FL) as a method to implement intrusion detection in IoT environments. FL is an alternative, distributed method to centralized ML models, which has seen a surge of interest in IoT intrusion detection recently. In our implementation, we evaluate FL using a shallow artificial neural network (ANN) as the shared model and federated averaging (FedAvg) as the aggregation algorithm. The experiments are completed on the ToN_IoT and CICIDS2017 datasets in binary and multiclass classification. Classification is performed by the distributed devices using their own data. No sharing of data occurs among participants, maintaining data privacy. When compared against a centralized approach, results have shown that a collaborative FL IDS can be an efficient alternative, in terms of accuracy, precision, recall and F1-score, making it a viable option as an IoT IDS. Additionally, with these results as baseline, we have evaluated alternative aggregation algorithms, namely FedAvgM, FedAdam and FedAdagrad, in the same setting by using the Flower FL framework. The results from the evaluation show that, in our scenario, FedAvg and FedAvgM tend to perform better compared to the two adaptive algorithms, FedAdam and FedAdagrad.

Securing a Smart Home with a Transformer-Based IoT Intrusion Detection System

Machine learning (ML)-based Network Intrusion Detection Systems (NIDSs) can classify each network’s flow behavior as benign or malicious by detecting heterogeneous features, including both categorical and numerical features. However, the present ML-based NIDSs are deemed insufficient in terms of their ability to generalize, particularly in changing network environments such as the Internet of Things (IoT)-based smart home. Although IoT devices add so much to home comforts, they also introduce potential risks and vulnerabilities. Recently, many NIDS studies on other IoT scenarios, such as the Internet of Vehicles (IoV) and smart cities, focus on utilizing the telemetry data of IoT devices for IoT intrusion detection. Because when IoT devices are under attack, their abnormal telemetry data values can reflect the anomaly state of those devices. Those telemetry data-based IoT NIDS methods detect intrusion events from a different view, focusing on the attack impact, from the traditional network traffic-based NIDS, which focuses on analyzing attack behavior. The telemetry data-based NIDS is more suitable for IoT devices without built-in security mechanisms. Considering the smart home IoT scenario, which has a smaller scope and a limited number of IoT devices compared to other IoT scenarios, both NIDS views can work independently. This motivated us to propose a novel ML-based NIDS to combine the network traffic-based and telemetry data-based NIDS together. In this paper, we propose a Transformer-based IoT NIDS method to learn the behaviors and effects of attacks from different types of data that are generated in the heterogeneous IoT environment. The proposed method utilizes a self-attention mechanism to learn contextual embeddings for input network features. Based on the contextual embeddings, our method can solve the feature set challenge, including both continuous and categorical features. Our method is the first to utilize both network traffic data and IoT sensors’ telemetry data at the same time for intrusion detection. Experiments reveal the effectiveness of our method on a realistic network traffic intrusion detection dataset named ToN_IoT, with an accuracy of 97.95% for binary classification and 95.78% for multiple classifications on pure network data. With the extra IoT information, the performance of our method has been improved to 98.39% and 97.06%, respectively. A comparative study with existing works shows that our method can achieve state-of-the-art performance on the ToN_IoT dataset.

A new two-phase intrusion detection system with Naïve Bayes machine learning for data classification and elliptic envelop method for anomaly detection

Technology is pivotal in the rapid growth of services and intensifying the quality of life. Recent technology, like the Internet of Things (IoT), demonstrates an impressive performance in fast-forward development. Intrusion Detection System (IDS) is used as a lifeline to prevent attacks by classifying the activities as normal and suspicious. In this paper, we propose a two-phase IDS for IoT. In the first phase, we categorize data into four sections according to the data types (i.e., nominal, integer, binary, and float). We then classify them using different versions of the Naive Bayes classifier. After that, we use majority voting to choose the final result of the classification. In the second phase, we pass those data which behave normally or are benign in the first phase and classify them using an unsupervised elliptic envelope. We validated our work using the standard NSL-KDD, UNSW_NB15, and CIC-IDS2017 datasets. We found the proposed method more efficient than existing IDS techniques and achieved reasonable accuracy in the first phase. Furthermore, the benign data is sent to the second phase of the analysis. After the second phase, we achieved a 97% accuracy in the NSL-KDD dataset, 86.9% in the UNSW_NB15 dataset, and 98.59% accuracy in the CIC-IDS2017 dataset.

An ensemble deep learning based IDS for IoT using Lambda architecture

The Internet of Things (IoT) has revolutionized our world today by providing greater levels of accessibility, connectivity and ease to our everyday lives. It enables massive amounts of data to be traversed across multiple heterogeneous devices that are all interconnected. This phenomenon makes IoT networks vulnerable to various network attacks and intrusions. Building an Intrusion Detection System (IDS) for IoT networks is challenging as they enable a massive amount of data to be aggregated, which is difficult to handle and analyze in real time mainly because of the heterogeneous nature of IoT devices. This inefficient, traditional IDS approach accentuates the need to develop advanced IDS techniques by employing Machine or Deep Learning. This paper presents a deep ensemble-based IDS using Lambda architecture by following a multi-pronged classification approach. Binary classification uses Long Short Term Memory (LSTM) to differentiate between malicious and benign traffic, while the multi-class classifier uses an ensemble of LSTM, Convolutional Neural Network and Artificial Neural Network classifiers to detect the type of attacks. The model training is performed in the batch layer, while real-time evaluation is carried out through model inferences in the speed layer of the Lambda architecture. The proposed approach gives high accuracy of over 99.93% and saves useful processing time due to the multi-pronged classification strategy and using the lambda architecture.

A Review on IoT Intrusion Detection Systems Using Supervised Machine Learning: Techniques, Datasets, and Algorithms

Physical objects that may communicate with one another are referred to “things” throughout the Internet of Things (IoT) concept. It introduces a variety of services and activities that are both available, trustworthy and essential for human life. The IoT necessitates multifaceted security measures that prioritize communication protected by confidentiality, integrity and authentication services; data inside sensor nodes are encrypted and the network is secured against interruptions and attacks. As a result, the issue of communication security in an IoT network needs to be solved. Even though the IoT network is protected by encryption and authentication, cyber-attacks are still possible. Consequently, it’s crucial to have an intrusion detection system (IDS) technology. In this paper, common and potential security threats to the IoT environment are explored. Then, based on evaluating and contrasting recent studies in the field of IoT intrusion detection, a review regarding the IoT IDSs is offered with regard to the methodologies, datasets and machine learning (ML) algorithms. In This study, the strengths and limitations of recent IoT intrusion detection techniques are determined, recent datasets collected from real or simulated IoT environment are explored, high-performing ML methods are discovered, and the gap in recent studies is identified.

Engineering the application of machine learning in an IDS based on IoT traffic flow

Internet of Things (IoT) devices are now widely used, enabling intelligent services that, in association with new communication technologies like the 5G and broadband internet, boost smart-city environments. Despite their limited resources, IoT devices collect and share large amounts of data and are connected to the internet, becoming an attractive target for malicious actors.This work uses machine learning combined with an Intrusion Detection System (IDS) to detect possible attacks. Due to the limitations of IoT devices and low latency services, the IDS must have a specialized architecture. Furthermore, although machine learning-based solutions have high potential, there are still challenges related to training and generalization, which may impose constraints on the architecture.Our proposal is an IDS with a distributed architecture that relies on Fog computing to run specialized modules and use deep neural networks to identify malicious traffic inside IoT data flows. We compare our IoT-Flow IDS with three other architectures. We assess model generalization using test data from different datasets and evaluate their performance in terms of Recall, Precision, and F1-Score. Results confirm the feasibility of flow-based anomaly detection and the importance of network traffic segmentation and specialized models in the AI-based IDS for IoT.

Internet of Things Intrusion Detection System Based on Convolutional Neural Network

In recent years, the Internet of Things (IoT) technology has developed by leaps and bounds. However, the large and heterogeneous network structure of IoT brings high management costs. In particular, the low cost of IoT devices exposes them to more serious security concerns. First, a convolutional neural network intrusion detection system for IoT devices is proposed. After cleaning and preprocessing the NSL-KDD dataset, this paper uses feature engineering methods to select appropriate features. Then, based on the combination of DCNN and machine learning, this paper designs a cloud-based loss function, which adopts a regularization method to prevent overfitting. The model consists of one input layer, two convolutional layers, two pooling layers and three fully connected layers and one output layer. Finally, a framework that can fully consider the user’s privacy protection is proposed. The framework can only exchange model parameters or intermediate results without exchanging local individuals or sample data. This paper further builds a global model based on virtual fusion data, so as to achieve a balance between data privacy protection and data sharing computing. The performance indicators such as accuracy, precision, recall, F1 score, and AUC of the model are verified by simulation. The results show that the model is helpful in solving the problem that the IoT intrusion detection system cannot achieve high precision and low cost at the same time.

An Intelligent Two-Layer Intrusion Detection System for the Internet of Things

The Internet of Things (IoT) has become an enabler paradigm for different applications, such as healthcare, education, agriculture, smart homes, and recently, enterprise systems. Significant advances in IoT networks have been hindered by security vulnerabilities and threats, which, if not addressed, can negatively impact the deployment and operation of IoT-enabled systems. This article addresses IoT security and presents an intelligent two-layer intrusion detection system for IoT. The system's intelligence is driven by machine learning techniques for intrusion detection, with the two-layer architecture handling flow-based and packet-based features. By selecting significant features, the time overhead is minimized without affecting detection accuracy. The uniqueness and novelty of the proposed system emerge from combining machine learning and selection modules for flow-based and packet-based features. The proposed intrusion detection works at the network layer, and hence, it is device and application transparent. In our experiments, the proposed system had an accuracy of 99.15% for packet-based features with a testing time of 0.357 μs. The flow-based classifier had an accuracy of 99.66% with a testing time of 0.410 μs. A comparison demonstrated that the proposed system outperformed other methods described in the literature. Thus, it is an accurate and lightweight tool for detecting intrusions in IoT systems.

DIDS: A Deep Neural Network based real-time Intrusion detection system for IoT

The number of people using the Internet of Things (IoT) devices has exploded in recent years. The instantaneous development in deploying constrained devices in numerous areas makes them vulnerable to assaults due to limited resources. Advanced cryptography cannot be constructed in these modest battery-powered devices. However, due to the unique properties of the constrained devices, current solutions are insufficient to protect the complete safety scope of IoT networks. An anomaly-based Intrusion Detection System (IDS) is used to identify and categorize assaults. Machine Learning (ML) and Deep Learning (DL) techniques, skilled in embedding intellect in IoT devices and networks, can address various security issues. In this article, we have proposed a deep neural network-based intrusion detection system to identify malicious packets in real-time. We have used newly developed benchmark Netflow-based datasets to train the model. We have proposed a packet capturing and detecting algorithm for real-time attack detection. We also demonstrate the accuracy of our suggested model.

Correlation between Deep Neural Network Hidden Layer and Intrusion Detection Performance in IoT Intrusion Detection System

As the Internet of Things (IoT) continues to grow, a vast amount of data is generated. The IoT environment is quite sensitive to security challenges because personal information may be leaked or sensor data may be manipulated, which could cause accidents. Because traditional intrusion detection system (IDS) studies are often designed to work well on datasets, it is unknown whether they would work well in a changing network environment. In addition, IDSs for protecting IoT environments have been studied, but their performance was verified using datasets unrelated to the IoT, so it is not known whether the performance would be effective in an IoT environment. In this study, we propose an intrusion detection hyperparameter control system (ID-HyConSys) that automates the IDS using proximal policy optimization (PPO) to solve these problems and reliably protect the IoT environment. ID-HyConSys consists of an intrusion detection module consisting of a deep neural network (DNN) feature extractor that extracts efficient features from a changing network environment, a k-means cluster that clusters the extracted data, and a PPO agent that automates the IDS through learning and control. Through experimentation, it was confirmed that the hidden layer configuration, the number of feature extractions by the DNN feature extractor, and the number of clusters in the k-means cluster significantly affected the intrusion detection performance. The PPO directly controls these hyperparameters and determines the optimized value itself. The performance of ID-HyConSys was evaluated using the CICIDS2017 and MQTTset datasets. An F1-score of 0.9707 on CICIDS2017 and an F1-score of 0.9973 on the MQTTset were obtained. Finally, we merged the two datasets and obtained an F1-score of 0.9901. The superiority of the ID-HyConSys proposed in this study was confirmed because ID-HyConSys showed high performance on each dataset and, at the same time, very high performance on complex merged datasets. ID-HyConSys is expected to protect the IoT environment more quickly and safely by automatically learning network changes and adjusting the intrusion detection module accordingly.