Intrusion Detection Techniques Research Articles

Ensemble technique of intrusion detection for IoT-edge platform

Internet of Things (IoT) technology has revolutionized modern industrial sectors. Moreover, IoT technology has been incorporated within several vital domains of applicability. However, security is overlooked due to the limited resources of IoT devices. Intrusion detection methods are crucial for detecting attacks and responding adequately to every IoT attack. Conspicuously, the current study outlines a two-stage procedure for the determination and identification of intrusions. In the first stage, a binary classifier termed an Extra Tree (E-Tree) is used to analyze the flow of IoT data traffic within the network. In the second stage, an Ensemble Technique (ET) comprising of E-Tree, Deep Neural Network (DNN), and Random Forest (RF) examines the invasive events that have been identified. The proposed approach is validated for performance analysis. Specifically, Bot-IoT, CICIDS2018, NSL-KDD, and IoTID20 dataset were used for an in-depth performance assessment. Experimental results showed that the suggested strategy was more effective than existing machine learning methods. Specifically, the proposed technique registered enhanced statistical measures of accuracy, normalized accuracy, recall measure, and stability.

Boosting Network Security: A comparative Analysis of Deep Learning Techniques for Intrusion Detection

This paper addresses demanding situations in Intrusion Detection Systems (IDS) by way of combining the Adaptive Synthetic Sampling (ADASYN) method with a break up-primarily based Resnet framework. ADASYN balances sample distribution, overcoming biases in the direction of large samples. Our method extracts multiscale functions, reduces interchannel redundancy, and enhances the version's capability using a smooth hobby operation. We recommend a Residual Neural Network (ResNN) version for intrusion detection, displaying massive enhancements in recognition accuracy and execution performance. Ongoing work targets to optimize performance further, highlighting the capacity for extra strong IDS solutions.

DTT: A Dual-domain Transformer model for Network Intrusion Detection

With the rapid evolution of network technologies, network attacks have become increasingly intricate and threatening. The escalating frequency of network intrusions has exerted a profound influence on both industrial settings and everyday activities. This underscores the urgent necessity for robust methods to detect malicious network traffic. While intrusion detection techniques employing Temporal Convolutional Networks (TCN) and Transformer architectures have exhibited commendable classification efficacy, most are confined to the temporal domain. These methods frequently fall short of encompassing the entirety of the frequency spectrum inherent in network data, thereby resulting in information loss. To mitigate this constraint, we present DTT, a novel dual-domain intrusion detection model that amalgamates TCN and Transformer architectures. DTT adeptly captures both high-frequency and low-frequency information, thereby facilitating the simultaneous extraction of local and global features. Specifically, we introduce a dual-domain feature extraction (DFE) block within the model. This block effectively extracts global frequency information and local temporal features through distinct branches, ensuring a comprehensive representation of the data. Moreover, we introduce an input encoding mechanism to transform the input into a format suitable for model training. Experiments conducted on two distinct datasets address concerns regarding data duplication and diverse attack types, respectively. Comparative experiments with recent intrusion detection models unequivocally demonstrate the superior performance of the proposed DTT model.

A comparative assessment of machine learning algorithms in the IoT-based network intrusion detection systems

The rapid increase in online risks is a reflection of the exponential growth of Internet of Things (IoT) networks. Researchers have proposed numerous intrusion detection techniques to mitigate the harm caused by these threats. Enterprises use intrusion detection systems (IDSs) and intrusion prevention systems (IPSs) to keep their networks safe, stable, and accessible. Network intrusion detection solutions have lately integrated powerful Machine Learning (ML) techniques to safeguard IoT networks. Selecting the proper data features for effectively training such ML models is critical to maximizing detection accuracy and computational efficiency. However, the efficiency of these systems degrades in high-dimensional data spaces, and it is crucial to have a suitable feature extraction method to eliminate extraneous data from the classification procedure. The detection accuracy and false positive rate of many ML-based IDSs also rise when the samples used to train the models are unbalanced. This study provides a detailed overview of the UNSW-NB15(DS-1) and NF-UNSWNB15(DS-2) datasets for intrusion detection, which will be utilized to develop and evaluate our models. In addition, this model uses the MaxAbsScaler algorithm to implement a filter-based feature scaling strategy . Then, use the condensed feature set to perform several ML techniques, including Support Vector Machines (SVM), K-nearest neighbors (KNN), Logistic Regression (LR), Naive Bayes (NB), Decision Tree (DT), and Random Forest (RF), considering multiclass classification. Accuracy tests for the multiclass classification scheme were improved from 60% to 94% using the MaxAbsScaler-based feature scaling method.

Optimized common features selection and deep-autoencoder (OCFSDA) for lightweight intrusion detection in Internet of things

AbstractEmbedded systems, including the Internet of things (IoT), play a crucial role in the functioning of critical infrastructure. However, these devices face significant challenges such as memory footprint, technical challenges, privacy concerns, performance trade-offs and vulnerability to cyber-attacks. One approach to address these concerns is minimising computational overhead and adopting lightweight intrusion detection techniques. In this study, we propose a highly efficient model called optimized common features selection and deep-autoencoder (OCFSDA) for lightweight intrusion detection in IoT environments. The proposed OCFSDA model incorporates feature selection, data compression, pruning, and deparameterization. We deployed the model on a Raspberry Pi4 using the TFLite interpreter by leveraging optimisation and inferencing with semi-supervised learning. Using the MQTT-IoT-IDS2020 and CIC-IDS2017 datasets, our experimental results demonstrate a remarkable reduction in the computation cost in terms of time and memory use. Notably, the model achieved an overall average accuracies of 99% and 97%, along with comparable performance on other important metrics such as precision, recall, and F1-score. Moreover, the model accomplished the classification tasks within 0.30 and 0.12 s using only 2KB of memory.

Cyber Intrusion Detection System Using Deep Learning Approach

Abstract: Technological developments in network communications have led to a remarkable increase in network traffic and an explosion in the use of linked devices across a number of commercial fields. Systems for detecting intrusions that can recognize malicious assaults from traffic data might be useful instruments for protecting company assets from illegal access. This project suggests a two-stage architecture for an intrusion detection system, where an auto encoder (AE) and the grey wolf algorithm (GWO) choose features. It is evaluated using the Bot-Iot and NSL-KDD datasets, yielding better accuracy levels for binary and multiclass attack categorization. This method outperforms the latest intrusion detection techniques in terms of categorization using an ideal selection of traffic characteristics.

A Robust Intrusion Detection System Empowered by Generative Adversarial Networks

There is a very bleak outlook on cyber security due to the rapid expansion of the Internet and the ever-changing terrain of cyber-attacks. This paper explores the field of intrusion detection through network analysis, with a particular emphasis on applying machine learning (ML) and deep learning (DL) approaches. For every ML/DL technique, a thorough tutorial overview is given together with a review of pertinent research publications. These studies were read, indexed, and summarised according to their thermal or temporal correlations with great care. The paper also provides information on frequently used network datasets in this field, which is relevant given the critical role that data plays in ML/DL techniques. It also discusses the difficulties in using ML/DL for cyber security and provides insightful recommendations for future lines of inquiry. Interestingly, the KDD data set shows up as a reputable industry standard for intrusion detection methods. A lot of work is being done to improve intrusion detection techniques, and both training and evaluating the detection model's quality depend equally on the quality of the data. The KDD data collection is thoroughly analysed in this research, with a special emphasis on four different attribute classes: Basic, Content, Traffic, and Host. We use the Modified Random Forest (MRF) technique to classify these properties.

Deep Learning Based Security Schemes for IoT Applications: A Review

Due to its widespread perception as a crucial element of the Internet of the future, the Internet of Things (IoT) has garnered a lot of attention in recent years. The Internet of Things (IoT) is made up of billions of sentients, communicative "things" that expand the boundaries of the physical and virtual worlds. Every day, such widely used smart gadgets generate enormous amounts of data, creating an urgent need for rapid data analysis across a range of smart mobile devices. Thankfully, current developments in deep learning have made it possible for us to solve the issue tastefully. Deep models may be built to handle large amounts of sensor data and rapidly and effectively learn underlying properties for a variety of Internet of Things applications on smart devices. We review the research on applying deep learning to several Internet of Things applications in this post. Our goal is to provide insights into the many ways in which deep learning techniques may be used to support Internet of Things applications in four typical domains: smart industrial, smart home, smart healthcare, and smart transportation. One of the main goals is to seamlessly integrate deep learning and IoT, leading to a variety of novel ideas in IoT applications, including autonomous driving, manufacture inspection, intelligent control, indoor localization, health monitoring, disease analysis, and home robotics. We also go over a number of problems, difficulties, and potential avenues for future study that make use of deep learning (DL), which is turning out to be one of the most effective and appropriate methods for dealing with various IoT security concerns. The goal of recent research has been to enhance deep learning algorithms for better Internet of Things security. This study examines deep learning-based intrusion detection techniques, evaluates the effectiveness of several deep learning techniques, and determines the most effective approach for deploying intrusion detection in the Internet of Things. This study uses Deep Learning (DL) approaches to better expand intelligence and application skills by using the large quantity of data generated or acquired. The many IoT domains have drawn the attention of several academics, and both DL and IoT approaches have been explored. Because DL was designed to handle a variety of data in huge volumes and required processing in virtually real-time, it was indicated by several studies as a workable method for handling data generated by IoT.

Enhancing IoT Security: A Few-Shot Learning Approach for Intrusion Detection

Recently, the number of Internet of Things (IoT)-connected devices has increased daily. Consequently, cybersecurity challenges have increased due to the natural diversity of the IoT, limited hardware resources, and limited security capabilities. Intrusion detection systems (IDSs) play a substantial role in securing IoT networks. Several researchers have focused on machine learning (ML) and deep learning (DL) to develop intrusion detection techniques. Although ML is good for classification, other methods perform better in feature transformation. However, at the level of accuracy, both learning techniques have their own certain compromises. Although IDSs based on ML and DL methods can achieve a high detection rate, the performance depends on the training dataset size. Incidentally, collecting a large amount of data is one of the main drawbacks that limits performance when training datasets are lacking, and such methods can fail to detect novel attacks. Few-shot learning (FSL) is an emerging approach that is employed in different domains because of its proven ability to learn from a few training samples. Although numerous studies have addressed the issues of IDSs and improved IDS performance, the literature on FSL-based IDSs is scarce. Therefore, an investigation is required to explore the performance of FSL in IoT IDSs. This work proposes an IoT intrusion detection model based on a convolutional neural network as a feature extractor and a prototypical network as an FSL classifier. The empirical results were analyzed and compared with those of recent intrusion detection approaches. The accuracy results reached 99.44%, which shows a promising direction for involving FSL in IoT IDSs.

IoT Guardian: A Novel Feature Discovery and Cooperative Game Theory Empowered Feature Selection with ML Model for IoT Threats & Attack Detection

Cyber intrusion attacks increasingly target the Internet of Things (IoT) ecosystem, exploiting vulnerable devices and networks. Malicious activities must be identified early to minimize damage and mitigate threats. Using actual benign and attack traffic from the CICIoT2023 dataset, this WORK aims to evaluate and benchmark machine-learning techniques for IoT intrusion detection. There are four main phases to the system. First, the CICIoT2023 dataset is refined to remove irrelevant features and clean up missing and duplicate data. The second phase employs statistical models and artificial intelligence to discover novel features. The most significant features are then selected in the third phase based on cooperative game theory. Using the original CICIoT2023 dataset and a dataset containing only novel features, we train and evaluate a variety of machine learning classifiers. On the original dataset, Random Forest achieved the highest accuracy of 99%. Still, with novel features, Random Forest's performance dropped only slightly (96%) while other models achieved significantly lower accuracy. As a whole, the work contributes substantial contributions to tailored feature engineering, feature selection, and rigorous benchmarking of IoT intrusion detection techniques. IoT networks and devices face continuously evolving threats, making it necessary to develop robust intrusion detection systems.

A Comprehensive Review of Dimensionality Reduction Techniques for Real time Network Intrusion Detection with Applications in Cybersecurity

This paper reviews popular signature and anomaly-based intrusion detection systems (IDS). Dimensionality reduction techniques (DRT) are used to increase the efficiency of such systems for real-time operation. Autoencoder-based IDS is rapidly gaining in popularity, primarily due to its inherent ability to denoise data and reduce dimensionality. In addition to the efficiency, we also look at the classification techniques used by various authors, and the overall impact of a model in terms of performance metrics. This article is written for novices in cybersecurityto get a jumpstart on the latest IDS algorithms. The purpose is to give useful insights into the broad and progressive view of various techniques in wide use, expose high-impact future research areas and to summarize classic IDS methods and feature selection techniques.

Deep learning-based integrated attack detection framework to protect distance relays against cyberattacks

The cyber security of communication-assisted intelligent relays at the IEC61850-enabled modern digital substations has become a prime concern among power companies and regulatory bodies. Particularly, distance relay IEDs are easy to manipulate to send false trip command to circuit breakers through random false data injection and replay attacks. With these attacks evolving and becoming more sophisticated, existing intrusion detection techniques can be easily compromised, resulting in unwanted line outages. This work proposes a convolutional-based autoencoder and Siamese neural network deep learning integrated attack detection framework (IADF) to differentiate these attacks from actual faults. The framework works in conjunction with distance relay IEDs to issue genuine trip commands to circuit breakers. The autoencoder, trained on fault voltage and current signals, detects the false data injection attacks using reconstruction error, while the siamese neural network trained on similar and dissimilar pairs of the fault voltage and current signals detects the fully synchronized replay attacks using similarity estimation with fault data stored on database. The validity of the proposed framework is assessed using IEEE 39 and 118 bus test system simulated on PSCAD/EMTDC software. The validation results suggest that the proposed IADF can accurately discriminate the faults from attacks and is resilient to various system parameter changes.

An efficient intrusion detection model based on convolutional spiking neural network

Many intrusion detection techniques have been developed to ensure that the target system can function properly under the established rules. With the booming Internet of Things (IoT) applications, the resource-constrained nature of its devices makes it urgent to explore lightweight and high-performance intrusion detection models. Recent years have seen a particularly active application of deep learning (DL) techniques. The spiking neural network (SNN), a type of artificial intelligence that is associated with sparse computations and inherent temporal dynamics, has been viewed as a potential candidate for the next generation of DL. It should be noted, however, that current research into SNNs has largely focused on scenarios where limited computational resources and insufficient power sources are not considered. Consequently, even state-of-the-art SNN solutions tend to be inefficient. In this paper, a lightweight and effective detection model is proposed. With the help of rational algorithm design, the model integrates the advantages of SNNs as well as convolutional neural networks (CNNs). In addition to reducing resource usage, it maintains a high level of classification accuracy. The proposed model was evaluated against some current state-of-the-art models using a comprehensive set of metrics. Based on the experimental results, the model demonstrated improved adaptability to environments with limited computational resources and energy sources.

Class imbalance and concept drift invariant online botnet threat detection framework for heterogeneous IoT edge

Heterogeneous networks (HetIoT) of high-capacity and resource-constrained IoT devices and their edge associations for on-device distributed critical workloads—called the edge-of-things (EoT)—attract short-burst, botnet-based zero-day attacks that exploit latent vulnerabilities due to heterogeneous device properties, dynamic operational contexts, and insufficient security scrutiny of the constituent proprietary devices. Such a scenario necessitates a device-specific network intrusion detection (NID) technique for localizing the threat space and updated rule learning through online (real-time) model retraining. Furthermore, scarce labeled knowledge base and high levels of class imbalance of NID datasets complicate the ID system design process for EoT environments, as online detection cannot afford computationally expensive data balancing techniques; this necessitates a class imbalance invariant traffic inference technique for data preprocessing. Therefore, we propound the ONIDS online NID technique, which consists of a two-fold solution for the above problems. First, we propose a Beta distribution-based inference technique for efficient traffic behavior approximation—invariant of class imbalance and capable of non-cumulative traffic processing of smaller sample sizes. Then, we put forth an online ID technique called ELMO for class imbalance invariant time-bound training of smaller sample sizes on resource-constrained device-specific network traffic. Together, they are invariant of traffic class imbalances and adaptable to resultant concept drift categories exhibited by HetIoT attack behaviors. ONIDS has low memory and compute footprints and can efficiently process large and small amounts of traffic, making it suitable for online and offline NID. It also exhibits qualitative and quantitative superiority—particularly on smaller data samples.

Energy efficiency in 5G systems: A systematic literature review

To ensure Energy Efficiency (EE) and better Quality of service (QoS), it is necessary to analyze the energy saving possibilities for low resource utilization in the current networks caused by rigorous QoS requirements and implementing EE approach in the planned model for performance improvement. Distributed Denial of Service (DDoS) attacks aim to exhaust the network’s processing and communication capacity by saturating it with packets and generating malicious traffic. There are numerous advantages that make Digital Twin (DT) and Intrusion Detection technique (ID) an effective remedy for a range of (fifth generation) 5G problems. A DDoS attack must be immediately detected and stopped before a legitimate user can access the target of the attacker for the 5G network to provide an efficient energy service. Although they clearly show promise in assisting with the creation and implementation of the challenging 5G environment, Digital Twins is still a relatively new technology for 5G networks but will increase EE. In this research, a thorough examination of the materials was carried out to identify the most cutting-edge DT and ID methods. The purpose of this study was to comprehend the problems with Energy Efficiency, the need for DT, and the methods for dealing with large-scale attack by DDoS on Energy Efficient networks. Only 94 of the 1555 articles produced by the procedure were determined to be relevant using inclusion and exclusion criteria. The outcome demonstrates that in 5G networks, DT, and its fundamental approaches, like QoS and DDoS attack mitigation, can be used to regulate the network’s Energy Efficiency. Numerous practical applications focusing on 5G Systems use their own principles. The effectiveness of these strategies was evaluated using several assessment criteria, including DT, Intrusion Detection, QoS, Energy Efficiency, and 5G Systems. Each study issue is thoroughly explained, along with typical methods, advantages, disadvantages, and performance metrics. Energy economy, network reliability, privacy, and cost reduction are all considerably increased by the implementation of intrusion detection technology in 5G systems. The decision is supported by the technology’s demonstrated efficacy, scalability, real-time detection capacities, low error level, and personalized learning attributes, all of which contribute to the long-term viability of 5G networks as an entire system.

Utilization of adaptive techniques for channel estimation and intrusion detection in OWC systems

Utilization of adaptive techniques for channel estimation and intrusion detection in OWC systems

Intrusion Detection Using Bat Optimization Algorithm and DenseNet for IoT and Cloud Based Systems

In Internet of Things (IoT) and cloud systems, Intrusion Detection (ID) is very vital for protecting the security infrastructures. ID techniques are extensively used to detect and track malicious threats in cloud and IoT systems. In the IoT based ID, the conventional techniques work based on the manual traffic feature values that increase the complexity of the networks and achieve a limited detection rate on the larger IoT databases. For addressing the above-stated issues and achieving high classification results, an effective deep learning based ID-System (IDS) is implemented in this article. Initially, the IoT data is acquired from the NSW-NB15 and NSL-KDD databases, and then, the standard scaling normalization technique, known as Min-Max normalization, is applied to select the dominant attributes and to eliminate outliers from the acquired databases. Additionally, the optimal features are selected from the rescaled normalized data by implementing the Bat optimization algorithm. The selection of optimal features decreases the computational complexity and training time of the IDS. The chosen optimal features are passed into the DenseNet model for carrying out intrusion attack detection. Particularly, in the binary-class classification, the Bat-based DenseNet model obtained 98.89% and 98.40% of accuracy on the UNSW-NB15 and NSL-KDD databases, correspondingly. The obtained simulation results prove the higher effectiveness of the current study when it is related to the state-of-the-art classifiers.

A Study of Role and Applicability of Data Mining Techniques in Intrusion Detection Systems

Abstract: The swift development of computers technologies changed the way data and information were kept. The risk of this data being exposed to uninvited and unauthorized users arises with this new paradigm of data access. Numerous systems have been created that examine data to look for deviations from a user's or system's typical behavior or look for a known signature in the data. Intrusion Detection Systems (IDS) is the name given to these systems. These systems use a variety of approaches, including machine learning algorithms and statistical methodologies. With the massive rise in the use of network-based services and information sharing on networks, network security has emerged as the fundamental component. The integrity, confidentiality, and availability of computer and network resources are all seriously compromised by intrusion, which also poses a severe risk to network security. Network audit data classification by humans is a costly, time-consuming, and laborious task. An intrusion detection system (IDS) is one tool used to find anomalies and attacks on a network. The network intrusion detection system has made extensive use of data mining techniques to extract valuable information from vast amounts of network data. This work proposes a hybrid model that combines two distinct intrusion detection techniques: anomaly-based and signaturebased. The model is separated into two stages. Systems for detecting intrusions make use of audit data produced by network devices, operating systems, and application software. These sources generate enormous databases that contain tens of millions of records. Data mining, which is the process of extracting meaningful patterns from a sizable amount of information, is used to analyze this data. The presented paper deals with the role and the applicability of data mining techniques in designing and developing the IDS Systems.

A Transferable Deep Learning Framework for Improving the Accuracy of Internet of Things Intrusion Detection

As the size of the IoT solutions and services market proliferates, industrial fields utilizing IoT devices are also diversifying. However, the proliferation of IoT devices, often intertwined with users’ personal information and privacy, has led to a continuous surge in attacks targeting these devices. However, conventional network-level intrusion detection systems with pre-defined rulesets are gradually losing their efficacy due to the heterogeneous environments of IoT ecosystems. To address such security concerns, researchers have utilized ML-based network-level intrusion detection techniques. Specifically, transfer learning has been dedicated to identifying unforeseen malicious traffic in IoT environments based on knowledge distillation from the rich source domain data sets. Nevertheless, since most IoT devices operate in heterogeneous but small-scale environments, such as home networks, selecting adequate source domains for learning proves challenging. This paper introduces a framework designed to tackle this issue. In instances where assessing an adequate data set through pre-learning using transfer learning is non-trivial, our proposed framework advocates the selection of a data set as the source domain for transfer learning. This selection process aims to determine the appropriateness of implementing transfer learning, offering the best practice in such scenarios. Our evaluation demonstrates that the proposed framework successfully chooses a fitting source domain data set, delivering the highest accuracy.

Modified genetic algorithm and fine-tuned long short-term memory network for intrusion detection in the internet of things networks with edge capabilities

The emergence of smart cities is an example of how new technologies, such as the Internet of Things (IoT), have facilitated the creation of extensive interconnected and intelligent ecosystems. The widespread deployment of IoT devices has enabled the provision of constant environmental feedback, thereby facilitating the automated adaptation of associated systems. This has brought about a fundamental transformation in the way contemporary society functions. The security of emerging technologies such as IoT has become a significant challenge due to the added complexities, misconfigurations, and conflicts between modern and legacy systems. This challenge has a notable impact on the reliability and accessibility of existing infrastructure. Edge computing (EC) is a collaborative computing system that brings data processing and analysis closer to the edge of the network, where the data is generated, rather than in a centralized cloud environment. The utilization of the IoT has become more prevalent in both everyday life and the manufacturing sector, with a particular emphasis on critical infrastructure. The IoT is presently being utilized across diverse domains, including but not limited to industrial, agricultural, healthcare, and logistical sectors. The security of IoT networks has implications for the safety of individuals, the security of the nation, and economic development. Notwithstanding, conventional intrusion detection techniques that rely on centralized cloud-based systems that have been suggested in previous studies for IoT network security are insufficient to meet the requirements for data confidentiality, network capacity, and prompt responsiveness. In addition, the integration of IoT applications into smart devices has been shown to augment their functionalities. However, it is important to note that this integration also brings about potential security vulnerabilities. Furthermore, a significant number of contemporary IoT devices exhibit restricted security capabilities, rendering them vulnerable to intricate attacks and impeding the extensive integration of IoT technologies. Also, a lot of IoT network devices have been put in place that don't have hardware security measures. This means that traditional intrusion detection systems (IDS) aren't enough to protect the IoT network ecosystem. To address these issues, this research suggests the IoT-Defender framework, which combines a Modified Genetic Algorithm (MGA) model with a deep Long Short-Term Memory (LSTM) network to find cyberattacks in IoT networks. This research represents a pioneering attempt to employ the MGA for feature selection and the GA for fine-tuning the LSTM parameters within an EC framework. The parameters of the LSTM model were fine-tuned through the manipulation of the number of hidden layers, utilizing the GA fitness function. The customization of the MGA aimed to enhance its performance in selecting relevant features, optimizing the use of limited resources on IoT devices and edge nodes. The fine-tuning process involved optimizing hyperparameters, architecture, and training strategies to maximize the LSTM network's effectiveness in learning and detecting patterns in IoT network traffic. The synergy between the MGA and LSTM aimed at creating a comprehensive and efficient IDS. The feature selection by the MGA contributes to improving the LSTM’s performance by providing it with more relevant and discriminating features. In order to solve the issue of class imbalance, we utilize the focal loss function, which provides greater weights to minority classes, hence improving the model’s capacity to learn from those particular classes. The performance of the IoT-Defender model was assessed on the BoT-IoT, UNSW-NB15, and N-BaIoT datasets utilizing a Raspberry Pi IoT device. The results of our study show that the IoT-Defender model works better than other methods. This is shown by its accuracy score of 99.41%, detection rate of 99.78%, precision score of 98.50%, false alarm rate of 2.56%, mean intersection over union (mIoU) of 0.68, and training time of 81.3 seconds on BoT-IoT. The proposed IoT model is designed to be lightweight and can be installed on edge servers to detect cyber-attacks in real-time, specifically in the context of IoT security.