Intrusion Detection in IoT and IIoT: Comparing Lightweight Machine Learning Techniques Using TON_IoT, WUSTL-IIOT 2021, and EdgeIIoTset Datasets

Abstract

There is increasing need for lightweight, scalable and intelligent intrusion detection systems with the rapid growth of IoT and IIoT. In this paper, author present a comprehensive machine learning and deep learning based intrusion detection system and evaluated it on ToN_IoT, WUSTL-IIoT 2021 and Edge-IIoTset datasets. Data preparation includes outlier removal, chi-squared feature selection, and SMOTE/Undersampling imbalance treatment. Algorithms include Convolutional Neural Networks, Deep Neural Networks, Decision Tree, Random Forest, LightGBM, Bagging, a stacking ensemble based on Random Forest and LightGBM and a voting ensemble made of Boosted Decision Tree, Bagging Random Forest and XGBoost. On ToN_IoT, CNN got 93.8% accuracy, DNN got 94.4%, Random Forest got 96.3%, Decision Tree and LightGBM got 96.6%, and the voting ensemble achieved the best accuracy of 98.4%, 98.9% on WUSTL-IIoT 2021, and 96.7% on Edge-IIoTset. Explainable AI techniques, like SHAP and LIME, provide straightforward feature-level explanations. The framework is built with Flask, offers user signin/signout with sqlite, has real-time data input, display data after preprocessing, display the prediction result, and provides actionable data when detecting intrusions in IoT and IIoT security. This implementation allows for secure interaction, visualization and efficient monitoring in various remote industrial network environments around the world.

Introduction

This study focuses on improving Intrusion Detection Systems (IDS) for Internet of Things (IoT) and Industrial Internet of Things (IIoT) environments using Machine Learning (ML), Deep Learning (DL), and Explainable Artificial Intelligence (XAI) techniques. As IoT and IIoT devices continue to grow rapidly, cyberattacks on critical infrastructure such as healthcare, transportation, energy grids, and smart factories have become a major concern. Traditional signature-based IDS struggle to detect new and evolving threats, creating a need for intelligent and adaptive security solutions.

Background and Motivation

The number of connected IoT devices is expected to exceed 55 billion by 2025, significantly increasing cybersecurity risks. IoT devices accounted for a large portion of cyberattacks in recent years, while industrial cyber incidents can cause multi-million-dollar losses. Major attacks such as Mirai, Stuxnet, and Triton demonstrate the vulnerability of IoT and IIoT systems. Because IIoT architectures contain multiple layers (Edge, Middleware, Application, IT/OT, and Cloud), they face threats ranging from physical tampering and malware to insider attacks and cloud data breaches.

Research Contributions

The study makes five main contributions:

1. Evaluates multiple ML and DL algorithms on the ToN-IoT, WUSTL-IIoT 2021, and Edge-IIoTset datasets.
2. Proposes a lightweight ensemble-based IDS framework suitable for resource-constrained IoT/IIoT devices.
3. Integrates Explainable AI (XAI) techniques such as SHAP and LIME for transparent decision-making.
4. Develops a Flask-based real-time intrusion monitoring and prediction system.
5. Improves detection performance using ensemble learning and data balancing techniques.

Literature Review

Previous research has explored various IDS approaches:

• Reinforcement Learning for adaptive intrusion detection in SCADA systems.
• Data balancing techniques such as SMOTE to improve minority attack detection.
• CNN-based and attention-based deep learning models for detecting sophisticated attacks.
• Lightweight IDS models suitable for low-resource IoT devices.
• Federated Learning for privacy-preserving intrusion detection.
• Explainable AI systems to improve trust, transparency, and accountability in security-critical applications.

Researchers have also highlighted challenges such as scalability, explainability, class imbalance, and limited cross-dataset evaluation.

Proposed Framework

The proposed IDS framework follows a complete ML pipeline:

1. Data collection from benchmark IoT/IIoT datasets.
2. Data preprocessing and cleaning.
3. Feature selection using Chi-Square (Chi²) methods.
4. Class balancing using SMOTE and undersampling techniques.
5. Training multiple ML and DL models, including:
   • Random Forest (RF)
   • Decision Tree (DT)
   • XGBoost
   • LightGBM
   • Bagging Classifier
   • Stacking Classifier
   • Voting Classifier
   • Convolutional Neural Network (CNN)
   • Deep Neural Network (DNN)
6. Model evaluation and selection.
7. Real-time deployment through a Flask web application.
8. Explainability using SHAP and LIME.

Datasets Used

The framework is evaluated using three major benchmark datasets:

1. Edge-IIoTset

• 32,404 records and 55 features.
• Includes protocols such as TCP, UDP, DNS, MQTT, and Modbus.
• Contains attacks like DDoS, port scanning, ransomware, password attacks, and vulnerability scanning.

2. ToN-IoT

• 190,474 records and 20 features.
• Covers normal traffic and attacks such as scanning, DDoS, DoS, ransomware, injection, backdoor, XSS, MITM, and password attacks.

3. WUSTL-IIoT 2021

• 1.19 million records and 45 features.
• Includes normal traffic, DoS, reconnaissance, command injection, and backdoor attacks.
• Represents realistic industrial network environments.

Data Preprocessing

To improve model performance, the study applies several preprocessing techniques:

• Data Cleaning: Removes duplicates, missing values, outliers, timestamps, and irrelevant features.
• Data Visualization: Uses correlation analysis and attack distribution plots to understand data patterns.
• Label Encoding: Converts categorical features into numerical values for ML processing.
• Feature Selection: Uses Chi-Square statistics and SelectKBest to retain the most relevant features.
• Data Resampling: Applies SMOTE and RandomUnderSampler to address class imbalance and improve detection of rare attacks.

Conclusion

The paper demonstrates that the lightweight ML models can be integrated with powerful ensemble methods to accurately detect intrusions in IoT and IIoT networks. The system was able to effectively manage high-dimensional and imbalanced network traffic data across varied datasets thanks to comprehensive preprocessing, chi-squared feature selection, and class balancing with SMOTE and undersampling. Applying each of the classifiers together with ensemble methods significantly boosted detection reliability and generalization. The Voting Classifier has consistently performed better than all the other models tested with an accuracy of 98.4%, 98.9%, and 96.7% on the ToN_IoT, WUSTL-IIoT 2021, and Edge-IIoTset datasets, respectively, thus showing its robustness to detect heterogeneous attack patterns. The Explainable AI techniques, such as SHAP and LIME, were employed to enhance model transparency, offering clear explanations on feature contributions and boosting trust in automated decisions. For real-world application the intrusion detection framework was designed using Flask framework that offers a lightweight web based user interface, secure user sign-up, sign-in, real-time data entry, preprocessing, and prediction display through SQLite. In general, the recommended IDS offers a precise, comprehensible, and deployable answer to proactive cyber safety checking in a contemporary IoT and IIoT infrastructure. Future efforts will involve developing the system with an ML-based intrusion detection solution and application on the microcontroller platforms that are widely used in IoT and IIoT applications. With this approach a comprehensive evaluation of the performance in realistic hardware and network scenarios will be possible. Study of energy use, latency and adaptability to dynamic traffic patterns in resource constrained environments will be emphasized. Additionally, other optimization techniques could be explored to reduce computation cost without compromising resilience and accuracy. Lightweight security protocols and edge AI systems will be integrated allowing for smooth detection and response. The upgrades are meant to make the intrusion detection system more useful, scalable and resilient, making it a better fit for industrial, large-scale IoT environments.

References

[1] Alam, K., Monir, M. F., Hassan, Z., & Habib, M. T. (2024, October). Optimizing IoT Network Intrusion Detection: A Deep Learning Approach. In 2024 7th Conference on Cloud and Internet of Things (CIoT) (pp. 1-5). IEEE. [2] Lazzarini, R., Tianfield, H., & Charissis, V. (2023). A stacking ensemble of deep learning models for IoT intrusion detection. Knowledge-Based Systems, 279, 110941. [3] Kim, Y. G., Ahmed, K. J., Lee, M. J., & Tsukamoto, K. (2022, August). A Comprehensive Analysis of Machine Learning-Based Intrusion Detection System for IoT-23 Dataset. In International Conference on Intelligent Networking and Collaborative Systems (pp. 475-486). Cham: Springer International Publishing. [4] Morshedi, R., Matinkhah, S. M., & Sadeghi, M. T. (2024). Intrusion detection for IoT network security with deep learning. Journal of AI and Data Mining, 12(1), 37-55. [5] Eren, K. K., Küçük, K., Özyurt, F., & Alhazmi, O. H. (2025). Simple Yet Powerful: Machine Learning-Based IoT Intrusion System With Smart Preprocessing and Feature Generation Rivals Deep Learning. IEEE Access. [6] J. A. Beauty Angelin and C. Priyadharsini, ‘‘Deep learning based network based intrusion detection system in industrial Internet of Things,’’ in Proc. 2nd Int. Conf. Intell. Data Commun. Technol. Internet Things (IDCIoT), Jan. 2024, pp. 426–432. [7] M. Ramaiah and M. Y. Rahamathulla,‘‘Securing the industrial IoT: A novel network intrusion detection models,’’ in Proc. 3rd Int. Conf. Artif. Intell. For Internet Things (AIIoT), May 2024, pp. 1–6. [8] S. I. Popoola, A. L. Imoize, M. Hammoudeh, B. Adebisi, O. Jogunola, and A. M. Aibinu, ‘‘Federated deep learning for intrusion detection in consumer-centric Internet of Things,’’ IEEE Trans. Consum. Electron., vol. 70, no. 1, pp. 1610–1622, Feb. 2024. [9] Z. Ahmed and S. S. Askar, ‘‘EdgeGuard: Machine learning for proactive intrusion detection on edge networks,’’ Artif. Intell. Cybersecurity, vol. 1, pp. 37–43, Jun. 2024. [10] R. S. Tiwari, D. Lakshmi, T. K. Das, A. K. Tripathy, and K.-C. Li, ‘‘A lightweight optimized intrusion detection system using machine learning for edge-based IIoT security,’’ Telecommun. Syst., vol. 87, no. 3, pp. 605–624, Nov. 2024. [11] F. Mesadieu, D. Torre, and A. Chennamaneni, ‘‘Leveraging deep reinforce ment learning technique for intrusion detection in SCADA infrastructure,’’ IEEE Access, vol. 12, pp. 63381–63399, 2024. [12] A. M. Eid, B. Soudan, A. B. Nassif, and M. Injadat, ‘‘Comparative study of ML models for IIoT intrusion detection: Impact of data preprocessing and balancing,’’ Neural Comput. Appl., vol. 36, no. 13, pp. 6955–6972, May 2024. [13] A. M. Eid, B. Soudan, A. B. Nassif, and M. Injadat, ‘‘Enhancing intrusion detection in IIoT: Optimized CNN model with multi-class SMOTE balancing,’’ Neural Comput. Appl., vol. 36, no. 24, pp. 14643–14659, Aug. 2024. [14] A. H. Farea and K. Küçük, ‘‘Machine learning-based intrusion detection technique for IoT: Simulation with cooja,’’ Int. J. Comput. Netw.Inf. Secur., vol. 16, no. 1, pp. 1–23, Feb. 2024. [15] M. S. Alshehri, O. Saidani, F. S. Alrayes, S. F. Abbasi, and J. Ahmad, ‘‘A self-attention-based deep convolutional neural networks for IIoT networks intrusion detection,’’ IEEE Access, vol. 12, pp. 45762–45772, 2024. [16] K. Bansal and A. Singhrova, ‘‘Review on intrusion detection system for IoT/IIoT-brief study,’’ Multimedia Tools Appl., vol. 83, no. 8, pp. 23083–23108, Aug. 2023. [17] M. Nuaimi, L. C. Fourati, and B. B. Hamed, ‘‘Intelligent approaches toward intrusion detection systems for industrial Internet of Things: A systematic comprehensive review,’’ J. Netw. Comput. Appl., vol. 215, Jun. 2023, Art. no. 103637. [18] G.Guo,X.Pan,H.Liu,F.Li,L.Pei,andK.Hu,‘‘AnIoTintrusiondetection system based on TON IoT network dataset,’’ in Proc. IEEE 13th Annu. Comput. Commun. Workshop Conf. (CCWC), Mar. 2023, pp. 0333–0338. [19] O. Belarbi, T. Spyridopoulos, E. Anthi, I. Mavromatis, P. Carnelli, and A. Khan, ‘‘Federated deep learning for intrusion detection in IoT networks,’’ in Proc. IEEE Global Commun. Conf. (GLOBECOM), vol. 3125, Dec. 2023, pp. 85–99. [20] A. Oseni, N. Moustafa, G. Creech, N. Sohrabi, A. Strelzoff, Z. Tari, and I. Linkov, ‘‘An explainable deep learning framework for resilient intrusion detection in IoT-enabled transportation networks,’’ IEEE Trans. Intell. Transp. Syst., vol. 24, no. 1, pp. 1000–1014, Jan. 2023. [21] D. Musleh, M. Alotaibi, F. Alhaidari, A. Rahman, and R. M. Mohammad, ‘‘Intrusion detection system using feature extraction with machine learning algorithms in IoT,’’ J. Sensor Actuator Netw., vol. 12, no. 2, p. 29, Mar. 2023. [22] M. M. Shtayat, M. K. Hasan, R. Sulaiman, S. Islam, and A. U. R. Khan, ‘‘An explainable ensemble deep learning approach for intrusion detection in industrial Internet of Things,’’ IEEE Access, vol. 11, pp. 115047–115061, 2023. [23] M. Wang, N. Yang, and N. Weng, ‘‘Securing a smart home with a transformer-based IoT intrusion detection system,’’ Electronics, vol. 12, no. 9, p. 2100, May 2023. [24] S. Li, G. Chai, Y. Wang, G. Zhou, Z. Li, D. Yu, and R. Gao, ‘‘CRSF: An intrusion detection framework for industrial Internet of Things based on pretrained CNN2D-RNN and SVM,’’ IEEE Access, vol. 11, pp. 92041–92054, 2023. [25] M. M. Rashid, S. U. Khan, F. Eusufzai, M. A. Redwan, S. R. Sabuj, and M. Elsharief, ‘‘A federated learning-based approach for improving intrusion detection in industrial Internet of Things networks,’’ Network, vol. 3, no. 1, pp. 158–179, Jan. 2023. [26] A. M. Eid, A. B. Nassif, B. Soudan, and M. N. Injadat, ‘‘IIoT network intrusion detection using machine learning,’’ in Proc. 6th Int. Conf. Intell. Robot. Control Eng. (IRCE), Aug. 2023, pp. 196–201. [27] T. Gaber, J. B. Awotunde, S. O. Folorunso, S. A. Ajagbe, and E. Eldesouky, ‘‘Industrial Internet of Things intrusion detection method using machinelearningandoptimizationtechniques,’’WirelessCommun.Mobile Comput., vol. 2023, pp. 1–15, Apr. 2023. [28] B. Xu, L. Sun, X. Mao, R. Ding, and C. Liu, ‘‘IoT intrusion detection system based on machine learning,’’ Electronics, vol. 12, no. 20, p. 4289, Oct. 2023. [29] Z. Benamor, Z. A. Seghir, M. Djezzar, and M. Hemam, ‘‘A comparative study of machine learning algorithms for intrusion detection in IoT networks,’’ Revue d’Intell. Artificielle, vol. 37, no. 3, pp. 567–576, Jun. 2023. [30] M. Al-Hawawreh, E. Sitnikova, and N. Aboutorab, ‘‘X-IIoTID: A connectivity-agnostic and device-agnostic intrusion data set for industrial Internet of Things,’’ IEEE Internet Things J., vol. 9, no. 5, pp. 3962–3977, Mar. 2022.

Copyright

Copyright © 2026 Jaswanth Syam Sundar Garugu. This is an open access article distributed under the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.