Work

A resilient IoT intrusion detection system using hybrid feature selection and explainable ensemble learning

Year: 2025

Type: article

Abstract: Internet of Things (IoT) networks, comprising billions of connected devices, have become prime targets for cyberattacks that threaten critical digital infrastructure. Traditional intrusion detection systems often fail when individual components encounter implementation barriers, creating security coverage gaps in operational environments. This paper presents a fault-tolerant ensemble framework for multi-class IoT intrusion detection that maintains operational continuity despite component failures. The framework integrates a hybrid feature selection approach that combines statistical filters, recursive feature elimination, and embedded tree-based ranking, achieving a 27.7% dimensionality reduction (from 47 to 34 features). An adaptive ensemble architecture incorporating five models (Balanced Random Forest, LightGBM, CatBoost, Extra Trees, and XGBoost) is designed to handle realistic implementation challenges, with systematic fault tolerance when components fail. When evaluated on the CICIoT2023 dataset, the framework achieved 99.16% accuracy, 73.79% macro F1-score, and 0.9908 MCC while demonstrating systematic fault tolerance. Experimental validation for explainability revealed that packet Inter-Arrival Time, TCP protocol features, and traffic magnitude are the most discriminative attack indicators. These insights help security teams interpret and trust detection outcomes. By integrating high detection performance, fault tolerance, and interpretability, the proposed approach provides a practical pathway for resilient IoT cybersecurity systems and strengthens the foundations for sustainable digital infrastructure protection. • Novel fault-tolerant ensemble framework for multi-class IoT intrusion detection. • Hybrid feature selection achieves 27.7% dimensionality reduction. • Dynamic ensemble voting maintains performance with partial model failures. • Dual-tier explainability guarantees interpretable security insights. • Achieves 99.16% accuracy across 33 attack categories on CICIoT2023.

Source: Results in Engineering

DOI: 10.1016/j.rineng.2025.107392

Authors: Abubakar Wakili, Sara Bakkali

Institution: Euro-Mediterranean University of Fes

Language: English

Topic: Network Security and Intrusion Detection

Subfield: Computer Networks and Communications

Field: Computer Science

Domain: Physical Sciences

SDG: Industry, innovation and infrastructure

Open Access status: gold

Estimated APC paid: $1,940