Enhancing IoT Intrusion Detection System using ASAE-XGBoost for Binary and Multi-class Attack Classification

Abstract

As the number of Internet of Things (IoT) devices continues to grow, the IoT network has become more vulnerable to cyber threats, which requires reliable intrusion detection systems (IDSs) to protect IoT environments. Despite their extensive use, traditional IDSs still face challenges in detecting unknown attacks and accurately classifying different attack categories. To bridge these challenges, we propose a hierarchical two-stage intrusion detection framework based on the integration of the Asymmetric Stacked AutoEncoder (ASAE) with XGBoost for binary anomaly detection and multi-class attack classification. The ASAE is trained only on normal traffic to identify anomalous traffic patterns, while the XGBoost classifier uses the learned latent representations to classify the detected attacks into their corresponding categories. We evaluate the proposed framework on two real-world datasets, TON_IoT Network and IOTID20, using a standardized experimental protocol. Results show that the proposed framework demonstrates reliable binary anomaly detection performance, accurate attack classification along with a low computational cost across both datasets. Reliable performance on both datasets confirm that our framework is a lightweight, robust and effective intrusion detection system in real-time diverse IoT network environments.