Title: A two-stage intrusion detection framework in IoT using random forest for binary and multi-class classification

Authors: Arash Salehpour; Pejman Hosseinioun; Mohammad Ali Balafar

Addresses: Department of Computer Engineering, Faculty of Engineering, Haliç University, Istanbul 34060, Turkey ' Department of Computer Engineering, Isl.C., Islamic Azad University, Islamshahr, Iran ' Department of Computer Engineering, Faculty of Electrical and Computer Engineering, University of Tabriz, Tabriz, East Azarbaijan Province, Iran

Abstract: The proliferation of IoT devices due to cyber threats, which have become increasingly sophisticated, requires a strong security framework. This paper proposes a new framework for Intrusion Detection System-IoT-IDs using a Random Forest classifier to first classify the attack into binary features and prepare a new data set that would enable multiclass classification. It achieved an overall accuracy of 0.98 on the comprehensive UNSW-NB15 data set, with very good performance in detecting 'Generic' attacks, having almost perfect precision, recall and F1-score. It also presents cases of 'Analysis' and 'Backdoor' types of attacks, where further improvements should be done. All these models have been analysed to find the pros and cons in IoT settings using Random Forests, XGBoost and MLP. Further studies based on the research could be done on multiplying models with improved features, intrusion detection in real time and more strong AI techniques. This paper focuses on addressing challenges with imbalanced classes and scalability concerns using data privacy preservation methods for improving the performance of IDS. It represents one step further in continuous improvement with respect to security and reliability of IoT networking, while at the same time opening wide avenues for future research and advances in IDS technologies.

Keywords: IDS; intrusion detection system; IoT; internet of things; ensemble learning; UNSW-NB15; cybersecurity; hybrid models.

DOI: 10.1504/IJGUC.2026.154427

International Journal of Grid and Utility Computing, 2026 Vol.17 No.3, pp.214 - 237

Received: 24 Jul 2024
Accepted: 24 Sep 2024
Published online: 29 Jun 2026 *

Full-text access for editors Full-text access for subscribers Purchase this article Comment on this article