Intelligent Intrusion Detection in IoT Networks Using Data Mining and Machine Learning Techniques

Abstract

The rapid expansion of Internet of Things (IoT) technologies has introduced major cybersecurity challenges due to the increasing number of connected and resource-constrained devices vulnerable to various berattacks. In this context, Intrusion Detection Systems (IDS) play a fundamental role in protecting IoT environments against malicious activities and unauthorized access.This thesis aims to design and develop an efficient IDS framework based on machine learning and deep learning techniques for IoT security. A comprehensive eoretical study was first conducted on IoT concepts, architectures, communication protocols, and security challenges, along with an overview of intrusion detection systems and the most widely used datasets in this field. In the practical part, the CICIoT2023 dataset was utilized and processed through several preprocessing stages, including data cleaning, attack label grouping, encoding, class imbalance handling, data normalization, and feature selection. Multiple machine learning and deep learning models were then trained and evaluated using standard performance metrics such as accuracy, precision, recall, and F1-score. In addition, mputational efficiency metrics including training time, inference speed, and model size were analyzed to evaluate the suitability of each model for IoT environments. The experimental results demonstrated that tree-based machine learning models, particularly XGBoost and LightGBM, achieved superior classification performance while maintaining low computational cost compared to deep learning models. Furthermore, explainability techniques such as SHAP (SHapley Additive exPlanations) were integrated to improve model interpretability and identify the most influential network traffic features in the decision-making process. In conclusion, this study highlights the effectiveness of machine learning approaches in improving intrusion detection systems for IoT security hile emphasizing the importance of balancing detection performance, computational efficiency, and model terpretability in modern cybersecurity applications.