IntruDet-LSTM: A Knowledge-Driven Hybrid Intrusion Detection System for IoT Cybersecurity

¹ Department of Computers Techniques Engineering, College of Technical Engineering, The Islamic University, Najaf, Iraq
² Department of Electrical and Electronics Engineering, Nitte Meenakshi Institute of Technology, Nitte (Deemed -to-be University), Bengaluru, India
³ Kakatiya Institute of Technology and Science, Warangal, India
⁴ Department of Electronics and Communication Engineering, Cambridge Institute of Technology, Bengaluru, India
⁵ Department of Computer Science and Engineering, Cambridge Institute of Technology, Bengaluru, India

^* Corresponding author: aruna.m@nmit.ac.in

Abstract

In recent times, Internet of Things (IoT) ecosystem is rapidly expanding, with a flow in various devices being integrated to allow continuous and efficient communication. Most IoT devices are resource-constrained, and without clearly defined security standards, their communications remain exposed to potential risks. As a result, quickly identifying threats within IoT networks is critical, making Intrusion Detection Systems (IDS) an essential component of modern cybersecurity strategies. The unpredictable behavior of IoT traffic demands dynamic and context-sensitive rule configurations. Software Defined Networks (SDN’s) is programmable architecture enables real-time threat justification across heterogeneous IoT environments. The proposed IntruDet-LSTM which is Intrusion Detection with Long Short-Term Memory method introduces a hybrid system for intrusion detection and dynamic rule-based configuration, combining a signature-based SNORT method with a data-driven ensemble model built on LSTM. Fault tolerance is achieved through a dual-layer design, where the intrusion detection and rule configuration models are dissociated, enabling uninterrupted performance even when one layer is compromised. IntruDet-LSTM method effectively reduces false alarms, allowing true IoT traffic to flow continuous and still delivering high detection accuracy. The proposed IntruDet-LSTM achieves accuracy of 99.8%, which is better than existing Deep Integrated Stacking for the IoT (DIS-IoT).