A Hybrid Machine Learning Model for Detecting Anomalies and Cyberattacks in IoT Networks

Abstract

The rapid expansion of IoT networks has increased their vulnerability to cyberattacks. Their complexity challenges traditional security methods, highlighting the need for advanced detection mechanisms. This study proposes a hybrid machine learning framework for anomaly and attack detection in IoT-enabled smart grids. We evaluate three algorithms—Random Forest (RF), k-Nearest Neighbours (KNN), and Logistic Regression (LR)—using the Canadian Institute for Cybersecurity (CIC) dataset, which includes benign traffic and various cyberattacks (e.g., DDoS, DoS, Mirai). RF was selected for deployment due to its superior accuracy and real-time detection efficiency. To enhance performance, digital twin technology was used for real-time attack simulation, and federated learning enabled decentralized, privacy-preserving anomaly detection. The model was deployed in a Streamlit-based web application for real-time monitoring and alerting. This research bridges the gap between theoretical advancements and practical security solutions for IoT networks