IoT Security: Lessons From My Final Year Project

My Final Year Project looked at detecting cyberattacks in smart home and IoT environments using a hybrid intrusion detection system — combining machine learning with signature-based detection and incremental learning. A few things stood out along the way that I didn't fully appreciate before starting.

IoT traffic doesn't stay still

Most public IoT intrusion detection datasets are snapshots. Real device behaviour drifts — firmware updates, new device types, changing usage patterns. A model trained once and never touched again degrades. That's the whole motivation behind looking at incremental and online learning rather than a single static classifier.

Accuracy alone is a misleading headline number

It's tempting to lead with a single accuracy percentage. In practice, false positive rate, resource usage (CPU/memory), and how much a model "forgets" older attack patterns when it adapts (tracked as a Forgetting Index) all matter just as much for something to be usable in a real deployment.

Research results aren't production benchmarks

An experimental accuracy figure from a specific dataset split, under a specific evaluation setup, is not the same claim as "this system is production-ready." I try to be explicit about that distinction on the project page — it matters for how the work should be read.

What's next

Certifications and hands-on labs (network security, SIEM, forensics) are the next step in turning this research interest into operational skill — tracked on the certifications and labs pages as they happen.