Detecting Cyberattacks in Smart Home and IoT Environments
AI-Driven Adaptive Intrusion Detection System
Supervisor: Dr. Naveen Palanichamy
A Final Year Project (Cybersecurity, Multimedia University) investigating an adaptive intrusion detection approach for IoT and smart-home environments, combining machine learning with signature-based detection and incremental / online learning to stay effective as network behaviour drifts over time.
Click a stage to see what it does.
87.81%
Overall Accuracy
Precision, Recall, F1, FPR, Forgetting Index, CPU/Memory
Metrics Tracked
Experimental result obtained during project development and evaluation. Performance depends on the dataset, preprocessing, experimental setup and evaluation methodology used, and should not be read as a validated production benchmark.
Problem
IoT and smart-home devices are increasingly targeted by network-based attacks, yet many intrusion detection systems are trained once and do not adapt as device behaviour and attack patterns change over time.
Motivation
Static, signature-only detection struggles against novel or evolving attacks, while purely ML-based detectors can drift or degrade in accuracy as new traffic patterns emerge. A hybrid, adaptive approach aims to combine the strengths of both.
Research Gap
Existing IoT IDS research often evaluates models on static snapshots of traffic. This project explores incremental, online and transfer learning techniques so the detector can adapt to concept drift without full retraining.
Methodology
Network traffic was captured and processed into features, then evaluated using a hybrid detection pipeline combining a Random Forest classifier, an incremental SGD-based online learner, and a signature-based detection layer, with adaptive feedback used to update the model over time.
Architecture
Network Traffic → Packet Capture → Feature Extraction → Machine Learning → Hybrid IDS (Random Forest + Incremental SGD + Signature Detection) → Threat Detection → Alert / Logging → Adaptive Feedback → Model Update.
Dataset
Experiments drew on TON_IoT, Bot-IoT, UNSW-NB15, CICIoT2023, and simulated TCP/IP traffic to evaluate detection performance across a range of IoT attack scenarios.
Implementation
Implemented in Python using Pandas and NumPy for data processing, Scikit-learn for the Random Forest and incremental SGD components, PyTorch/TensorFlow during experimentation, and Scapy for packet-level handling, all developed in Jupyter Notebook.
Results
An experimental configuration (fusion weights: Random Forest 50%, Incremental SGD 30%, Signature IDS 20%) reached 87.81% overall accuracy on the evaluated dataset split. This is an experimental project result, not an industry benchmark or production performance figure — it depends heavily on the dataset, preprocessing and evaluation methodology used.
Lessons Learned
Balancing detection accuracy against false positives and computational cost (CPU/memory usage) is a central trade-off in adaptive IDS design, and incremental learning introduces its own challenges around catastrophic forgetting, tracked here via a Forgetting Index metric.
Related Publication
Presented a related paper, "Adaptive Learning in Intrusion Detection Systems: A Review," at CITIC2026 (in conjunction with DIFCON2026) at Multimedia University, May 2026.