Machine Learning Driven Intrusion Detection for Internet of Things Networks: A Comparative Study of Ensemble and Traditional Models

Abstract

This study investigates the effectiveness of an intrusion detection system (IDS) powered by machine learning (ML) for securing Internet of Things environments. The growth of IoT devices has increased exposure to complex cyber threats that traditional security mechanisms struggle to detect. In this work, a supervised learning based intrusion detection framework was developed and evaluated using the publicly available UNSW-NB15 dataset, which represents real IoT network traffic scenarios. The methodology involved data preprocessing, feature engineering, model training, and performance evaluation using multiple metrics including accuracy, precision, recall, F1-score, and Area Under the Curve (AUC). Five ML models were examined, namely Random Forest, XGBoost, Decision Tree, Logistic Regression and Naive Bayes. Experimental results show that ensemble models achieved superior performance. Random Forest recorded the highest performance with an accuracy of 99.78%, precision of 9.59%, recall of 98.27%, F1-score of 97.93% and AUC of 99.99%, followed by XGBoost with accuracy of 99.76%, precision of 97.72%, recall of 97.84%, F1-score of 97.78% and AUC of 99.99%. Decision Tree achieved an accuracy of 99.68%, precision of 96.76%, recall of 97.28%, F1-score of 97.02% and AUC of 98.55%, while Logistic Regression recorded an accuracy of 99.28%, precision of 91.07%, recall of 95.86%, F1-score of 93.40% and AUC of 99.92%. Naive Bayes produced lower performance with accuracy of 92.91%, precision of 40.16%, recall of 66.30%, F1-score of 50.02% and AUC of 93.56%, indicating reduced capability in modeling complex IoT traffic patterns. Further analysis using confusion matrices, ROC curves, and calibration plots confirmed the robustness and reliability of ensemble approaches. The findings demonstrate that ML driven intrusion detection is effective for IoT security, with XGBoost and Random Forest offering the best balance between detection performance and false alarm reduction.