TSM-NIDS: A time-series mixer-based intrusion detection system for IoT networks - PMC Skip to main content An official website of the United States government Here's how you know Here's how you know Official websites use .gov A .gov website belongs to an official government organization in the United States. Secure .gov websites use HTTPS A lock ( Lock Locked padlock icon ) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites. Search Log in Dashboard Publications Account settings Log out Search… Search NCBI Primary site navigation Search Logged in as: Dashboard Publications Account settings Log in Search PMC Full-Text Archive Search in PMC Journal List User Guide PERMALINK Copy As a library, NLM provides access to scientific literature. Inclusion in an NLM database does not imply endorsement of, or agreement with, the contents by NLM or the National Institutes of Health. Learn more: PMC Disclaimer | PMC Copyright Notice MethodsX . 2026 Mar 24;16:103885. doi: 10.1016/j.mex.2026.103885 Search in PMC Search in PubMed View in NLM Catalog Add to search TSM-NIDS: A time-series mixer-based intrusion detection system for IoT networks ☆ Muhammad Iffat bin Hanafiah Muhammad Iffat bin Hanafiah a Faculty of Information Science and Technology, Multimedia University, Jalan Ayer Keroh Lama, 75450 Melaka, Malaysia Find articles by Muhammad Iffat bin Hanafiah a , Ying Han Pang Ying Han Pang a Faculty of Information Science and Technology, Multimedia University, Jalan Ayer Keroh Lama, 75450 Melaka, Malaysia Find articles by Ying Han Pang a, ⁎ , Charilaos Zarakovitis Charilaos Zarakovitis b ICT Department, Axon logic IKE, 14122 Athens, Greece Find articles by Charilaos Zarakovitis b , Heng Siong Lim Heng Siong Lim b ICT Department, Axon logic IKE, 14122 Athens, Greece c Faculty of Engineering and Technology, Multimedia University, Jalan Ayer Keroh Lama, 75450 Melaka, Malaysia Find articles by Heng Siong Lim b, c , Dionysis Skordoulis Dionysis Skordoulis b ICT Department, Axon logic IKE, 14122 Athens, Greece Find articles by Dionysis Skordoulis b , Christina D Nikolakakou Christina D Nikolakakou d Department of Digital Systems, University of the Peloponnese, 23100 Sparta, Greece Find articles by Christina D Nikolakakou d , Shih Yin Ooi Shih Yin Ooi a Faculty of Information Science and Technology, Multimedia University, Jalan Ayer Keroh Lama, 75450 Melaka, Malaysia Find articles by Shih Yin Ooi a , Fu San Hiew Fu San Hiew e Infineon Technologies, Free Trade Zone, Batu Berendam, 75350 Melaka, Malaysia Find articles by Fu San Hiew e Author information Article notes Copyright and License information a Faculty of Information Science and Technology, Multimedia University, Jalan Ayer Keroh Lama, 75450 Melaka, Malaysia b ICT Department, Axon logic IKE, 14122 Athens, Greece c Faculty of Engineering and Technology, Multimedia University, Jalan Ayer Keroh Lama, 75450 Melaka, Malaysia d Department of Digital Systems, University of the Peloponnese, 23100 Sparta, Greece e Infineon Technologies, Free Trade Zone, Batu Berendam, 75350 Melaka, Malaysia ⁎ Corresponding author. [email protected] Received 2025 Jul 12; Accepted 2026 Mar 23; Collection date 2026 Jun. © 2026 The Author(s) This is an open access article under the CC BY-NC license (http://creativecommons.org/licenses/by-nc/4.0/). PMC Copyright notice PMCID: PMC13087786 PMID: 42007410 Abstract The rapid proliferation of Internet of Things (IoT) devices in healthcare, manufacturing, and smart cities has introduced significant cybersecurity challenges. These devices present an attractive attack surface for cyber threats, making robust intrusion detection essential. Traditional Intrusion Detection Systems (IDS) analyse IoT network traffic data as independent instances, failing to capture important temporal dependencies, leading to suboptimal detection performance. To address this limitation, we propose TSM-NIDS, an adaptation of the TSMixer architecture for anomaly detection in IoT networks. While TSMixer has demonstrated exceptional performance in domains such as retail forecasting and energy demand prediction, its application to cybersecurity remains largely unexplored. TSM-NIDS employs an All-MLP (Multi-Layer Perceptron) design that performs both time mixing and feature mixing, enabling it to learn sequential patterns and cross-feature dependencies crucial for differentiating between regular and malicious traffic. We evaluate TSM-NIDS using the publicly available TON-IoT dataset, where it surpasses existing state-of-the-art approaches, showing its potential for enhancing IoT network security. Keywords: Internet of Things, Intrusion detection system, Artificial intelligence, Deep learning, Time series analysis Highlights • Leverages a unified model to capture temporal and feature dependencies in IoT network data. • Adapts a proven forecasting architecture to the domain of cybersecurity for anomaly detection. • Demonstrates superior detection performance on a benchmark IoT security dataset. Graphical abstract Open in a new tab Specifications table. Subject area Computer Science More specific subject area IoT Network Security with Artificial Intelligence Name of your method TSM-NIDS: TSMixer for IDS in IoT Networks Name and reference of original method Cao, Z., Zhao, Z., Shang, W., Ai, S., & Shen, S. (2024). Using the ToN-IoT dataset to develop a new intrusion detection system for industrial IoT devices. Multimedia Tools and Applications. https://doi.org/10.1007/s11042–024–19695–7 Resource availability Dataset availability: https://research.unsw.edu.au/projects/toniot-datasets Open in a new tab Background The rapid advancement of technology has led to the widespread adoption of the Internet of Things (IoT), significantly enhancing daily life in both domestic and industrial settings [ 1 ]. According to The 2024 Benchmark Report on IoT Security (2024), the global number of connected IoT devices is expected to surpass 29 billion by 2027, increasing from 16.7 billion devices today [ 2 ]. Nevertheless, the heterogeneity and enormous amount of data across IoT networks pose substantial security challenges. Intrusion Detection Systems (IDS) have emerged as a promising solution to address these security risks [ 3 ]. Although IDSs play a vital role in detecting security threats, they have notable limitations. A traditional IDS typically depends on a database of recognised attack signatures to determine threats and generate alerts; this type is known as a signature-based IDS. When incoming data matches a signature in the database, the system flags it as a security violation [ 4 ]. In contrast, an anomaly-based IDS operates by distinguishing between normal and abnormal network behaviour. This approach can detect novel attacks by building and continuously updating a behavioural profile for the network or user. Any deviation from this normal behaviour is flagged as abnormal, enabling the detection of previously unseen intrusions. However, a key limitation of anomaly-based IDSs is their high false alarm rate [ 5 ]. In recent years, various approaches have been proposed to enhance anomaly-based IDSs, with artificial intelligence (AI) playing a central role in improving detection accuracy. The massive amounts of data produced by IoT devices provide an opportunity to apply machine learning (ML) and deep learning (DL) algorithms. These models analyse network traffic to make meaningful predictions, offering an effective means of protecting IoT devices from intrusion attacks. DL, in particular, has gained significant traction due to its ability to learn complex patterns and automatically extract relevant features for detecting intrusion, malware, and botnets with promising results [ 6 ]. For instance, Jothi & Pushpalatha (2021) proposed a WOA-integrated LSTM network (WILS-NET) achieving high accuracy, while Altunay & Albayrak (2023) demonstrated the effectiveness of hybrid CNN-LSTM models [ 7 , 5 ]. IoT network traffic is inherently time-dependent; however, many IoT attacks manifest as coordinated deviations across multiple traffic features within short windows. Conventional models, such as LSTM and CNN-LSTM, capture temporal continuity through sequential processing but encode feature interactions implicitly within hidden states. This limits their ability to model complex cross-feature interactions. Effective IoT intrusion detection requires models that explicitly capture both temporal and cross-feature correlations. Thus, we propose an AI-driven IDS based on the Time-Series Mixer (TSMixer) architecture, referred to as TSM-NIDS. This model adopts an all-MLP (Multi-layer Perceptron) architecture with separate temporal and feature mixing operations. Channel and temporal attention modules are integrated to emphasise attack-relevant features in heterogeneous IoT traffic. While TSMixer has proven successful in domains such as retail forecasting and energy demand prediction, its application in network intrusion detection, particularly for IoT networks, remains largely unexplored. This study addresses this gap by investigating the feasibility of TSMixer for IoT anomaly detection and benchmarking its performance against existing IDS approaches. Method details In this work, the proposed AI-driven TSM-NIDS were trained and evaluated using the TON-IoT dataset, and the architecture of the proposed TSM-NIDS is as illustrated in Fig. 1 . The proposed TSM-NIDS adopts the architecture of TSMixer, which analyses IoT network time-series data using multiple Mixer Layers. Every Mixer Layer consists of two components: time mixing, where MLPs operate across the temporal dimension to discover time-based patterns; and feature mixing, where MLPs process features to learn their interactions. Both components employ layer normalisation and residual connections to maintain stable training and enable smooth information flow. The outputs from the Mixer Layers are aggregated using global average pooling and then passed through fully connected layers. Finally, a softmax or sigmoid activation function generates class probabilities for intrusion detection. Regularisation is incorporated by applying dropout to each MLP. This structure enables both time and feature relationships in IoT network data to be learned effectively for accurate intrusion detection. The system design flow of the proposed TSM-NIDS is shown in Fig. 2 , which comprises four phases: (1) data acquisition and exploratory data analysis, (2) data preprocessing, (3) model training, and (4) model evaluation. Each phase is described in detail in the following subsections. Fig. 1. Open in a new tab TSMixer architecture for multivariate time series classification. Fig. 2. Open in a new tab Overview of the system design flow of TSM-NIDS. Unlike the original forecasting architecture, TSM-NIDS is structured as a discriminative classifier. Continuous IoT traffic streams are segmented into fixed-length temporal windows, each of which is treated as an independent instance. Rather than predicting future values, the model learns representations that maximize inter-class separability. The separation of temporal and feature mixing enables capturing both burst anomalies within short windows and coordinated multi-feature deviations characteristic of IoT attacks. Data acquisition and exploratory data analysis (EDA) The TON-IoT dataset was developed by a group at the University of New South Wales known as the Networked Sensing and Control Group in Canberra. It is available in both log and CSV formats and includes a label column which will be used in binary classification (where 0 indicates normal behaviour and 1 indicates an attack behaviour) and a column for multi-class classification named as type with various attack types, such as password attacks, scanning, cross-site scripting (XSS), DoS, DDoS, injection, ransomware, backdoor and more. The TON-IoT dataset consists of three types of data: telemetry data, network traffic, and system logs (for both Linux and Windows), all captured from a purpose-built IoT system designed to emulate an industry-level application of IoT Networks in everyday life. The telemetry data were collected from various IoT devices, such as “Fridge”, “Garage_Door”, “GPS_Tracker”, “Modbus”, “Motion_Light”, “Thermostat” and “Weather”, as illustrated in Fig. 3 . The details of the features and data types in the network and IoT dataset are provided in Tables 1 and 2 . Fig. 3. Open in a new tab Simulation testbed used to collect TON-IoT network traffic [ 8 ]. Table 1. Feature description of the TON-IoT dataset. Index Features Data types Index Features Data types 1 ts Time 24 dns_rejected Boolean 2 src_ip String 25 ssl_version String 3 src_port Number 26 ssl_cipher String 4 dst_ip String 27 ssl_resumed Boolean 5 dst_port Number 28 ssl_established Boolean 6 proto String 29 ssl_subject String 7 service String 30 ssl_issuer String 8 duration Number 31 http_trans_depth Number 9 src_bytes Number 32 http_method String 10 dst_bytes Number 33 http_uri String 11 conn_state String 34 http_referrer String 12 missed_bytes Number 35 http_version String 13 src_pkts Number 36 http_request_body_len Number 14 src_ip_bytes Number 37 http_response_body_len Number 15 dst_pkts Number 38 http_status_code Number 16 dst_ip_bytes Number 39 http_user_agent Number 17 dns_query string 40 http_orig_mime_types String 18 dns_qclass Number 41 http_resp_mime_types String 19 dns_qtype Number 42 weird_name String 20 dns_rcode Number 43 weird_addl String 21 dns_AA Boolean 44 weird_notice Boolean 22 dns_RD Boolean 45 label Number 23 dns_RA Boolean 46 type String Open in a new tab Table 2. Feature description of different TON-IoT devices activities. Index Features Data types IoT Fridge activity 1 date Date 2 time Time 3 fridge_temperature Number 4 temp_condition String 5 label Number 6 type String IoT Garage_Door activity 1 date Date 2 time Time 3 door_state Boolean 4 sphone_signal Boolean 5 label Number 6 type String IoT GPS_Tracker activity 1 date Date 2 time Time 3 latitude Number 4 longitude Number 5 label Number 6 type String IoT Modbus activity 1 date Date 2 time Time 3 FC1_Read_Input_Register Number 4 FC2_Read_Discrete_Value Number 5 FC3_Read_Holding_Register Number 6 FC4_Read_Coil Number 7 label Number 8 type String IoT Motion_Light activity 1 date Date 2 time Time 3 motion_status Number 4 light_status Boolean 5 label Number 6 type String IoT Thermostat activity 1 date Date 2 time Time 3 current_temperature Number 4 thermostat_status Boolean 5 label Number 6 type String IoT Weather activity 1 date Date 2 time Time 3 temperature Number 4 pressure Number 5 humidity Number 6 label Number 7 type String Open in a new tab Data preprocessing The IoT and network datasets are merged based on the nearest “timestamp”, and all null values are removed. Temporal features such as hour, minute and second are extracted from the “timestamp” field and cyclically encoded using sine and cosine transformations to preserve their periodic nature for improved temporal analysis. Additionally, categorical features are encoded by using a label encoder. For example, the “type” feature (indicating attack categories) and the “conn_state” feature (indicating connection states) are transformed accordingly. EDA revealed that the dataset contains a large number of features, which may negatively affect model performance. To mitigate this, two dimensionality reduction techniques are employed in this study: • Mutual Information (MI) Scores: Calculates each feature's information gain and ranks features based on importance. • Correlation-based Feature Selection (CFS): Identifies highly correlated features, which are then eliminated to reduce redundancy. Data scaling is important to ensure efficient model training. Standard scaling is adopted in this study because it effectively reduces the impact of outliers without completely removing them. It transforms the data in such a way that the mean becomes 0 and the standard deviation becomes 1, as formulated below: X s c a l e d = X − μ σ (1) where X represents the initial value, μ represents the feature mean, and σ represents the standard deviation. Model training In this study, the preprocessed dataset is split into three datasets, which are 70% for the training dataset, 15% for the validation dataset, and 15% for the testing dataset. To capture temporal dependencies in the multivariate time-series data, the dataset is segmented into fixed-length sequences. The proposed TSM-NIDS model is based on the TSMixer architecture, which processes multivariate time-series data through a series of temporal and feature mixing phases. The architecture includes several tunable hyperparameters, such as hidden dimensions, the number of mixer blocks, attention mechanisms (channel and temporal), dropout rates, and more, as illustrated in Algorithm I ( Fig. 4 ). Input data passes through multiple MixerBlocks that perform temporal and feature mixing. Each block comprises residual connections, layer normalisation, and attention modules to enhance the learning of feature relevance and temporal dependencies. Fig. 4. Open in a new tab Pseudocode of the TSMixer algorithm. In this work, hyperparameter tuning is performed using the Tree-structured Parzen Estimator (TPE) with a total of 15 trials. The hyperparameter configurations are detailed in Table 3 . The model is trained using the Focal Loss function to mitigate the impact of class imbalance inherent in the intrusion detection task. The Adam Optimizer with weight decay regularisation is employed, and a ReduceLROnPlateau scheduler, which depends on the validation loss, adjusts the learning rate. Training is performed for up to 20 epochs, with early stopping applied if the validation accuracy does not improve for 7 consecutive epochs. Table 3. Hyperparameter searching space and optimised values for TSM-NIDS. Hyperparameter Searching Space Optimised Value batch_size 32 – 96 with a step of 16 96 hidden_dim 256 – 640 with a step of 32 320 num_blocks 15 – 30 with a step of 1 17 dropout_rate 0.05 – 0.5 with a step of 0.01 0.13 learning_rate 0.0001 – 0.1 with log is True 0.0008179499475211679 weight_decay 0.0000001 – 0.001 with log is True 1.2561043700013547e-05 focal_alpha 0.25 – 3.5 with a step of 0.25 1.75 focal_gamma 0.25 – 3.5 with a step of 0.25 1.25 use_channel_attention True or False True use_temporal_attention True or False False If use_channel_attention or use_temporal_attention attention_reduction 8 – 72 with a step of 8 40 Open in a new tab Model evaluation To assess the performance of TSM-NIDS, several evaluation metrics are used: accuracy, precision, recall, and F1-Score. These metrics capture critical aspects of detecting malicious or abnormal behaviour in IoT network traffic. Accuracy measures the overall correctness of the anomaly detection model across all network traffic instances, including both normal and anomalous data. Precision reflects the proportion of detected anomalies that are truly malicious or abnormal. Recall measures the model’s ability to find all actual anomalies in the IoT network. The F1-Score measures the balance between precision and recall, providing a single metric that captures the trade-off between missing anomalies (false negatives) and raising false alarms (false positives). The performance metrics are defined as follows: A c c u r a c y = N u m b e r o f c o r r e c t p r e d i c t i o n s T o t a l n u m b e r o f p r e d i c t i o n s (2) P r e c i s i o n = T P T P + F P (3) R e c a l l = T P T P + F N (4) F 1 − S c o r e = 2 × P r e c i s i o n × R e c a l l P r e c i s i o n + R e c a l l (5) where TP denotes true positives, FP denotes false positives, and FN denotes false negatives. Method validation A training-validation evaluation strategy is adopted to evaluate the performance and robustness of the proposed TSM-NIDS models. Firstly, we investigate the impact of hyperparameter optimisation on the performance of the proposed model. As shown in Table 4 , the TPE optimisation yields no significant improvement in model performance. However, it has a slight influence on training time, as detailed in Table 5 . The results indicate that the performance metrics – accuracy, precision, recall and F1-score - generally decrease slightly after optimisation. Some models show minor performance deterioration; for instance, TSM-NIDS (without optimisation) achieves slightly higher accuracy for binary classification compared to its optimised counterpart. In terms of computational efficiency, Table 5 reveals mixed effects: for example, TSM-NIDS (without optimisation) in the binary classification task and TSM-NIDS (MI scores) in the multi-class classification task exhibit reduced training durations. Conversely, other configurations show either comparable or slightly increased training times. Overall, TSM-NIDS maintains consistently high performance across parameter configurations, suggesting stable optimisation behaviour and low sensitivity to hyperparameter variation. In other words, the proposed TSM-NIDS offers high-performing intrusion detection without requiring extensive hyperparameter tuning. This robustness is advantageous for practical deployment in IoT environments. Table 4. TSMixer performance before and after TPE hyperparameter optimisation. Models Accuracy Precision Recall F1-Score Before TPE hyperparameter optimisation Binary classification TSM-NIDS (without optimisation) 99.75% 99.75% 99.75% 99.75% TSM-NIDS (MI Scores) 99.76% 99.76% 99.76% 99.76% TSM-NIDS (CFS) 99.72% 99.72% 99.72% 99.72% Multi-class classification TSM-NIDS (without optimisation) 99.78% 99.78% 99.78% 99.78% TSM-NIDS (MI Scores) 99.86% 99.86% 99.86% 99.86% TSM-NIDS (CFS) 99.81% 99.81% 99.81% 99.81% After TPE hyperparameter optimisation Binary classification TSM-NIDS (without optimisation) 99.55% 99.55% 99.55% 99.55% TSM-NIDS (MI Scores) 99.70% 99.70% 99.70% 99.70% TSM-NIDS (CFS) 99.57% 99.58% 99.57% 99.57% Multi-class classification TSM-NIDS (without optimisation) 99.61% 99.61% 99.61% 99.61% TSM-NIDS (MI Scores) 99.65% 99.65% 99.65% 99.65% TSM-NIDS (CFS) 99.67% 99.67% 99.67% 99.67% Open in a new tab Table 5. TSMixer training time before and after hyperparameter optimisation. Models Classification Train time without TPE Train time with TPE TSMixer Binary 2448.98 s 2132.51 s Multi-Class 1759.65 s 2060.21 s TSMixer + MI Scores Binary 2147.79 s 2086.83 s Multi-Class 2682.14 s 1856.21 s TSMixer + CFS Binary 2161.08 s 2061.02 s Multi-Class 2527.98 s 2067.23 s Open in a new tab Robustness analysis To evaluate the robustness of the proposed TSM-NIDS, a noise injection experiment is conducted, where incremental random noise (5%, 10%, 15%) is added to the data input. F1-score is reported as the primary metric due to the class imbalance. The performance of both the base and the optimised models is evaluated under each noise level, as presented in Table 6 . The results demonstrate that the proposed model maintains consistently high performance, with only marginal degradation as noise increases. Specifically, the base model achieves an F1-score of 99.86% without noise, which slightly decreased to 99.72% at 15% noise. Similarly, the optimised model maintained stable performance, with F1-scores ranging around 99.65% to 99.70% across all noise levels. These results indicate that the proposed TSM-NIDS is robust to feature-level perturbations and capable of learning stable and discriminative representations across multiple intrusion classes. Table 6. Robustness evaluation under noise injection (multi-class classification). Noise Level Base Model F1-Score Optimised Model F1-Score 0% 99.86% 99.65% 5% 99.85% 99.70% 10% 99.70% 99.65% 15% 99.72% 99.66% Open in a new tab Performance comparison Several recent studies have reported strong results on the TON-IoT dataset. Table 7 presents a performance comparison between several recent approaches and the proposed method. From the table, it can be observed that the DNN model proposed by Cao et al. [ 8 ] achieves an F1-score of about 92.30% for binary classification without any dimensionality reduction, and an F1-score of approximately 98.74% for multi-class classification when employing SMOTE and Topek Link Removal techniques. Ensemble methods by Alotaibi & Ilyas [ 9 ] reached an F1-score of about 98.61% for binary classification, while the ACBLSTM model of Fang et al. [ 10 ] reported a high F1-score of 99.40% for binary classification. In contrast, traditional models such as LightGBM [ 11 ] yield lower F1-scores for multi-class classification, around 78%, whereas BiLSTM methods [ 12 ] achieve around 95.81% for binary classification. Table 7. Comparison of the proposed TSM-NIDS with other models. Model Task Type Accuracy Precision Recall F1-Score DNN * [ 8 ] Binary 92.19% 93.55% 92.19% 92.30% DNN + SMOTE + Topek Link Removal * [ 8 ] Multi-Class 98.71% 98.84% 98.71% 98.74% Stacking Algorithm * [ 9 ] Binary 98.64% 98.60% 98.66% 98.61% ACBLSTM * [ 10 ] Binary 99.82% 99.80% 99.00% 99.40% LightGBM * [ 11 ] Multi-Class 78.00% 82.00% 78.00% 78.00% BiLSTM * [ 12 ] Binary 96.84% 99.61% 95.75% 95.81% TSM-NIDS (Proposed) Binary 99.76% 99.76% 99.76% 99.76% TSM-NIDS (Proposed) Multi-Class 99.86% 99.86% 99.86% 99.86% Open in a new tab ⁎ The results are extracted from the original papers. The proposed TSM-NIDS demonstrate competitive performance, achieving an F1-Score of 99.76% for binary classification and 99.86% for multi-class classification. These results demonstrate that TSM-NIDS maintains a balanced and reliable detection capability across both tasks. While some methods report slightly higher F1-Scores in specific scenarios, TSM-NIDS offers consistently strong performance, making it a robust solution for IoT anomaly detection. Limitations None. Supplementary material and/or additional information [OPTIONAL] Nil. Ethics statements Not applicable. CRediT author statement Muhammad Iffat bin Hanafiah : Methodology, Writing- Original draft preparation; Ying Han Pang : Reviewing, Editing and Supervision; Charilaos Zarakovitis, Heng Siong Lim, Dionysis Skordoulis, Christina D. Nikolakakou, Shih Yin Ooi : Reviewing and Supervision; Fu San Hiew : Supervision. Declaration of competing interest The authors declare that they have no known competing financial interests or personal relationships that could have appeared to influence the work reported in this paper. Acknowledgments This research is supported by the project “Integrated Software Toolbox for Secure IoT-to-Cloud Computing (INTACT)”, funded by the European Commission Horizon Europe Programme under contract number 101168438 and the MMU Postdoctoral Research Fellow Grant (MMUI/240020). Footnotes ☆ Related research article: None. For a published article : None. Data availability The authors do not have permission to share data. References 1. Al-Garadi M.A., Mohamed A., Al-Ali A.K., Du X., Ali I., Guizani M. A survey of machine and deep learning methods for Internet of Things (IoT) security. IEEE Commun. Surv. Tutor. 2020;22(3):1646–1685. doi: 10.1109/COMST.2020.2988293. [ DOI ] [ Google Scholar ] 2. The 2024 benchmark report on IoT security - how top-performing organizations use advanced Internet of Things (IoT) security to safeguard their network-connected devices. Palo Alto Networks; 2024. [ Google Scholar ] 3. Mishra N., Pandya S. Internet of Things applications, security challenges, attacks, intrusion detection, and future visions: a systematic review. IEEE Access. 2021;9:59353–59377,. doi: 10.1109/ACCESS.2021.3073408. Institute of Electrical and Electronics Engineers Inc. [ DOI ] [ Google Scholar ] 4. Saba T., Rehman A., Sadad T., Kolivand H., Bahaj S.A. Anomaly-based intrusion detection system for IoT networks through deep learning model. Comput. Electr. Eng. 2022;99:107810. doi: 10.1016/j.compeleceng.2022.107810. [ DOI ] [ Google Scholar ] 5. Altunay H.C., Albayrak Z. A hybrid CNN + LSTMbased intrusion detection system for industrial IoT networks. Eng. Sci. Technol. Int. J. 2023;38:101322. doi: 10.1016/j.jestch.2022.101322. [ DOI ] [ Google Scholar ] 6. Chaganti R., Suliman W., Ravi V., Dua A. Deep learning approach for SDN-enabled intrusion detection system in IoT networks. Information (Switzerland) 2023;14(1):41. doi: 10.3390/info14010041. [ DOI ] [ Google Scholar ] 7. Jothi B., Pushpalatha M. A novel optimized deep learning based intrusion detection framework for IoT networks. Pers. Ubiquitous Comput. 2021;27(3):1285–1301. doi: 10.1007/s00779-021-01578-5. (2023) Published. [ DOI ] [ Google Scholar ] 8. Cao Z., Zhao Z., Shang W., Ai S., Shen S. Using the ToN-IoT dataset to develop a new intrusion detection system for industrial IoT devices. Multimed. Tools Appl. 2025;84(16):16425–16453. doi: 10.1007/s11042-024-19695-7. [ DOI ] [ Google Scholar ] 9. Alotaibi Y., Ilyas M. Ensemble-learning framework for intrusion detection to enhance Internet of Things’ Devices security. Sensors. 2023;23(12):5568. doi: 10.3390/s23125568. [ DOI ] [ PMC free article ] [ PubMed ] [ Google Scholar ] 10. Fang Y., Jia Y., Bai G., Hong R., Linglin X., Mohi-ud-din G., Ai C., Asim M., Li Z. Deciphering TON-IoT threats: meta-heuristic and deep learning for attack classification. Expert Syst. Appl. 2025;282:127414. doi: 10.1016/j.eswa.2025.127414. [ DOI ] [ Google Scholar ] 11. Soni, Remli M.A., Daud K.M., Al Amien J. Performance evaluation of multiclass classification models for ToN-IoT network device datasets. Indones. J. Electr. Eng. Comput. Sci. 2024;35(1):485–493. doi: 10.11591/ijeecs.v35.i1.pp485-493. [ DOI ] [ Google Scholar ] 12. Jagdish Kumar P., Neduncheliyan S., Adnan M.M., Sudhakar K., Sudhakar A.V.V. Proc. 3rd IEEE Int. Conf. Distrib. Comput. Electr. Circuits Electron. ICDCECE 2024. 2024. Anomaly-based intrusion detection system using bidirectional long short-term memory for internet of things; pp. 1–4. [ DOI ] [ Google Scholar ] Associated Data This section collects any data citations, data availability statements, or supplementary materials included in this article. Data Availability Statement The authors do not have permission to share data. Articles from MethodsX are provided here courtesy of Elsevier ACTIONS View on publisher site PDF (2.7 MB) Cite Collections Permalink PERMALINK Copy RESOURCES Similar articles Cited by other articles Links to NCBI Databases Cite Copy Download .nbib .nbib Format: AMA APA MLA NLM Add to Collections Create a new collection Add to an existing collection Name your collection * Choose a collection Unable to load your collection due to an error Please try again Add Cancel Follow NCBI NCBI on X (formerly known as Twitter) NCBI on Facebook NCBI on LinkedIn NCBI on GitHub NCBI RSS feed Connect with NLM NLM on X (formerly known as Twitter) NLM on Facebook NLM on YouTube National Library of Medicine 8600 Rockville Pike Bethesda, MD 20894 Web Policies FOIA HHS Vulnerability Disclosure Help Accessibility Careers NLM NIH HHS USA.gov Back to Top