Toward Accurate IoT Intrusion Detection Using Optimized Active Sample Selection Strategies

Intrusion detection systems play major role in security of Internet of Things (IoT) networks against various types of cyber threats. However, traditional Machine Learning (ML) and Deep Learning (DL) models still struggle with challenges such as critical class imbalance, reliance on manual tuning of hyperparameters, and the expensive cost of obtaining labeled data. In this study, we addressed these limitations using the TON_IoT dataset. To address data imbalance, the proximity weighted random affine shadow sampling technique is utilized. Further, Bayesian optimization is applied on LeNet, resulting in LeBayesNet, which provides the optimal configuration for high-accuracy threat detection. Additionally, EntroLeNet integrates entropy-based uncertainty into the learning process for improved robustness. Next, MargiLeNet leverages marginal-based active learning, annotating the most uncertain samples. Experimental results obtained show that LeBayesNet, MargiLeNet, and EntroLeNet improve performance over existing ML and DL models by 6.90%, 5.80%, and 4.27% in accuracy and 6.19%, 6.43%, 8.05%, and 7.52% in receiver operating characteristic-area under the curve, respectively. The LeBayesNet, MargiLeNet, and EntroLeNet models significantly reduce Hamming loss by 72.84%, 60.49%, and 43.21%, respectively. For robustness and generalizability assurance, 10-fold cross-validation is used during evaluation and validated the statistical significance of performance improvements using the Mann–Whitney U test. Furthermore, the models’ explainability and interpretability is enhanced through Shapley additive explanations and local interpretable model-agnostic explanations, providing insights into feature importance and decision transparency.