Lightweight Flow-based Anomaly Detection for IoT Using HC-MTDNN: A Hierarchically Cascaded Multitask Deep Neural Network
DOI:
https://doi.org/10.26636/jtit.2025.4.2311Keywords:
anomaly detection, deep neural network, IoT security, lightweight model, multitask learning, network traffic analysisAbstract
In this article, we propose a lightweight, hierarchical multi-task learning framework designed for detecting both high-level and fine-grained threats in IoT traffic. The developed model focuses on anomalies detectable through flow-level metadata. The deliberate choice to prioritize computational efficiency by excluding content analysis scopes the approach to payload-independent threats, while still enabling robust detection of key attack classes. To further enhance efficiency within this metadata-driven paradigm, we introduce HC-MTDNN, a hierarchical multitask model that integrates a gated feature mechanism and feature reuse to significantly reduce redundancy and computational overhead, improving upon previous hierarchical architectures and achieving high performance while dealing with volumetric and protocol-based attacks. The model is evaluated on four benchmark datasets: CICIoT2023, N-BaIoT, Bot-IoT, and Edge-IIoTset. It demonstrates strong performance in both binary and multiclass classification tasks, with an average inference time of 122 us per sample and a compact model size of 2.4 MB. The proposed framework effectively balances accuracy and computational efficiency, offering a practical and scalable solution for securing resource-constrained IoT environments.
Downloads
References
[1] R. Chataut, A. Phoummalayvane, and R. Akl, "Unleashing the Power of IoT: A Comprehensive Review of IoT Applications and Future Prospects in Healthcare, Agriculture, Smart Homes, Smart Cities, and Industry 4.0", Sensors, vol. 23, art. no. 7194, 2023.
View in Google Scholar
DOI: https://doi.org/10.3390/s23167194
[2] F. Nie, W. Liu, G. Liu, and B. Gao, "M2VT-IDS: A Multi-task Multi-view Learning Architecture for Designing IoT Intrusion Detection System", Internet of Things, vol. 25, art. no. 101102, 2024.
View in Google Scholar
DOI: https://doi.org/10.1016/j.iot.2024.101102
[3] P.S. Bangare and K.P. Patil, "Security Issues and Challenges in Internet of Things (IoT) System", 2022 2nd International Conference on Advance Computing and Innovative Technologies in Engineering (ICACITE), Greater Noida, India, 2022.
View in Google Scholar
DOI: https://doi.org/10.1109/ICACITE53722.2022.9823709
[4] A.A. Rokhade et al., "Anomaly Detection for IoT Security: Comprehensive Survey", 2023 International Conference on Advances in Electronics, Communication, Computing and Intelligent Information Systems (ICAECIS), Bangalore, India, 2023.
View in Google Scholar
DOI: https://doi.org/10.1109/ICAECIS58353.2023.10170192
[5] M. Antonakakis et al., "Understanding the Mirai Botnet", 26th USENIX Conference on Security Symposium (SEC’17), Vancouver, Canada, 2017.
View in Google Scholar
[6] H. Rhachi, Y. Balboul, and A. Bouayad, "Enhanced Anomaly Detection in IoT Networks Using Deep Autoencoders with Feature Selection Techniques", Sensors, vol. 25, art. no. 3150, 2025.
View in Google Scholar
DOI: https://doi.org/10.3390/s25103150
[7] A.G. Kumar, A. Rastogi, and V. Ranga, "Evaluation of Different Machine Learning Classifiers on New IoT Dataset CICIoT2023", 2024 International Conference on Intelligent Systems for Cybersecurity (ISCS), Gurugram, India, 2024.
View in Google Scholar
DOI: https://doi.org/10.1109/ISCS61804.2024.10581375
[8] K.R. Narayan et al., "IIDS: Design of Intelligent Intrusion Detection System for Internet-of-Things Applications", 2023 IEEE 7th Conference on Information and Communication Technology (CICT), Jabalpur, India, 2023. -0.3pt
View in Google Scholar
DOI: https://doi.org/10.1109/CICT59886.2023.10455720
[9] R. Caruana, "Multitask Learning", Machine Learning, vol. 28, pp. 41-75, 1997.
View in Google Scholar
DOI: https://doi.org/10.1023/A:1007379606734
[10] E.C.P. Neto et al., "CICIOT2023: A Real-time Dataset and Benchmark for Large-scale Attacks in IoT Environment", Sensors, vol. 23, art. no. 5941, 2023.
View in Google Scholar
DOI: https://doi.org/10.3390/s23135941
[11] B. Meidan et al., "N-BaIoT Dataset to Detect IoT Botnet Attacks", IEEE Pervasive Computing, vol. 17, pp. 12-22, 2018.
View in Google Scholar
DOI: https://doi.org/10.1109/MPRV.2018.03367731
[12] N. Koroniotis et al., "Towards the Development of Realistic Botnet Dataset in the Internet of Things for Network Forensic Analytics: Bot-IoT Dataset", Future Generation Computer Systems, vol. 100, pp. 779-796, 2018.
View in Google Scholar
DOI: https://doi.org/10.1016/j.future.2019.05.041
[13] M.A. Ferrag et al., "Edge-IIoTSET: A New Comprehensive Realistic Cyber Security Dataset of IoT and IIoT Applications for Centralized and Federated Learning", IEEE Access, vol. 10, pp. 40281-40306, 2022.
View in Google Scholar
DOI: https://doi.org/10.1109/ACCESS.2022.3165809
[14] Imran et al., "Realtime Feature Engineering for Anomaly Detection in IoT Based MQTT Networks", IEEE Access, vol. 12, pp. 25700-25718, 2024.
View in Google Scholar
DOI: https://doi.org/10.1109/ACCESS.2024.3363889
[15] Z. Hafezian, M. Naderan, and M. Jaderyan, "A Machine Learning-based Approach for Multi-class Intrusion Detection and Classification in IoT Using CICIoT2023 Dataset", 2024 11th International Symposium on Telecommunications (IST), Tehran, Iran, 2024.
View in Google Scholar
DOI: https://doi.org/10.1109/IST64061.2024.10843502
[16] A. Hajjouz and E. Avksentieva, "Optimizing Intrusion Detection for DoS, DDoS, and Mirai Attacks Subtypes Using Hierarchical Feature Selection and CatBoost on the CICIoT2023 Dataset", Data and Metadata, vol. 3, art. no. 577, 2024.
View in Google Scholar
DOI: https://doi.org/10.56294/dm2024577
[17] N. Thereza and K. Ramli, "Development of Intrusion Detection Models for IoT Networks Utilizing CICIoT2023 Dataset", 2023 3rd International Conference on Smart Cities, Automation & Intelligent Computing Systems (ICON-SONICS), Bali, Indonesia, 2023.
View in Google Scholar
DOI: https://doi.org/10.1109/ICON-SONICS59898.2023.10435006
[18] C. Eunaicy, c. Jayapratha, and H.S. Hemachitra, "IoT Guardian: A Novel Feature Discovery and Cooperative Game Theory Empowered Feature Selection with ML Model for IoT Threats and Attack Detection", International Journal of Computer Networks and Communications, vol. 16, pp. 25-42, 2024.
View in Google Scholar
DOI: https://doi.org/10.5121/ijcnc.2024.16202
[19] J.R.K. Rajasekaran, B. Natarajan, and A. Pahwa, "Modified Matrix Completion-based Detection of Stealthy Data Manipulation Attacks in Low Observable Distribution Systems", IEEE Transactions on Smart Grid, vol. 14, pp. 4851-4862, 2023.
View in Google Scholar
DOI: https://doi.org/10.1109/TSG.2023.3266834
[20] H. Dong and I. Kotenko, "An Autoencoder-based Multi-task Learning for Intrusion Detection in IoT Networks", 2023 IEEE Ural-Siberian Conference on Biomedical Engineering, Radioelectronics and Information Technology (USBEREIT), Yekaterinburg, Russia, 2023.
View in Google Scholar
DOI: https://doi.org/10.1109/USBEREIT58508.2023.10158807
[21] Z. Wang et al., "A Lightweight Intrusion Detection Method for IoT Based on Deep Learning and Dynamic Quantization", PeerJ Computer Science, vol. 9, art. no. 1569, 2023.
View in Google Scholar
DOI: https://doi.org/10.7717/peerj-cs.1569
[22] J. Chen, J. Xiao, and J. Xu, "VGGIncepNet: Enhancing Network Intrusion Detection and Network Security Through Non-image-to-image Conversion and Deep Learning", Electronics, vol. 13, art. no. 3639, 2024.
View in Google Scholar
DOI: https://doi.org/10.3390/electronics13183639
[23] A. Hinojosa and N.E. Majd, "Edge Computing Network Intrusion Detection System in IoT Using Deep Learning", 2024 33rd International Conference on Computer Communications and Networks (ICCCN), Kailua-Kona, USA, 2024.
View in Google Scholar
DOI: https://doi.org/10.1109/ICCCN61486.2024.10637611
[24] T. Hasan and S. Tasnim, "Multidimensional Feature Learning Enhancement in IoT Intrusion Detection: An Adaptive Cost-sensitive Autoencoder and Weighted Ensemble Approach", 2024 IEEE 10th World Forum on Internet of Things (WF-IoT), Ottawa, Canada, 2024. -0.1pt
View in Google Scholar
DOI: https://doi.org/10.1109/WF-IoT62078.2024.10811174
[25] S. Yan, H. Han, X. Dong, and Z. Xu, "Lightweight Deep Learning Method Based on Group Convolution: Detecting DDoS Attacks in IoT Environments", 2024 10th International Symposium on System Security, Safety, and Reliability (ISSSR), Xiamen, China, 2024.
View in Google Scholar
DOI: https://doi.org/10.1109/ISSSR61934.2024.00027
[26] M.A. Elaziz, I.A. Fares, and A.O. Aseeri, "CKAN: Convolutional Kolmogorov-Arnold Networks Model for Intrusion Detection in IoT Environment", IEEE Access, vol. 12, pp. 134837-134851, 2024.
View in Google Scholar
DOI: https://doi.org/10.1109/ACCESS.2024.3462297
[27] H. Kamal and M. Mashaly, "Enhanced Hybrid Deep Learning Models-based Anomaly Detection Method for Two-stage Binary and Multi-class Classification of Attacks in Intrusion Detection Systems", Algorithms, vol. 18, 2025.
View in Google Scholar
DOI: https://doi.org/10.3390/a18020069
[28] Z. Ahmad et al., "Anomaly Detection Using Deep Neural Network for IoT Architecture", Applied Sciences, vol. 11, art. no. 7050, 2021.
View in Google Scholar
DOI: https://doi.org/10.3390/app11157050
[29] A.N. Gummadi, J.C. Napier, and M. Abdallah, "XAI-IoT: An Explainable AI Framework for Enhancing Anomaly Detection in IoT Systems", IEEE Access, vol. 12, pp. 71024-71054, 2024.
View in Google Scholar
DOI: https://doi.org/10.1109/ACCESS.2024.3402446
[30] E. Altulaihan, M.A. Almaiah, and A. Aljughaiman, "Anomaly Detection IDS for Detecting DoS Attacks in IoT Networks Based on Machine Learning Algorithms", Sensors, vol. 24, art. no. 713, 2024.
View in Google Scholar
DOI: https://doi.org/10.3390/s24020713
[31] Z. Zulfiqar et al., "DeepDetect: An Innovative Hybrid Deep Learning Framework for Anomaly Detection in IoT Networks", Journal of Computational Science, vol. 83, art. no. 102426, 2024.
View in Google Scholar
DOI: https://doi.org/10.1016/j.jocs.2024.102426
[32] A. Alrefaei and M. Ilyas, "Using Machine Learning Multiclass Classification Technique to Detect IoT Attacks in Real Time", Sensors, vol. 24, art. no. 4516, 2024.
View in Google Scholar
DOI: https://doi.org/10.3390/s24144516
[33] Z. Alwaisi, T. Kumar, E. Harjula, and S. Soderi, "Securing Constrained IoT Systems: A Lightweight Machine Learning Approach for Anomaly Detection and Prevention", Internet of Things, vol. 28, art. no. 101398, 2024.
View in Google Scholar
DOI: https://doi.org/10.1016/j.iot.2024.101398
[34] I. Ullah and Q.H. Mahmoud, "Design and Development of RNN Anomaly Detection Model for IoT Networks", IEEE Access, vol. 10, pp. 62722-62750, 2022.
View in Google Scholar
DOI: https://doi.org/10.1109/ACCESS.2022.3176317
[35] M.M. Khan and M. Alkhathami, "Anomaly Detection in IoT-based Healthcare: Machine Learning for Enhanced Security", Scientific Reports, vol. 14, art. no. 5872, 2024.
View in Google Scholar
DOI: https://doi.org/10.1038/s41598-024-56126-x
[36] S.-M. Tseng, Y.-Q. Wang, and Y.-C. Wang, "Multi-class Intrusion Detection Based on Transformer for IoT Networks Using CIC-IoT-2023 Dataset", Future Internet, vol. 16, art. no. 284, 2024.
View in Google Scholar
DOI: https://doi.org/10.3390/fi16080284
[37] R. Zhao et al., "A Novel Intrusion Detection Method Based on Lightweight Neural Network for Internet of Things", IEEE Internet of Things Journal, vol. 9, pp. 9960-9972, 2022.
View in Google Scholar
DOI: https://doi.org/10.1109/JIOT.2021.3119055
[38] M. Verkerken et al., "A Novel Multi-stage Approach for Hierarchical Intrusion Detection", IEEE Transactions on Network and Service Management, vol. 20, pp. 3915-3929, 2023.
View in Google Scholar
DOI: https://doi.org/10.1109/TNSM.2023.3259474
[39] A. Momand, S.U. Jan, and N. Ramzan, "ABCNN-IDS: Attention-based Convolutional Neural Network for Intrusion Detection in IoT Networks", Wireless Personal Communications, vol. 136, pp. 1981-2003, 2024.
View in Google Scholar
DOI: https://doi.org/10.1007/s11277-024-11260-7
[40] S. Ali et al., "Effective Multitask Deep Learning for IoT Malware Detection and Identification Using Behavioral Traffic Analysis", IEEE Transactions on Network and Service Management, pp. 1199-1209, 2022.
View in Google Scholar
DOI: https://doi.org/10.1109/TNSM.2022.3200741
Downloads
Published
Issue
Section
License
Copyright (c) 2025 Mohamed Amine Beghoura, Younes Belouche
This work is licensed under a Creative Commons Attribution 4.0 International License.
