Lightweight Flow-based Anomaly Detection for IoT Using HC-MTDNN: A Hierarchically Cascaded Multitask Deep Neural Network
DOI:
https://doi.org/10.26636/jtit.2025.4.2311Keywords:
anomaly detection, deep neural network, IoT security, lightweight model, multitask learning, network traffic analysisAbstract
In this article, we propose a lightweight, hierarchical multi-task learning framework designed for detecting both high-level and fine-grained threats in IoT traffic. The developed model focuses on anomalies detectable through flow-level metadata. The deliberate choice to prioritize computational efficiency by excluding content analysis scopes the approach to payload-independent threats, while still enabling robust detection of key attack classes. To further enhance efficiency within this metadata-driven paradigm, we introduce HC-MTDNN, a hierarchical multitask model that integrates a gated feature mechanism and feature reuse to significantly reduce redundancy and computational overhead, improving upon previous hierarchical architectures and achieving high performance while dealing with volumetric and protocol-based attacks. The model is evaluated on four benchmark datasets: CICIoT2023, N-BaIoT, Bot-IoT, and Edge-IIoTset. It demonstrates strong performance in both binary and multiclass classification tasks, with an average inference time of 122 us per sample and a compact model size of 2.4 MB. The proposed framework effectively balances accuracy and computational efficiency, offering a practical and scalable solution for securing resource-constrained IoT environments.
Downloads
References
[1] R. Chataut, A. Phoummalayvane, and R. Akl, "Unleashing the Power of IoT: A Comprehensive Review of IoT Applications and Future Prospects in Healthcare, Agriculture, Smart Homes, Smart Cities, and Industry 4.0", Sensors, vol. 23, art. no. 7194, 2023. DOI: https://doi.org/10.3390/s23167194
View in Google Scholar
[2] F. Nie, W. Liu, G. Liu, and B. Gao, "M2VT-IDS: A Multi-task Multi-view Learning Architecture for Designing IoT Intrusion Detection System", Internet of Things, vol. 25, art. no. 101102, 2024. DOI: https://doi.org/10.1016/j.iot.2024.101102
View in Google Scholar
[3] P.S. Bangare and K.P. Patil, "Security Issues and Challenges in Internet of Things (IoT) System", 2022 2nd International Conference on Advance Computing and Innovative Technologies in Engineering (ICACITE), Greater Noida, India, 2022. DOI: https://doi.org/10.1109/ICACITE53722.2022.9823709
View in Google Scholar
[4] A.A. Rokhade et al., "Anomaly Detection for IoT Security: Comprehensive Survey", 2023 International Conference on Advances in Electronics, Communication, Computing and Intelligent Information Systems (ICAECIS), Bangalore, India, 2023. DOI: https://doi.org/10.1109/ICAECIS58353.2023.10170192
View in Google Scholar
[5] M. Antonakakis et al., "Understanding the Mirai Botnet", 26th USENIX Conference on Security Symposium (SEC’17), Vancouver, Canada, 2017.
View in Google Scholar
[6] H. Rhachi, Y. Balboul, and A. Bouayad, "Enhanced Anomaly Detection in IoT Networks Using Deep Autoencoders with Feature Selection Techniques", Sensors, vol. 25, art. no. 3150, 2025. DOI: https://doi.org/10.3390/s25103150
View in Google Scholar
[7] A.G. Kumar, A. Rastogi, and V. Ranga, "Evaluation of Different Machine Learning Classifiers on New IoT Dataset CICIoT2023", 2024 International Conference on Intelligent Systems for Cybersecurity (ISCS), Gurugram, India, 2024. DOI: https://doi.org/10.1109/ISCS61804.2024.10581375
View in Google Scholar
[8] K.R. Narayan et al., "IIDS: Design of Intelligent Intrusion Detection System for Internet-of-Things Applications", 2023 IEEE 7th Conference on Information and Communication Technology (CICT), Jabalpur, India, 2023. -0.3pt DOI: https://doi.org/10.1109/CICT59886.2023.10455720
View in Google Scholar
[9] R. Caruana, "Multitask Learning", Machine Learning, vol. 28, pp. 41-75, 1997. DOI: https://doi.org/10.1023/A:1007379606734
View in Google Scholar
[10] E.C.P. Neto et al., "CICIOT2023: A Real-time Dataset and Benchmark for Large-scale Attacks in IoT Environment", Sensors, vol. 23, art. no. 5941, 2023. DOI: https://doi.org/10.3390/s23135941
View in Google Scholar
[11] B. Meidan et al., "N-BaIoT Dataset to Detect IoT Botnet Attacks", IEEE Pervasive Computing, vol. 17, pp. 12-22, 2018. DOI: https://doi.org/10.1109/MPRV.2018.03367731
View in Google Scholar
[12] N. Koroniotis et al., "Towards the Development of Realistic Botnet Dataset in the Internet of Things for Network Forensic Analytics: Bot-IoT Dataset", Future Generation Computer Systems, vol. 100, pp. 779-796, 2018. DOI: https://doi.org/10.1016/j.future.2019.05.041
View in Google Scholar
[13] M.A. Ferrag et al., "Edge-IIoTSET: A New Comprehensive Realistic Cyber Security Dataset of IoT and IIoT Applications for Centralized and Federated Learning", IEEE Access, vol. 10, pp. 40281-40306, 2022. DOI: https://doi.org/10.1109/ACCESS.2022.3165809
View in Google Scholar
[14] Imran et al., "Realtime Feature Engineering for Anomaly Detection in IoT Based MQTT Networks", IEEE Access, vol. 12, pp. 25700-25718, 2024. DOI: https://doi.org/10.1109/ACCESS.2024.3363889
View in Google Scholar
[15] Z. Hafezian, M. Naderan, and M. Jaderyan, "A Machine Learning-based Approach for Multi-class Intrusion Detection and Classification in IoT Using CICIoT2023 Dataset", 2024 11th International Symposium on Telecommunications (IST), Tehran, Iran, 2024. DOI: https://doi.org/10.1109/IST64061.2024.10843502
View in Google Scholar
[16] A. Hajjouz and E. Avksentieva, "Optimizing Intrusion Detection for DoS, DDoS, and Mirai Attacks Subtypes Using Hierarchical Feature Selection and CatBoost on the CICIoT2023 Dataset", Data and Metadata, vol. 3, art. no. 577, 2024. DOI: https://doi.org/10.56294/dm2024577
View in Google Scholar
[17] N. Thereza and K. Ramli, "Development of Intrusion Detection Models for IoT Networks Utilizing CICIoT2023 Dataset", 2023 3rd International Conference on Smart Cities, Automation & Intelligent Computing Systems (ICON-SONICS), Bali, Indonesia, 2023. DOI: https://doi.org/10.1109/ICON-SONICS59898.2023.10435006
View in Google Scholar
[18] C. Eunaicy, c. Jayapratha, and H.S. Hemachitra, "IoT Guardian: A Novel Feature Discovery and Cooperative Game Theory Empowered Feature Selection with ML Model for IoT Threats and Attack Detection", International Journal of Computer Networks and Communications, vol. 16, pp. 25-42, 2024. DOI: https://doi.org/10.5121/ijcnc.2024.16202
View in Google Scholar
[19] J.R.K. Rajasekaran, B. Natarajan, and A. Pahwa, "Modified Matrix Completion-based Detection of Stealthy Data Manipulation Attacks in Low Observable Distribution Systems", IEEE Transactions on Smart Grid, vol. 14, pp. 4851-4862, 2023. DOI: https://doi.org/10.1109/TSG.2023.3266834
View in Google Scholar
[20] H. Dong and I. Kotenko, "An Autoencoder-based Multi-task Learning for Intrusion Detection in IoT Networks", 2023 IEEE Ural-Siberian Conference on Biomedical Engineering, Radioelectronics and Information Technology (USBEREIT), Yekaterinburg, Russia, 2023. DOI: https://doi.org/10.1109/USBEREIT58508.2023.10158807
View in Google Scholar
[21] Z. Wang et al., "A Lightweight Intrusion Detection Method for IoT Based on Deep Learning and Dynamic Quantization", PeerJ Computer Science, vol. 9, art. no. 1569, 2023. DOI: https://doi.org/10.7717/peerj-cs.1569
View in Google Scholar
[22] J. Chen, J. Xiao, and J. Xu, "VGGIncepNet: Enhancing Network Intrusion Detection and Network Security Through Non-image-to-image Conversion and Deep Learning", Electronics, vol. 13, art. no. 3639, 2024. DOI: https://doi.org/10.3390/electronics13183639
View in Google Scholar
[23] A. Hinojosa and N.E. Majd, "Edge Computing Network Intrusion Detection System in IoT Using Deep Learning", 2024 33rd International Conference on Computer Communications and Networks (ICCCN), Kailua-Kona, USA, 2024. DOI: https://doi.org/10.1109/ICCCN61486.2024.10637611
View in Google Scholar
[24] T. Hasan and S. Tasnim, "Multidimensional Feature Learning Enhancement in IoT Intrusion Detection: An Adaptive Cost-sensitive Autoencoder and Weighted Ensemble Approach", 2024 IEEE 10th World Forum on Internet of Things (WF-IoT), Ottawa, Canada, 2024. -0.1pt DOI: https://doi.org/10.1109/WF-IoT62078.2024.10811174
View in Google Scholar
[25] S. Yan, H. Han, X. Dong, and Z. Xu, "Lightweight Deep Learning Method Based on Group Convolution: Detecting DDoS Attacks in IoT Environments", 2024 10th International Symposium on System Security, Safety, and Reliability (ISSSR), Xiamen, China, 2024. DOI: https://doi.org/10.1109/ISSSR61934.2024.00027
View in Google Scholar
[26] M.A. Elaziz, I.A. Fares, and A.O. Aseeri, "CKAN: Convolutional Kolmogorov-Arnold Networks Model for Intrusion Detection in IoT Environment", IEEE Access, vol. 12, pp. 134837-134851, 2024. DOI: https://doi.org/10.1109/ACCESS.2024.3462297
View in Google Scholar
[27] H. Kamal and M. Mashaly, "Enhanced Hybrid Deep Learning Models-based Anomaly Detection Method for Two-stage Binary and Multi-class Classification of Attacks in Intrusion Detection Systems", Algorithms, vol. 18, 2025. DOI: https://doi.org/10.3390/a18020069
View in Google Scholar
[28] Z. Ahmad et al., "Anomaly Detection Using Deep Neural Network for IoT Architecture", Applied Sciences, vol. 11, art. no. 7050, 2021. DOI: https://doi.org/10.3390/app11157050
View in Google Scholar
[29] A.N. Gummadi, J.C. Napier, and M. Abdallah, "XAI-IoT: An Explainable AI Framework for Enhancing Anomaly Detection in IoT Systems", IEEE Access, vol. 12, pp. 71024-71054, 2024. DOI: https://doi.org/10.1109/ACCESS.2024.3402446
View in Google Scholar
[30] E. Altulaihan, M.A. Almaiah, and A. Aljughaiman, "Anomaly Detection IDS for Detecting DoS Attacks in IoT Networks Based on Machine Learning Algorithms", Sensors, vol. 24, art. no. 713, 2024. DOI: https://doi.org/10.3390/s24020713
View in Google Scholar
[31] Z. Zulfiqar et al., "DeepDetect: An Innovative Hybrid Deep Learning Framework for Anomaly Detection in IoT Networks", Journal of Computational Science, vol. 83, art. no. 102426, 2024. DOI: https://doi.org/10.1016/j.jocs.2024.102426
View in Google Scholar
[32] A. Alrefaei and M. Ilyas, "Using Machine Learning Multiclass Classification Technique to Detect IoT Attacks in Real Time", Sensors, vol. 24, art. no. 4516, 2024. DOI: https://doi.org/10.3390/s24144516
View in Google Scholar
[33] Z. Alwaisi, T. Kumar, E. Harjula, and S. Soderi, "Securing Constrained IoT Systems: A Lightweight Machine Learning Approach for Anomaly Detection and Prevention", Internet of Things, vol. 28, art. no. 101398, 2024. DOI: https://doi.org/10.1016/j.iot.2024.101398
View in Google Scholar
[34] I. Ullah and Q.H. Mahmoud, "Design and Development of RNN Anomaly Detection Model for IoT Networks", IEEE Access, vol. 10, pp. 62722-62750, 2022. DOI: https://doi.org/10.1109/ACCESS.2022.3176317
View in Google Scholar
[35] M.M. Khan and M. Alkhathami, "Anomaly Detection in IoT-based Healthcare: Machine Learning for Enhanced Security", Scientific Reports, vol. 14, art. no. 5872, 2024. DOI: https://doi.org/10.1038/s41598-024-56126-x
View in Google Scholar
[36] S.-M. Tseng, Y.-Q. Wang, and Y.-C. Wang, "Multi-class Intrusion Detection Based on Transformer for IoT Networks Using CIC-IoT-2023 Dataset", Future Internet, vol. 16, art. no. 284, 2024. DOI: https://doi.org/10.3390/fi16080284
View in Google Scholar
[37] R. Zhao et al., "A Novel Intrusion Detection Method Based on Lightweight Neural Network for Internet of Things", IEEE Internet of Things Journal, vol. 9, pp. 9960-9972, 2022. DOI: https://doi.org/10.1109/JIOT.2021.3119055
View in Google Scholar
[38] M. Verkerken et al., "A Novel Multi-stage Approach for Hierarchical Intrusion Detection", IEEE Transactions on Network and Service Management, vol. 20, pp. 3915-3929, 2023. DOI: https://doi.org/10.1109/TNSM.2023.3259474
View in Google Scholar
[39] A. Momand, S.U. Jan, and N. Ramzan, "ABCNN-IDS: Attention-based Convolutional Neural Network for Intrusion Detection in IoT Networks", Wireless Personal Communications, vol. 136, pp. 1981-2003, 2024. DOI: https://doi.org/10.1007/s11277-024-11260-7
View in Google Scholar
[40] S. Ali et al., "Effective Multitask Deep Learning for IoT Malware Detection and Identification Using Behavioral Traffic Analysis", IEEE Transactions on Network and Service Management, pp. 1199-1209, 2022. DOI: https://doi.org/10.1109/TNSM.2022.3200741
View in Google Scholar
Downloads
Published
Issue
Section
License
Copyright (c) 2025 Mohamed Amine Beghoura, Younes Belouche
This work is licensed under a Creative Commons Attribution 4.0 International License.
