A HYBRID CNN-LSTM AND ADABOOST MODEL FOR CLASSIFYING INTRUSION IN IoT NETWORKS

Abstract

The rapid expansion of the Internet of Things (IoT) has vastly increased device connectivity but also expanded the attack surface. Resource constraints and heterogeneous protocols make traditional intrusion detection systems (IDS) inadequate: signature-based methods miss novel threats, and anomaly detectors yield high false positive rates. We propose a hybrid model integrating CNN, LSTM, and AdaBoost for robust IoT intrusion detection. Our two-stage pipeline begins with a hybrid CNN-LSTM model that automatically extracts spatial and temporal features from preprocessed network traffic. The CNN branch captures local attack patterns, while the LSTM branch models sequential traffic dependencies. We train on a combined UNSW-NB15 and RT-IoT2022 dataset of 205,449 instances with 127 initial features. Rigorous preprocessing (missing-value imputation, one-hot encoding, Z-score normalization, correlation-based elimination) reduces inputs to a 20-feature subset. In the second stage, we extract deep representations from the CNN-LSTM’s penultimate layer and input them to an AdaBoost classifier with decision-stump base learners. This ensemble adaptively weights features to boost accuracy while controlling computation. Experimental results show improved test performance: 99.70% accuracy, 99.90% precision, 99.78% recall, 99.84% F1-score, and a 2.43% false positive rate. These metrics outperform conventional IDS (e.g., [Churcher et al., 2021: 98.2% accuracy; Kumar et al., 2021: 98.5% F1-score]). The model’s computational efficiency during training (64 steps/sec) suggests potential for scalability, though real-world deployment validation remains future work.