Volume 9 • Issue 2 • PP: 01–13 • 2025
Hybrid Ensemble Learning for Flow-Level IoT Traffic Classification Using ACI Dataset: Towards Scalable and Real-Time Threat Detection
Open Access & Copyright
© 2025 The Author(s). Published by ASPG. This article is licensed under the Creative Commons Attribution 4.0 International License (CC BY 4.0).
View PDF Abstract
Internet of Things devices, which spread across consumer industrial and critical infrastructure domains, have boosted the quantity of diverse network traffic and its high frequency. The increasing scale of IoT networks causes problems securing the diverse data flow within these networks, threatening system performance and management capabilities. Analyzing network traffic with traditional methods based on signature identification and rule detection becomes ineffective for new traffic activity patterns and system behavior. Due to extensive growth in IoT networks, developing intelligent data-based classification systems that can process IoT traffic quickly and at large operational scales becomes essential. A detailed model of flow-level data-based machine learning operations for IoT traffic classification utilizes features extracted from the Army Cyber Institute (ACI) IoT dataset. The dataset encompasses statistical, temporal, and protocol-specific attributes for benign and malicious network flows. Our methodology first conducts a strict data preprocessing stage, which involves numerous operations such as cleaning the data, normalizing it and encoding the labels, and performing a feature correlation analysis before preparing the learning algorithms with a suitable quality and balanced dataset. Various classification models underwent training, including Linear Discriminant Analysis (LDA), Quadratic Discriminant Analysis (QDA), Naive Bayes and SGD Classifiers, and statistical learners. Our proposed hybrid ensemble method combines weighted voting between a deep learning neural network, a Random Forest model, and an XGBoost classifier to overcome the limitations of single classifiers. This ensemble model aimed to make the system more resilient while lowering bias and enhancing its ability to understand various IoT traffic patterns. A complete set of evaluation metrics assessed the models, using accuracy, precision, recall, F1-score, Hamming loss, Matthews correlation coefficient (MCC) and Cohen’s Kappa plus balanced accuracy and log loss for assessment. The chosen metrics allowed researchers to monitor model performance from global and detailed perspectives when dealing with imbalanced classes and similar patterns between legitimate and malicious network traffic. The ensemble methodology produces superior results than individual classifiers demonstrated through experimental results under all performance metrics evaluation. The complex nature of network environments demonstrates that model fusion achieves excellent results when tracking non-easy-to-classify traffic patterns. The ensemble approach proves excellent generalization properties and optimized performance for real-time IoT implementations because of its ability to adapt continuously while maintaining high accuracy levels. This proposed framework adds to intelligent IoT traffic analysis research while demonstrating how deep learning and traditional machine learning methods enhance ensemble systems. The system develops an expandable and clear quantitative solution that can be implemented for advanced network security systems and traffic monitoring applications across smart cities industrial settings, and critical infrastructure frameworks.
Keywords
References
[1] W. Jiang, “Cellular traffic prediction with machine learn-ing: A survey,” Expert Systems with Applications, vol. 201, p. 117163, 2022.
[2] G. Sripriyanka and A. Mahendran, “Mirai botnet at-tacks on IoT applications: Challenges and controls,” In International Conference on Information Systems and Management Science, Springer, pp. 49–67, 2021.
[3] Y. Xiong, S. Dong, R. Liu, F. Shi, and X. Jing, “IoT net-work traffic classification: A deep learning method with fourier transform-assisted hyperparameter optimization,” Frontiers in Physics, vol. 11, p. 1273862, 2023.
[4] N. A. Hung, “Traffic modeling and anomaly detection for internet of things,” Ph.D. dissertation, Shibaura In-stitute of Technology, 2021.
[5] M. Snehi and A. Bhandari, “Introspecting diverse IoT-traffic analysis methods in smart environments and prospects,” In IEEE International Conference on Data Science and Information System (ICDSIS), IEEE, pp. 1–5, 2022.
[6] Z. K. Maseer, R. Yusof, S. A. Mostafa, N. Bahaman, O. Musa, and B. A. S. Al-Rimy, “DeepIoT.IDS: Hybrid deep learning for enhancing IoT network intrusion de-tection,” Computers, Materials and Continua, vol. 69, no. 3, pp. 3946–3967, 2021.
[7] M. Pons, E. Valenzuela, B. Rodríguez, J. A. Nolazco-Flores, and C. Del-Valle-Soto, “Utilization of 5g tech-nologies in IoT applications: Current limitations by interference and network optimization difficulties—a review,” Sensors, vol. 23, no. 8, p. 3876, 2023.
[8] V. D. Jangampet, S. R. Pulyala, and A. G. Desetty, “Op-timized alternating graph-regularized neural network for cyber security threats detection in internet of things,” International Journal of Information Security, vol. 2, no. 1, 2023.
[9] M. Nicholson, R. Agrahari, C. Conran, H. Assem, and J. D. Kelleher, “The interaction of normalisation and clustering in sub-domain definition for multi-source transfer learning based time series anomaly detection,” Knowledge-Based Systems, vol. 257, p. 109894, 2022.
[10] M. Habiba, M. R. Islam, S. M. Muyeen, and A. B. M. S. Ali, “Edge intelligence for network intrusion prevention in IoT ecosystem,” Computers and Electrical Engineer-ing, vol. 108, p. 108727, 2023.
[11] G. Chakrapani, G. S. Rao, and K. V. Krishna, “Securing IoT networks: IoT device identification and classifi-cation through network traffic analysis using machine learning,” Turkish Journal of Computer and Mathemat-ics Education, vol. 14, no. 3, pp. 1021–1028, 2023.
[12] D. Alekseeva, N. Stepanov, A. Veprev, A. Sharapova, E. S. Lohan, and A. Ometov, “Comparison of machine learning techniques applied to traffic prediction of real wireless network,” IEEE Access, vol. 9, pp. 159 495–159 514, 2021.
[13] M. Hammoudeh, J. Pimlott, S. Belguith, G. Epiphaniou, T. Baker, A. S. M. Kayes, B. Adebisi, and A. Bounceur, “Network traffic analysis for threat detection in the inter-net of things,” IEEE Internet of Things Magazine, vol. 3, no. 4, pp. 40–45, 2021.
[14] H. Nguyen and R. F. Kashef, “TS-IDS: Traffic-aware self-supervised learning for IoT network intrusion detec-tion,” Knowledge-Based Systems, vol. 279, p. 110966, 2023.
[15] J. P. Kushwaha, S. Bhadauria, and S. Tapaswi, “Multi-method stacked feature selection approach based IDS for IoT networks,” Procedia Computer Science, vol. 230, pp. 564–573, 2023.
[16] R. Lazzarini, H. Tianfield, and V. Charissis, “A stack-ing ensemble of deep learning models for IoT intru-sion detection,” Knowledge-Based Systems, vol. 279, p. 110941, 2023.
[17] E. C. P. Neto, S. Dadkhah, R. Ferreira, A. Zohourian, R. Lu, and A. A. Ghorbani, “CICIoT2023: A real-time dataset and benchmark for large-scale attacks in IoT environment,” Sensors, vol. 23, no. 13, p. 5941, 2023.
[18] H. Nguyen-An, T. Silverston, T. Yamazaki, and T. Miyoshi, “IoT traffic: Modeling and measurement experiments,” IoT, vol. 2, no. 1, pp. 140–162, 2021.
[19] S. B. M. A. T. S. D. V. B. B. I. Neelakandan, M. A. Berlin, S. Tripathi, V. B. Devi, I. Bhardwaj, and N. Arulkumar, “IoT-based traffic prediction and traffic signal control system for smart city,” Soft Computing, vol. 25, no. 18, pp. 12 241–12 248, 2021.
[20] P. Khandait, N. Hubballi, and B. Mazumdar, “Io-THunter: IoT network traffic classification using device specific keywords,” IET Networks, vol. 10, no. 2, pp. 59–75, 2021.
[21] O. Salman, I. H. Elhajj, A. Chehab, and A. Kayssi, “A machine learning based framework for IoT device iden-tification and abnormal traffic detection,” Transactions on Emerging Telecommunications Technologies, vol. 33, no. 3, p. e3743, 2022.
[22] A. I. Owusu and A. Nayak, “An intelligent traffic classi-fication in sdn-IoT: A machine learning approach,” In IEEE International Black Sea Conference on Communi-cations and Networking (BlackSeaCom), IEEE, pp. 1–6, 2020.
[23] R. Kumar, M. Swarnkar, G. Singal, and N. Kumar, “IoT network traffic classification using machine learning algorithms: An experimental analysis,” IEEE Internet of Things Journal, vol. 9, no. 2, pp. 989–1008, 2021.
[24] S. P. Khedkar and R. AroulCanessane, “Machine learn-ing model for classification of IoT network traffic,” In Fourth International Conference on I-SMAC (IoT in So-cial, Mobile, Analytics and Cloud), IEEE, pp. 166–170, 2020.
[25] A. P. Joshi and B. V. Patel, “Data preprocessing: The techniques for preparing clean and quality data for data analytics process,” Oriental Journal of Computer Sci-ence and Technology, vol. 13, no. 2–3, pp. 78–81, 2021.
Cite This Article
Choose your preferred format
Publisher's Note
The statements, opinions, and data presented in this article are solely those of the author(s) and do not necessarily represent those of ASPG, the journal, or its editors. ASPG and the editors disclaim responsibility for any harm arising from the use of any ideas, methods, instructions, or products described in this article, to the fullest extent permitted by applicable law.