ROBUST FLOW-BASED IOT INTRUSION DETECTION FOR SUSTAINABLE SMART INFRASTRUCTURE: CROSS-CAPTURE EVALUATION AND INTERPRETABLE ATTACK FINGERPRINTS

Soorya S Suresh, Pragati Sachdeva, Amarjit Malhotra, Deepika Kukreja

Abstract: Internet of Things (IoT) devices are crucial in sustainability programs for monitoring energy, air, water, and transportation systems. These systems need reliable, timely data, which can be interrupted by compromised networks. This study examines whether an artificial intelligence model can still perform well when network conditions change. Using flow-based tabular data from the CIC IoT-IDAD dataset, traffic is divided into normal and three attack types: DoS-UDP, DDoS-ICMP, and Mirai. Two practical machine learning models, Logistic Regression and Random Forest, are assessed. The results show that while the best model performs well in a standard random data split (Macro-F1 up to 0.84), its performance drops sharply when trained on one capture group and tested on another (average Macro-F1: 0.34-0.39). This study highlights a significant generalization gap in real deployment scenarios. Additionally, feature importance shows that timing patterns and the sizes of packets or flows consistently serve as reliable indicators across changing network conditions.

Keywords: Internet of Things (IoT), Intrusion detection, Flow-based network traffic, Cross-capture generalization, Permutation importance, Sustainable smart infrastructure

DOI: 10.24874/PES08.02A.015

Recieved:   Revised:   Accepted:   
UDC:

Reads: 0   

---