An Adaptive Machine Learning-Based IDS with Threat-Specific Encryption for Secure IoT Communication

Abstract

The exponential growth of the Internet of Things (IoT) has introduced new dimensions of connectivity. Still, it also brings critical security challenges due to IoT devices' heterogeneity and resource constraints. Traditional Intrusion Detection Systems (IDS) often fail to meet IoT environments' real-time and adaptive security requirements, particularly against sophisticated and zero-day attacks. This paper proposes a hybrid IDS framework that integrates machine learning-based traffic classification with risk-adaptive encryption mechanisms to address these limitations. The system utilizes Random Forest classifiers to categorize network traffic into benign, low-risk, and high-risk threats. A dual-mode encryption strategy is applied based on the threat level: high-risk data is secured using a hybrid RSA and Modified ChaCha20 encryption algorithm. In contrast, low-risk data uses the lightweight Modified ChaCha20 alone. The encryption model introduces a non-linear transformation and custom permutation layer to enhance diffusion and security. Experimental evaluations demonstrate that the proposed system performs better in encryption time, throughput, entropy, and energy efficiency than traditional AES and RSA schemes. Moreover, the keystream randomness was validated through the NIST statistical test suite, confirming its robustness against cryptanalytic attacks. This hybrid approach ensures scalable, intelligent, and secure communication for real-time IoT operations.