Intelligent Cyber Threat Detection in IoT and Network Environments Using Hybrid Ensemble Learning

Abstract

The increasing proliferation of Internet of Things (IoT) devices and interconnected networks has significantly expanded the attack surface for cyber threats. Traditional intrusion detection systems often struggle to effectively detect and classify complex, multi-class attacks in real-time, especially in heterogeneous environments. This study addresses the challenge by proposing an intelligent cyber threat detection framework using hybrid ensemble learning techniques. We evaluate five machine learning classifiers—Decision Tree, Random Forest, Extra Trees, XGBoost, and a proposed Stacked Ensemble—on two comprehensive benchmark datasets: CIC-IDS2017 and TON_IoT. These datasets encompass a wide range of network traffic, including both benign and attack instances such as DDoS, DoS, Port Scans, and Injection Attacks. Standard preprocessing and tuning methods are applied to ensure fair evaluation. Among all models, the Stacked Ensemble classifier consistently achieves the highest performance, reaching 99.23% accuracy on CIC-IDS2017 and 99.47% on TON_IoT, along with superior precision, recall, and F1-scores. These results demonstrate the effectiveness of hybrid ensemble approaches in accurately identifying sophisticated cyber threats, making them suitable for deployment in modern IoT and enterprise network environments.