Citation

Rahman, Md. Asifur and Kabir, Md. Mohsin and Hossen, Md. Jakir and Mridha, M. F. (2026) WISE: A Weighted Hybrid Ensemble of CNN and Tree‐Based Models for Robust IoT Intrusion Detection. SECURITY AND PRIVACY, 9 (3). ISSN 2475-6725

Text WISE_ A Weighted Hybrid Ensemble of CNN and Tree‐Based Models for Robust IoT Intrusion Detection - Rahman - 2026 - SECURITY AND PRIVACY - Wiley Online Library.pdf - Published Version Restricted to Repository staff only Download (433kB)

Abstract

Intelligent and dependable Intrusion Detection Systems are crucial considering that the cyberattack surface has grown due to the exponential growth of the Internet of Things (IoT). However, traditional and single-model ML approaches are ineffective, particularly in detecting uncommon attacks, due to the high dimensionality, complexity, and stark class imbalance of real-world IoT network data. Equal-weight voting in hybrid ensembles fails to address class imbalance and lacks a principled weighting strategy. WISE addresses this gap with an adaptive weighted averaging mechanism for imbalanced IoT intrusion detection. For reliable IoT intrusion detection, we propose WISE, a weighted hybrid ensemble model that combines a 1D-CNN, Random Forest (RF), and XGBoost via weighted averaging. CNN's sensitivity to rare attacks is prioritized while utilizing the accuracy of the tree models on common classes through the use of a strategic weighted averaging technique (CNN = 0.4, RF = 0.3, XGBoost = 0.3). Using the unbalanced RT-IOT2022 dataset, WISE outperformed eight baseline models and successfully mitigated class imbalance across all 12 attack classes, achieving a state-of-the-art accuracy of 0.9978 and a superior macro F1-score of 0.9757, with high recall for rare attack classes such as Mirai and Bashlite. Additionally, Grad-CAM's Explainable AI (XAI) improves the model's decision-making process by revealing detected attacks. This weighted hybrid ensemble offers great promise as a dependable and successful IoT intrusion detection paradigm. In contrast to current hybrid ensembles that employ majority voting or simple averaging, WISE introduces a strategically weighted fusion mechanism that leverages the accuracy of tree-based models on common classes while prioritizing CNN's sensitivity to uncommon attacks. This approach has been validated through rigorous statistical testing and XAI.

Item Type:	Article
Uncontrolled Keywords:	Intrusion detection systems
Subjects:	T Technology > TK Electrical engineering. Electronics Nuclear engineering > TK5101-6720 Telecommunication. Including telegraphy, telephone, radio, radar, television
Divisions:	Faculty of Engineering and Technology (FET)
Depositing User:	Ms Rosnani Abd Wahab
Date Deposited:	03 Apr 2026 04:30
Last Modified:	03 Apr 2026 04:30
URII:	http://shdl.mmu.edu.my/id/eprint/15697

Downloads

Edit (login required)