Abstract:
The rapid rise of Internet of Things (IoT) devices has made cybersecurity much more dangerous and vulnerable, emphasizing the critical necessity for adaptive intrusion detection systems (IDS) to safeguard IoT networks. This study presents a Cyber Threat Intelligence (CTI) model that works in real time and adapts to IoT contexts. The suggested model uses density-based clustering (DBSCAN), deep learning (CNN-LSTM), and reinforcement learning (LDQN) to find, sort, and respond to threats that change over time. A generative model (GAN) is added to make detection better by adding fake data. The model works in three main steps: detection, mitigation and response, and ongoing improvement which is adaptively. During the detecting phase, DBSCAN identifies anomalies by grouping network IoT traffic and separating outliers. A hybrid CNN-LSTM architecture processes anomalies by finding patterns of threats over time, while a Random Forest algorithm classifies typical traffic. During the mitigation and response phase, a Lightweight Deep Q-Network (LDQN) dynamically assigns the actions BLOCK, DROP, INVESTIGATE, or ALLOW based on how serious each threat is. A Generative Adversarial Network (GAN) produces fake data to fix class imbalance and make it easier to find classes that aren't well represented. After being improved, the unified model was able to find IoT intrusions with an accuracy of 92.86%, a precision of 95.16%, and a recall of 95.93%. The system learns about new attack patterns in real time and responds to threats automatically, making it useful for protecting big and changing IoT deployments. This research links classic IDS solutions with cutting-edge AI-driven threat intelligence systems to create an approach for IoT cybersecurity that can grow, is resilient, and improves itself.
