An adaptive machine learning model for real time detection and mitigation of oit intrusion threats

Abstract

The rapid expansion of Internet of Things (IoT) deployments has increased system exposure to advanced cyber threats such as Distributed Denial-of-Service (DDoS) attacks, botnet infections, and zero-day exploits. Traditional signature-based Intrusion Detection Systems (IDSs) remain reactive, struggle to adapt to heterogeneous IoT environments, and perform poorly against previously unseen intrusion patterns. This study addresses these challenges by developing an adaptive machine learning model for real-time detection and mitigation of IoT intrusion threats. The objective of the study was to design a unified learning framework capable of identifying both known and unknown attacks with high accuracy while providing autonomous mitigation responses. The main research question examined how an integrated machine learning approach could enhance intrusion detection performance within IoT ecosystems. The proposed model incorporates four algorithms DBSCAN which is unsupervised for anomaly detection, Random Forest for supervised classification, a combination of CNN–LSTM network for spatio-temporal threat analysis, and a Light-weight Deep Q-Network (LDQN) for autonomous response actions (Block, Allow, Drop, and Investigate). The model was evaluated using multiple IoT datasets including IoT Intrusion, IoTNet24, IIoT Edge, and NSL-KDD. To address dataset imbalance, Generative Adversarial Network (GAN) augmentation was applied, increasing benign samples and stabilizing classification performance. Results showed high accuracy, precision, recall, and F1-scores above 98% across all datasets. Importantly, GAN augmentation significantly improved benign-class F1-score and reduced misclassification under skewed data conditions. This study shows that integrating diverse machine learning paradigms enhances real-time intrusion detection and automated mitigation in IoT networks. These findings support the study for development of scalable, proactive, and resilient IoT security architectures.