A TWO-TIER HYBRID INTRUSION DETECTION SYSTEM FOR IoT/MQTT NETWORKS BASED ON MACHINE LEARNING ENSEMBLE AND FUZZY INFERENCE SYSTEM
Keywords
DOI:
https://doi.org/10.34238/tnu-jst.15899Abstract
This paper proposes a two-stage hybrid intrusion detection system for IoT/MQTT networks. The first stage employs an Ensemble Stacking model combining Multi-Layer Perceptron (MLP), Random Forest, and eXtreme Gradient Boosting (XGBoost), with Logistic Regression as the meta-learner. The second stage applies a Fuzzy Inference System (FIS) to selectively re-examine low-confidence legitimate predictions. On the MQTTEEB-D dataset (60/20/20 split, SMOTE on training set only), the baseline Ensemble achieves the values of F1-Weighted, F1-Macro, Legit-F1, and Macro AP of 0.9450, 0.9152, 0.6866, and 0.9497, respectively. The proposed Hybrid Ensemble-FIS further improves these values to 0.9465, 0.9174, 0.6888, 0.9478, recovering 193 brute-force samples previously misclassified as legitimate and raising the recall of this class from 89% to 92%. The paper also presents a Precision–Recall analysis instead of ROC curves, which better fits the imbalanced data context. The proposed method enhances intrusion detection in IoT/MQTT networks while preserving interpretability through its Mamdani rule-based design.Downloads
References
OASIS, “MQTT Version 5.0 OASIS Standard,” OASIS Open, 7 March 2019. [Online]. Available: https://docs.oasis-open.org/mqtt/mqtt/v5.0/mqtt-v5.0.html. [Accessed May 24, 2026].
ISO/IEC, “Information technology — Message Queuing Telemetry Transport (MQTT) v3.1.1,” International Standard ISO/IEC 20922:2016, 2016.
Y. Kombate, P. Houngue, and O. Samuel, “Securing MQTT: Unveiling vulnerabilities and innovating cyber range solutions,” Procedia Computer Science, vol. 241, pp. 69-76, 2024, doi: 10.1016/j.procs.2024.08.012.
A. Aqachtoul et al., “MQTTEEB-D: A real-world IoT cybersecurity dataset for AI-powered threat detection in MQTT networks,” Data in Brief, vol. 62, 2025, doi: 10.1016/j.dib.2025.111897.
I. Vaccari, M. Aiello, and E. Cambiaso, “SlowITe, a novel denial of service attack affecting MQTT,” Sensors, vol. 20, no. 10, 2020, doi: 10.3390/s20102932.
A. Abdelkhalek and M. Mashaly, “Addressing the class imbalance problem in network intrusion detection systems using data resampling and deep learning,” The Journal of Supercomputing, vol. 79, no. 10, pp. 10611-10641, 2023, doi: 10.1007/s11227-023-05073-x.
H. Ren, Y. Tang, W. Dong, S. Ren, and L. Jiang, “DUEN: Dynamic ensemble handling class imbalance in network intrusion detection,” Expert Systems with Applications, vol. 229, 2023, doi: 10.1016/j.eswa.2023.120420.
T. Saito and M. Rehmsmeier, “The precision-recall plot is more informative than the ROC plot when evaluating binary classifiers on imbalanced datasets,” PLoS ONE, vol. 10, no. 3, 2015, doi: 10.1371/journal.pone.0118432.
L. Fischer and P. Wollstadt, “Precision and recall reject curves for classification,” arXiv preprint arXiv:2308.08381, 2023, doi: 10.48550/arXiv.2308.08381.
A. M. Banaamah and I. Ahmad, “Intrusion detection in IoT using deep learning,” Sensors, vol. 22, no. 21, 2022, doi: 10.3390/s22218417.
P. Sinha, D. Sahu, S. Prakash, T. Yang, R. S. Rathore, and V. K. Pandey, “A high performance hybrid LSTM CNN secure architecture for IoT environments using deep learning,” Scientific Reports, vol. 15, 2025, doi: 10.1038/s41598-025-94500-5.
H. Hindy, E. Bayne, M. Bures, R. Atkinson, C. Tachtatzis, and X. Bellekens, “Machine learning based IoT intrusion detection system: An MQTT case study (MQTT-IoT-IDS2020 dataset),” arXiv preprint arXiv:2006.15340v3, Nov. 2020.
M. A. Khan, M. A. Khan, S. U. Jan, J. Ahmad, S. S. Jamal, A. A. Shah, N. Pitropakis, and W. J. Buchanan, “A deep learning-based intrusion detection system for MQTT enabled IoT,” Sensors, vol. 21, no. 21, 2021, doi: 10.3390/s21217016.
A. Almotairi, S. Atawneh, O. A. Khashan, and N. M. Khafajah, “Enhancing intrusion detection in IoT networks using machine learning-based feature selection and ensemble models,” Systems Science & Control Engineering, vol. 12, no. 1, 2024, doi: 10.1080/21642583.2024.2321381.
D. H. Wolpert, “Stacked generalization,” Neural Networks, vol. 5, no. 2, pp. 241-259, 1992, doi: 10.1016/S0893-6080(05)80023-1.
X. Qiu, L. Shi, and P. Fan, “A cooperative intrusion detection system for internet of things using fuzzy logic and ensemble of convolutional neural networks,” Scientific Reports, vol. 15, 2025, doi: 10.1038/s41598-025-99938-1.
M. Almseidin, J. Al-Sawwa, M. Alkasassbeh, and M. Alweshah, “On detecting distributed denial of service attacks using fuzzy inference system,” Cluster Computing, vol. 26, no. 2, pp. 1337-1351, 2023, doi: 10.1007/s10586-022-03657-5.
S. S. Pandi, R. D. R. Ramani, A. Senthilselvi, S. Dhanasekaran, B. Kalpana, and N. A. Balaji, “Advancing IoT security with FLAME: A hybrid approach combining fuzzy logic and artificial lizard search optimization,” Computers & Security, vol. 145, 2024, doi: 10.1016/j.cose.2024.103984.
A. H. Abu Saq, A. Zainal, B. A. S. Al-Rimy, A. Alyami, and H. A. Abosaq, “Intrusion detection in IoT using Gaussian fuzzy mutual information-based feature selection,” Engineering, Technology & Applied Science Research, vol. 14, no. 6, pp. 17564-17571, 2024, doi: 10.48084/etasr.8268.
L. Breiman, “Random forests,” Machine Learning, vol. 45, no. 1, pp. 5-32, 2001, doi: 10.1023/A:1010933404324.
T. Chen and C. Guestrin, “XGBoost: A scalable tree boosting system,” in Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, 2016, pp. 785-794, doi: 10.1145/2939672.2939785.
E. H. Mamdani, “Application of fuzzy logic to approximate reasoning using linguistic synthesis,” IEEE Transactions on Computers, vol. C-26, no. 12, pp. 1182-1191, 1977, doi: 10.1109/TC.1977.1674779.
L. A. Zadeh, “Fuzzy sets,” Information and Control, vol. 8, no. 3, pp. 338-353, 1965, doi: 10.1016/S0019-9958(65)90241-X.
G. Lemaître, F. Nogueira, and C. K. Aridas, “Imbalanced-learn: A Python Toolbox to Tackle the Curse of Imbalanced Datasets in Machine Learning,” J. Mach. Learn. Res., vol. 18, no. 17, pp. 1-5, 2017, doi: 10.5555/3122009.3122026.
F. Pedregosa et al., “Scikit-learn: Machine Learning in Python,” J. Mach. Learn. Res., vol. 12, pp. 2825-2830, 2011, doi: 10.5555/1953048.2078195.
H. Allaga, M. Biniz, and A. Farchane, “MQTTEEB-D: A high-fidelity benchmark for real-time MQTT anomaly detection using machine learning techniques,” Ad Hoc Networks, vol. 181, 2026, Art. no. 104062, doi: 10.1016/j.adhoc.2025.104062.
K. Karam, A. Aqachtoul, A. Elamrani, M. Najib, N. Rafalia, I. Moumen, J. Abouchabaka, and M. Bakhouya, “ISAAF: an IoT security and attack prevention framework using AI-driven predictive analytics,” Scientific Reports, vol. 15, 2025, Art. no. 44913, doi: 10.1038/s41598-025-28516-2.
A. K. Alhossainy and M. Malekzadeh, “AI Powered Threat Detection Framework for Security Enhancement of MQTT based IoT Networks,” International Transactions on Electrical Engineering and Computer Science, vol. 5, no. 1, 2026, doi: 10.62760/iteecs.5.1.2026.171.
