Design and Implementation of a Real-Time Intrusion Detection System for IoT Networks

Thesis Abstract

The rapid proliferation of Internet of Things (IoT) devices has significantly transformed modern digital infrastructure, yet it has concurrently heightened vulnerabilities to cyber threats, posing critical challenges for ensuring data security and operational integrity within IoT networks. This study addresses the pressing need for an effective, real-time intrusion detection mechanism tailored to the unique characteristics of IoT environments. The primary aim is to design, implement, and evaluate a comprehensive intrusion detection system (IDS) capable of detecting malicious activities with high accuracy and low latency, thereby enhancing the security posture of IoT networks. Specific objectives include identifying prevalent attack vectors targeting IoT devices, developing a lightweight detection model suitable for resource-constrained environments, and assessing the system’s real-time detection performance through empirical testing. The research adopts a mixed-methods approach, combining experimental system development with quantitative performance evaluation. The population comprises IoT devices within a controlled laboratory environment representing typical smart home and industrial IoT deployments, totaling 150 devices including sensors, actuators, and gateways. A sample of 100 devices will be monitored for data collection, using both simulated attack scenarios (such as denial-of-service, spoofing, and data injection attacks) and normal traffic patterns. Data collection instruments involve network traffic captures using Wireshark and custom data loggers that record packet-level features, including source/destination addresses, packet size, protocol type, and timing attributes. The system’s detection algorithms will be developed based on machine learning models, particularly Random Forest and Support Vector Machine classifiers, trained on feature sets extracted from labeled data, with model validation carried out via k-fold cross-validation to prevent overfitting. The analytical framework involves statistical analysis of detection accuracy metrics such as precision, recall, F1-score, and detection latency, complemented by receiver operating characteristic (ROC) curve analysis to evaluate model performance. Additionally, a comparative analysis will be conducted between the machine learning models to identify the most effective classifier for real-time detection. The study also employs contextual threat analysis guided by the Protection Motivation Theory (PMT) to understand user and system vulnerabilities within IoT networks. Expected findings include a high detection accuracy exceeding 90% with minimal false positives, detection latency below 200 milliseconds suitable for real-time operations, and identification of specific attack signatures unique to IoT traffic patterns. This research significantly contributes to knowledge by providing a scalable, resource-efficient intrusion detection framework specifically designed for IoT environments, advancing the deployment of intelligent security solutions in embedded systems. The integration of machine learning classifiers within a lightweight architecture offers practical insights into balancing detection performance with the constraints of IoT devices. Furthermore, by empirically validating the proposed IDS in a real-world simulated environment, the study provides a replicable model for IoT security practitioners and researchers aiming to enhance cyber resilience. The main conclusion emphasizes that tailored machine learning-based IDS models, when optimized for IoT-specific features and network constraints, can substantially improve threat detection capabilities without compromising system performance. Recommendations include adopting the proposed IDS architecture for deployment across diverse IoT contexts, emphasizing continuous model training with real-time data to adapt to evolving threats, and implementing comprehensive security policies addressing identified vulnerabilities. Future research should explore integrating anomaly detection mechanisms utilizing deep learning techniques and expanding the scope to include cloud-based IoT ecosystem security, thereby ensuring comprehensive protection across interconnected platforms.