# AI-based Two-Stage Intrusion Detection for Software Defined IoT Networks

arXiv: https://arxiv.org/abs/1806.02566 · HTML: https://mlsanity.com/paper/1806.02566/

## Key facts

- Cited by 5 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 7 Jun 2018.

## Built on by (most cited first, 5 of 5)

- [Joint Semantic Transfer Network for IoT Intrusion Detection](https://mlsanity.com/paper/2210.15911/) (2022)
- [Heterogeneous Domain Adaptation for IoT Intrusion Detection: A Geometric Graph Alignment Approach](https://mlsanity.com/paper/2301.09801/) (2023)
- [Adaptive Bi-Recommendation and Self-Improving Network for Heterogeneous Domain Adaptation-Assisted IoT Intrusion Detection](https://mlsanity.com/paper/2303.14317/) (2023)
- [LGTBIDS: Layer-wise Graph Theory Based Intrusion Detection System in Beyond 5G](https://mlsanity.com/paper/2210.03518/) (2022)
- [GTCN-G: A Residual Graph-Temporal Fusion Network for Imbalanced Intrusion Detection](https://mlsanity.com/paper/2510.07285/) (2025)

## Abstract (arXiv)

Software Defined Internet of Things (SD-IoT) Networks profits from centralized management and interactive resource sharing which enhances the efficiency and scalability of IoT applications. But with the rapid growth in services and applications, it is vulnerable to possible attacks and faces severe security challenges. Intrusion detection has been widely used to ensure network security, but classical detection means are usually signature-based or explicit-behavior-based and fail to detect unknown attacks intelligently, which are hard to satisfy the requirements of SD-IoT Networks. In this paper, we propose an AI-based two-stage intrusion detection empowered by software defined technology. It flexibly captures network flows with a globle view and detects attacks intelligently through applying AI algorithms. We firstly leverage Bat algorithm with swarm division and Differential Mutation to select typical features. Then, we exploit Random forest through adaptively altering the weights of samples using weighted voting mechanism to classify flows. Evaluation results prove that the modified intelligent algorithms select more important features and achieve superior performance in flow classification. It is also verified that intelligent intrusion detection shows better accuracy with lower overhead comparied with existing solutions.