# A Comparative Analysis of Machine Learning Techniques for IoT Intrusion Detection

arXiv: https://arxiv.org/abs/2111.13149 · HTML: https://mlsanity.com/paper/2111.13149/

## Key facts

- Cited by 10 papers in the map (data through 14 Oct 2026).
- Builds on 6 of its 25 references that are in the map.
- First posted on arXiv 25 Nov 2021.

## Builds on (most cited first, 6 of 6)

- [XGBoost: A Scalable Tree Boosting System](https://mlsanity.com/paper/1603.02754/) (2016)
- [Deep Reinforcement Learning with Double Q-learning](https://mlsanity.com/paper/1509.06461/) (2015)
- [Machine Learning Based Network Vulnerability Analysis of Industrial Internet of Things](https://mlsanity.com/paper/1911.05771/) (2019)
- [Security of the Internet of Things: Vulnerabilities, Attacks and Countermeasures](https://mlsanity.com/paper/1910.13312/) (2019)
- [Machine Learning Based Solutions for Security of Internet of Things (IoT): A Survey](https://mlsanity.com/paper/2004.05289/) (2020)
- [Towards Learning-automation IoT Attack Detection through Reinforcement Learning](https://mlsanity.com/paper/2006.15826/) (2020)

## Built on by (most cited first, 10 of 10)

- [Towards Adversarial Realism and Robust Learning for IoT Intrusion Detection and Classification](https://mlsanity.com/paper/2301.13122/) (2023)
- [An Adversarial Robustness Benchmark for Enterprise Network Intrusion Detection](https://mlsanity.com/paper/2402.16912/) (2024)
- [Reliable Feature Selection for Adversarially Robust Cyber-Attack Detection](https://mlsanity.com/paper/2404.04188/) (2024)
- [CPS Attack Detection under Limited Local Information in Cyber Security: A Multi-node Multi-class Classification Ensemble Approach](https://mlsanity.com/paper/2209.00170/) (2022)
- [Efficient Network Traffic Feature Sets for IoT Intrusion Detection](https://mlsanity.com/paper/2406.08042/) (2024)
- [A Low-Cost Multi-Agent System for Physical Security in Smart Buildings](https://mlsanity.com/paper/2209.00741/) (2022)
- [Adversarial Robustness and Feature Impact Analysis for Driver Drowsiness Detection](https://mlsanity.com/paper/2303.13649/) (2023)
- [Is there a Trojan! : Literature survey and critical evaluation of the latest ML based modern intrusion detection systems in IoT environments](https://mlsanity.com/paper/2310.10778/) (2023)
- [Data-Driven Heat Pump Management: Combining Machine Learning with Anomaly Detection for Residential Hot Water Systems](https://mlsanity.com/paper/2506.15719/) (2025)
- [Benchmarking Machine Learning Models for IoT Malware Detection under Data Scarcity and Drift](https://mlsanity.com/paper/2601.18736/) (2026)

## Abstract (arXiv)

The digital transformation faces tremendous security challenges. In particular, the growing number of cyber-attacks targeting Internet of Things (IoT) systems restates the need for a reliable detection of malicious network activity. This paper presents a comparative analysis of supervised, unsupervised and reinforcement learning techniques on nine malware captures of the IoT-23 dataset, considering both binary and multi-class classification scenarios. The developed models consisted of Support Vector Machine (SVM), Extreme Gradient Boosting (XGBoost), Light Gradient Boosting Machine (LightGBM), Isolation Forest (iForest), Local Outlier Factor (LOF) and a Deep Reinforcement Learning (DRL) model based on a Double Deep Q-Network (DDQN), adapted to the intrusion detection context. The most reliable performance was achieved by LightGBM. Nonetheless, iForest displayed good anomaly detection results and the DRL model demonstrated the possible benefits of employing this methodology to continuously improve the detection. Overall, the obtained results indicate that the analyzed techniques are well suited for IoT intrusion detection.