# Machine Learning-Enabled IoT Security: Open Issues and Challenges Under Advanced Persistent Threats

arXiv: https://arxiv.org/abs/2204.03433 · HTML: https://mlsanity.com/paper/2204.03433/

## Key facts

- Cited by 7 papers in the map (data through 14 Oct 2026).
- Builds on 11 of its 194 references that are in the map.
- First posted on arXiv 7 Apr 2022.

## Builds on (most cited first, 11 of 11)

- [Network In Network](https://mlsanity.com/paper/1312.4400/) (2013)
- [Recurrent Neural Network Regularization](https://mlsanity.com/paper/1409.2329/) (2014)
- [Towards the Development of Realistic Botnet Dataset in the Internet of Things for Network Forensic Analytics: Bot-IoT Dataset](https://mlsanity.com/paper/1811.00701/) (2018)
- [Hyperparameters and Tuning Strategies for Random Forest](https://mlsanity.com/paper/1804.03515/) (2018)
- [N-BaIoT: Network-based Detection of IoT Botnet Attacks Using Deep Autoencoders](https://mlsanity.com/paper/1805.03409/) (2018)
- [A Survey of Machine and Deep Learning Methods for Internet of Things (IoT) Security](https://mlsanity.com/paper/1807.11023/) (2018)
- [Lifelong Learning for Sentiment Classification](https://mlsanity.com/paper/1801.02808/) (2018)
- [Early detection of the advanced persistent threat attack using performance analysis of deep learning](https://mlsanity.com/paper/2009.10524/) (2020)
- [An Efficient One-Class SVM for Anomaly Detection in the Internet of Things](https://mlsanity.com/paper/2104.11146/) (2021)
- [Economic impact of IoT cyber risk -- Analysing past and present to predict the future developments in IoT risk analysis and IoT cyber insurance](https://mlsanity.com/paper/1810.10322/) (2018)
- [Real Time Lateral Movement Detection based on Evidence Reasoning Network for Edge Computing Environment](https://mlsanity.com/paper/1902.04387/) (2019)

## Built on by (most cited first, 7 of 7)

- [From One Attack Domain to Another: Contrastive Transfer Learning with Siamese Networks for APT Detection](https://mlsanity.com/paper/2511.20500/) (2025)
- [Large Language Model-driven Security Assistant for Internet of Things via Chain-of-Thought](https://mlsanity.com/paper/2505.06307/) (2025)
- [Blockchain-Enabled Privacy-Preserving Second-Order Federated Edge Learning in Personalized Healthcare](https://mlsanity.com/paper/2506.00416/) (2025)
- [Neuro-Symbolic AI for Cybersecurity: State of the Art, Challenges, and Opportunities](https://mlsanity.com/paper/2509.06921/) (2025)
- [Multidomain transformer-based deep learning for early detection of network intrusion](https://mlsanity.com/paper/2309.01070/) (2023)
- [Host-Based Network Intrusion Detection via Feature Flattening and Two-stage Collaborative Classifier](https://mlsanity.com/paper/2306.09451/) (2023)
- [Enhancing Adversarial Robustness of IoT Intrusion Detection via SHAP-Based Attribution Fingerprinting](https://mlsanity.com/paper/2511.06197/) (2025)

## Abstract (arXiv)

Despite its technological benefits, Internet of Things (IoT) has cyber weaknesses due to the vulnerabilities in the wireless medium. Machine learning (ML)-based methods are widely used against cyber threats in IoT networks with promising performance. Advanced persistent threat (APT) is prominent for cybercriminals to compromise networks, and it is crucial to long-term and harmful characteristics. However, it is difficult to apply ML-based approaches to identify APT attacks to obtain a promising detection performance due to an extremely small percentage among normal traffic. There are limited surveys to fully investigate APT attacks in IoT networks due to the lack of public datasets with all types of APT attacks. It is worth to bridge the state-of-the-art in network attack detection with APT attack detection in a comprehensive review article. This survey article reviews the security challenges in IoT networks and presents the well-known attacks, APT attacks, and threat models in IoT systems. Meanwhile, signature-based, anomaly-based, and hybrid intrusion detection systems are summarized for IoT networks. The article highlights statistical insights regarding frequently applied ML-based methods against network intrusion alongside the number of attacks types detected. Finally, open issues and challenges for common network intrusion and APT attacks are presented for future research.