Saved in:
| Main Authors: | , , |
|---|---|
| Format: | Preprint |
| Published: |
2026
|
| Subjects: | |
| Online Access: | https://arxiv.org/abs/2605.19451 |
| Tags: |
Add Tag
No Tags, Be the first to tag this record!
|
| _version_ | 1866916025872678912 |
|---|---|
| author | Barzoki, Hossein Shaemi Hafshejani, Amir Hossein Fathi Montazerolghaem, Ahmadreza |
| author_facet | Barzoki, Hossein Shaemi Hafshejani, Amir Hossein Fathi Montazerolghaem, Ahmadreza |
| contents | Detecting anomalies in Internet of Things (IoT) networks is a critical security challenge, often hampered by highly imbalanced and diverse network traffic datasets. Standard classifiers struggle to perform well across all traffic types. This paper proposes a hybrid detection model to address this challenge using the Bot-IoT dataset. Instead of a single complex classifier, we first employ K-Means clustering to segment the training data into three distinct traffic profile clusters. We then train and evaluate multiple baseline machine learning models, including Decision Tree, KNN, and XGBoost, on each cluster independently to identify the optimal classifier for that specific data profile. Our results show that this clusterspecific, hybrid approach, which assigns different simple models to different clusters, improves detection accuracy and provides a more robust and efficient framework for handling diverse IoT attack traffic. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2605_19451 |
| institution | arXiv |
| publishDate | 2026 |
| record_format | arxiv |
| spellingShingle | A Hybrid Cluster-Based Classification Model for Anomaly Detection in Unbalanced IoT Networks Barzoki, Hossein Shaemi Hafshejani, Amir Hossein Fathi Montazerolghaem, Ahmadreza Networking and Internet Architecture Detecting anomalies in Internet of Things (IoT) networks is a critical security challenge, often hampered by highly imbalanced and diverse network traffic datasets. Standard classifiers struggle to perform well across all traffic types. This paper proposes a hybrid detection model to address this challenge using the Bot-IoT dataset. Instead of a single complex classifier, we first employ K-Means clustering to segment the training data into three distinct traffic profile clusters. We then train and evaluate multiple baseline machine learning models, including Decision Tree, KNN, and XGBoost, on each cluster independently to identify the optimal classifier for that specific data profile. Our results show that this clusterspecific, hybrid approach, which assigns different simple models to different clusters, improves detection accuracy and provides a more robust and efficient framework for handling diverse IoT attack traffic. |
| title | A Hybrid Cluster-Based Classification Model for Anomaly Detection in Unbalanced IoT Networks |
| topic | Networking and Internet Architecture |
| url | https://arxiv.org/abs/2605.19451 |