Advanced Anomaly Detection and Threat Intelligence in Zero Trust IoT Environments Using Machine Learning

• URL: http://arxiv.org/abs/2604.23332v1
• Date: Sat, 25 Apr 2026 14:39:07 GMT
• Title: Advanced Anomaly Detection and Threat Intelligence in Zero Trust IoT Environments Using Machine Learning
• Abstract summary: This study investigates the application of sophisticated artificial intelligence (AI) and machine learning (ML) techniques to improve anomaly detection and threat intelligence systems.<n>The research endeavors to improve cybersecurity resilience by mitigating false positives and providing actionable intelligence through supervised learning algorithms.
• Score: 1.4916114295865357
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: The growing adoption of IoT and cloud computing, combined with rapid advancements in digital technologies, has considerably increased the cyber-attack surface, resulting in increasingly complex and persistent attacks. Traditional security methods, primarily based on perimeter defenses, are insufficient to meet these developing threats, especially within the context of a Zero Trust Security (ZTS) architecture. This study investigates the application of sophisticated artificial intelligence (AI) and machine learning (ML) techniques, including the use of the Synthetic Minority Oversampling Technique (SMOTE), to improve anomaly detection and threat intelligence systems. This study focuses on how Support Vector Machine (SVM), Random Forest (RF), and Decision Tree (DT) classifiers might increase threat detection accuracy in IoT environments. The research endeavors to improve cybersecurity resilience by mitigating false positives and providing actionable intelligence through supervised learning algorithms. The KDD Cup 1999 dataset is used in the study to assess how well these models perform in simulating various network intrusions and regular traffic. The application of SMOTE significantly enhanced the performance of these models by addressing class imbalance, leading to improved detection accuracy. Furthermore, as supplementary methods for detecting malicious URLs and advanced persistent threats (APTs), edge-based machine learning and blockchain technology are investigated. This study addresses the shortcomings of conventional security systems and supports the growing demand for reliable threat detection in a world that is becoming more interconnected. It also advances the creation of more proactive and adaptable cybersecur

Related papers

• Multi-Agent Collaborative Intrusion Detection for Low-Altitude Economy IoT: An LLM-Enhanced Agentic AI Framework [60.72591149679355]
  The rapid expansion of low-altitude economy Internet of Things (LAE-IoT) networks has created unprecedented security challenges.<n>Traditional intrusion detection systems fail to tackle the unique characteristics of aerial IoT environments.<n>We introduce a large language model (LLM)-enabled agentic AI framework for enhancing intrusion detection in LAE-IoT networks.
  arXiv  Detail & Related papers  (2026-01-25T12:47:25Z)
• Leveraging Machine Learning for Botnet Attack Detection in Edge-Computing Assisted IoT Networks [0.34530027457862006]
  This paper investigates the application of machine learning techniques to enhance security in Edge-Computing-Assisted IoT environments.<n>It presents a comparative analysis of Random Forest, XGBoost, and LightGBM to address the dynamic and complex nature of botnet threats.<n>The results highlight the potential of machine learning to fortify IoT networks against emerging cybersecurity challenges.
  arXiv  Detail & Related papers  (2025-08-03T01:52:35Z)
• Towards Resilient Federated Learning in CyberEdge Networks: Recent Advances and Future Trends [20.469263896950437]
  We investigate the most recent techniques of resilient federated learning (ResFL) in CyberEdge networks.<n>We focus on joint training with agglomerative deduction and feature-oriented security mechanisms.<n>These advancements offer ultra-low latency, artificial intelligence (AI)-driven network management, and improved resilience against adversarial attacks.
  arXiv  Detail & Related papers  (2025-04-01T23:06:45Z)
• Intelligent IoT Attack Detection Design via ODLLM with Feature Ranking-based Knowledge Base [0.964942474860411]
  Internet of Things (IoT) devices have introduced significant cybersecurity challenges.<n>Traditional machine learning (ML) techniques often fall short in detecting such attacks due to the complexity of blended and evolving patterns.<n>We propose a novel framework leveraging On-Device Large Language Models (ODLLMs) augmented with fine-tuning and knowledge base (KB) integration for intelligent IoT network attack detection.
  arXiv  Detail & Related papers  (2025-03-27T16:41:57Z)
• Cyber Defense Reinvented: Large Language Models as Threat Intelligence Copilots [36.809323735351825]
  CYLENS is a cyber threat intelligence copilot powered by large language models (LLMs)<n>CYLENS is designed to assist security professionals throughout the entire threat management lifecycle.<n>It supports threat attribution, contextualization, detection, correlation, prioritization, and remediation.
  arXiv  Detail & Related papers  (2025-02-28T07:16:09Z)
• Hybrid Machine Learning Models for Intrusion Detection in IoT: Leveraging a Real-World IoT Dataset [0.0]
  Intrusion Detection Systems (IDS) are crucial for mitigating these threats.<n>Recent advancements in Machine Learning (ML) offer promising avenues for improvement.<n>This research explores a hybrid approach, combining several standalone ML models.
  arXiv  Detail & Related papers  (2025-02-17T23:41:10Z)
• Federated Learning-Driven Cybersecurity Framework for IoT Networks with Privacy-Preserving and Real-Time Threat Detection Capabilities [0.0]
  Traditional centralized security methods often struggle to balance privacy preservation and real-time threat detection in IoT networks.<n>This study proposes a Federated Learning-Driven Cybersecurity Framework designed specifically for IoT environments.<n>Secure aggregation of locally trained models is achieved using homomorphic encryption, allowing collaborative learning without exposing sensitive information.
  arXiv  Detail & Related papers  (2025-02-14T23:11:51Z)
• Countering Autonomous Cyber Threats [40.00865970939829]
  Foundation Models present dual-use concerns broadly and within the cyber domain specifically. Recent research has shown the potential for these advanced models to inform or independently execute offensive cyberspace operations. This work evaluates several state-of-the-art FMs on their ability to compromise machines in an isolated network and investigates defensive mechanisms to defeat such AI-powered attacks.
  arXiv  Detail & Related papers  (2024-10-23T22:46:44Z)
• Lightweight CNN-BiLSTM based Intrusion Detection Systems for Resource-Constrained IoT Devices [38.16309790239142]
  Intrusion Detection Systems (IDSs) have played a significant role in detecting and preventing cyber-attacks within traditional computing systems. The limited computational resources available on Internet of Things (IoT) devices make it challenging to deploy conventional computing-based IDSs. We propose a hybrid CNN architecture composed of a lightweight CNN and bidirectional LSTM (BiLSTM) to enhance the performance of IDS on the UNSW-NB15 dataset.
  arXiv  Detail & Related papers  (2024-06-04T20:36:21Z)
• Defense against ML-based Power Side-channel Attacks on DNN Accelerators with Adversarial Attacks [21.611341074006162]
  We present AIAShield, a novel defense methodology to safeguard FPGA-based AI accelerators. We leverage the prominent adversarial attack technique from the machine learning community to craft delicate noise. AIAShield outperforms existing solutions with excellent transferability.
  arXiv  Detail & Related papers  (2023-12-07T04:38:01Z)
• Blockchained Federated Learning for Threat Defense [0.0]
  This research paper introduces the development of an intelligent Threat Defense system, employing Federated Learning. The proposed framework combines Federated Learning for the distributed and continuously validated learning of the tracing algorithms. The aim of the proposed Framework is to intelligently classify smart cities networks traffic derived from Industrial IoT (IIoT) by Deep Content Inspection (DCI) methods.
  arXiv  Detail & Related papers  (2021-02-25T09:16:48Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.