A Two-Tiered Framework for Anomaly Classification in IoT Networks Utilizing CNN-BiLSTM Model

Abstract

The paper introduces ACS-IoT, an Anomaly Classification System for IoT networks, structured as a two-tiered framework. In the first, it employs a decision tree classifier for anomaly detection. In the second, a CNN-BiLSTM model is utilized for more profound analysis and classification of anomaly types. To address data imbalance, SMOTE is used, and feature selection is enhanced with PSO. The approach showcases strong practical applicability in real-world industrial settings, achieving an accuracy of 88%, precision of 89%, recall of 88%, and F1-score of 88% for multi-class classification, surpassing other machine learning approaches by at least 6% in all metrics.

Source: Exact author abstract from the publisher's CC BY 4.0 open-access version of record; verified on 2026-08-09.

Problem and motivation

IoT intrusion data are imbalanced and attack labels are heterogeneous. A single multi-class classifier can spend capacity distinguishing attack families before reliably screening ordinary traffic; a cascade can reduce that burden while retaining temporal flow information.

Method and contribution

The first tier is a decision-tree normal/anomaly screen and the second tier uses CNN-BiLSTM sequence modeling. Flows are represented from five-tuple information and prepared with SMOTE and particle-swarm-optimization feature selection. The evaluation uses IoTID20 and N-BaIoT; the latter covers nine devices, two botnets, and ten attack classes. The reported implementation uses a K80 GPU through Google Colab and compares the cascade with conventional alternatives.

Findings and evidence

For IoTID20, the detailed table reports approximately 91.87% accuracy, 89.91% precision, 90.70% recall, and 89.98% F1. For N-BaIoT, it reports approximately 90.12% accuracy, 89.87% precision, 90.21% recall, and 89.97% F1; the abstract rounds these results to about 88–90% depending on the metric summary. The results support the cascade on the selected labeled datasets, not detection of arbitrary unseen attacks.

Limitations and future directions

Limitations: The method depends on labeled, dataset-specific flow features, SMOTE, PSO selection, and the stated train/test protocol. It is not validated here against deployment drift, encrypted traffic, previously unseen attacks, adversarial feature manipulation, or the resource limits of an actual IoT gateway.

Future work: Use temporal and cross-device splits, evaluate unknown-attack rejection and calibration, quantify inference/training cost at the edge, and test continual learning and adversarial robustness on live IoT traffic.

Resources

• Code
• Demo

Sources and identifiers

• Published version published
• Open-access publisher PDF · PDF public_full_text

When to cite this paper

Cite this paper when evaluating a two-stage IoT detector that screens anomalies before CNN-BiLSTM attack classification.

• Decision-tree binary screening followed by CNN-BiLSTM classification.
• SMOTE and PSO feature selection over IoT flow features.
• The IoTID20 and N-BaIoT benchmark results.
• The labeled-data and unseen-attack generalization caveat.

Citation

@article{ezzatiJivan2024atwo,
  author = {Yue Guan and Morteza Noferesti and Naser Ezzati-Jivan},
  title = {A Two-Tiered Framework for Anomaly Classification in IoT Networks Utilizing CNN-BiLSTM Model},
  year = {2024},
  journal = {Software Impacts},
  volume = {20},
  pages = {100646},
  eid = {100646},
  publisher = {Elsevier BV},
  issn = {2665-9638},
  doi = {10.1016/j.simpa.2024.100646},
  url = {https://doi.org/10.1016/j.simpa.2024.100646}
}

Guan, Y., Noferesti, M., & Ezzati-Jivan, N. (2024). A Two-Tiered Framework for Anomaly Classification in IoT Networks Utilizing CNN-BiLSTM Model. Software Impacts, 20, 100646. https://doi.org/10.1016/j.simpa.2024.100646

Y. Guan, M. Noferesti, and N. Ezzati-Jivan, "A Two-Tiered Framework for Anomaly Classification in IoT Networks Utilizing CNN-BiLSTM Model," Software Impacts, vol. 20, Art. no. 100646, 2024, doi: 10.1016/j.simpa.2024.100646