{
  "schema_version": "0.6.0",
  "paper_id": "iot-anomaly-classification-cnn-bilstm-two-tiered",
  "page_url": "https://threadslab.org/research-publications/papers/iot-anomaly-classification-cnn-bilstm-two-tiered/",
  "title": "A Two-Tiered Framework for Anomaly Classification in IoT Networks Utilizing CNN-BiLSTM Model",
  "title_variants": [],
  "authors": [
    "Yue Guan",
    "Morteza Noferesti",
    "Naser Ezzati-Jivan"
  ],
  "author_details": [
    {
      "name": "Yue Guan",
      "orcid": null,
      "profile_url": "https://dblp.org/pid/54/7820.html"
    },
    {
      "name": "Morteza Noferesti",
      "orcid": "https://orcid.org/0009-0000-5507-1461",
      "profile_url": "https://dblp.org/pid/82/10462.html"
    },
    {
      "name": "Naser Ezzati-Jivan",
      "orcid": "https://orcid.org/0000-0003-1435-6297",
      "profile_url": "https://threadslab.org/"
    }
  ],
  "publication": {
    "year": 2024,
    "venue": "Software Impacts",
    "type": "journal article",
    "publication_date": "2024-05",
    "online_date": null,
    "print_date": "2024-05",
    "volume": "20",
    "issue": null,
    "pages": "100646",
    "article_number": "100646",
    "publisher": "Elsevier BV",
    "issn": [
      "2665-9638"
    ],
    "isbn": [],
    "crossref_type": "journal-article"
  },
  "publication_type": "journal article",
  "status": "published_with_public_full_text",
  "canonical_source_url": "https://doi.org/10.1016/j.simpa.2024.100646",
  "source_record_id": "a-two-tiered-framework-for-anomaly-classification-in-iot-networks-utilizing-cnn-bilstm-model-1f6844c5dc",
  "identifiers": {
    "doi": "10.1016/j.simpa.2024.100646"
  },
  "abstract": "The paper introduces ACS-IoT, an Anomaly Classification System for IoT networks, structured as a two-tiered framework. In the first, it employs a decision tree classifier for anomaly detection. In the second, a CNN-BiLSTM model is utilized for more profound analysis and classification of anomaly types. To address data imbalance, SMOTE is used, and feature selection is enhanced with PSO. The approach showcases strong practical applicability in real-world industrial settings, achieving an accuracy of 88%, precision of 89%, recall of 88%, and F1-score of 88% for multi-class classification, surpassing other machine learning approaches by at least 6% in all metrics.",
  "abstract_source": "Exact author abstract from the publisher's CC BY 4.0 open-access version of record; verified on 2026-08-09.",
  "abstract_available": true,
  "scholar_eligibility": {
    "eligible": true,
    "basis": "complete-visible-author-abstract",
    "note": "The page displays the complete verified author abstract."
  },
  "description": "The paper introduces ACS-IoT, an Anomaly Classification System for IoT networks, structured as a two-tiered framework. In the first, it employs a decision tree classifier for anomaly detection. In the second, a CNN-BiLSTM model is utilized for more profound analysis and classification of anomaly types. To address data imbalance, SMOTE is used, and feature selection is enhanced with PSO. The approach showcases strong practical applicability in real-world industrial settings, achieving an accuracy of 88%, precision of 89%, recall of 88%, and F1-score of 88% for multi-class classification, surpassing other machine learning approaches by at least 6% in all metrics.",
  "evidence_level": "full-text-reviewed",
  "evidence": {
    "source_basis": "full-text-reviewed",
    "coverage": "material paper sections",
    "summary_origin": "AI-assisted catalog editorial summary",
    "review_status": "catalog-reviewed; paper-author approval pending",
    "verified_on": "2026-08-26",
    "sources": [
      {
        "note": "Local PDF reviewed, including two-tier architecture, preprocessing, IoTID20/N-BaIoT datasets, and metric tables"
      },
      {
        "note": "ScienceDirect article DOI: https://doi.org/10.1016/j.simpa.2024.100646"
      },
      {
        "note": "ScienceDirect record: https://www.sciencedirect.com/science/article/pii/S2665963824000904"
      }
    ]
  },
  "summary": {
    "core_contribution": "The paper proposes a two-tier IoT intrusion detector that first separates normal from anomalous flows and then classifies the attack type with a CNN-BiLSTM model.",
    "problem": "IoT intrusion data are imbalanced and attack labels are heterogeneous. A single multi-class classifier can spend capacity distinguishing attack families before reliably screening ordinary traffic; a cascade can reduce that burden while retaining temporal flow information.",
    "method": "The first tier is a decision-tree normal/anomaly screen and the second tier uses CNN-BiLSTM sequence modeling. Flows are represented from five-tuple information and prepared with SMOTE and particle-swarm-optimization feature selection. The evaluation uses IoTID20 and N-BaIoT; the latter covers nine devices, two botnets, and ten attack classes. The reported implementation uses a K80 GPU through Google Colab and compares the cascade with conventional alternatives.",
    "findings": "For IoTID20, the detailed table reports approximately 91.87% accuracy, 89.91% precision, 90.70% recall, and 89.98% F1. For N-BaIoT, it reports approximately 90.12% accuracy, 89.87% precision, 90.21% recall, and 89.97% F1; the abstract rounds these results to about 88–90% depending on the metric summary. The results support the cascade on the selected labeled datasets, not detection of arbitrary unseen attacks.",
    "limitations": "The method depends on labeled, dataset-specific flow features, SMOTE, PSO selection, and the stated train/test protocol. It is not validated here against deployment drift, encrypted traffic, previously unseen attacks, adversarial feature manipulation, or the resource limits of an actual IoT gateway.",
    "future_work": "Use temporal and cross-device splits, evaluate unknown-attack rejection and calibration, quantify inference/training cost at the edge, and test continual learning and adversarial robustness on live IoT traffic."
  },
  "tags": [
    "iot-security",
    "anomaly-detection",
    "machine-learning",
    "deep-learning-systems"
  ],
  "keywords": [
    "IoT anomaly detection",
    "CNN-BiLSTM",
    "SMOTE",
    "particle swarm optimization",
    "PSO",
    "Software Impacts",
    "classification"
  ],
  "versions": [
    {
      "id": "published-version",
      "label": "Published version",
      "relation": "version-of-record",
      "title": "A Two-Tiered Framework for Anomaly Classification in IoT Networks Utilizing CNN-BiLSTM Model",
      "url": "https://doi.org/10.1016/j.simpa.2024.100646",
      "pdf_url": null,
      "status": "published",
      "canonical_for_citation": true
    },
    {
      "id": "open-access-publisher-pdf",
      "label": "Open-access publisher PDF",
      "relation": "source-record",
      "title": "A Two-Tiered Framework for Anomaly Classification in IoT Networks Utilizing CNN-BiLSTM Model",
      "url": "https://www.sciencedirect.com/science/article/pii/S2665963824000344/pdfft?isDTMRedir=true&download=true",
      "pdf_url": "https://www.sciencedirect.com/science/article/pii/S2665963824000344/pdfft?isDTMRedir=true&download=true",
      "status": "public_full_text",
      "canonical_for_citation": false
    }
  ],
  "access": {
    "status": "published_with_public_full_text",
    "note": "The publisher's version of record is open access under CC BY 4.0. The direct PDF is externally linked and is not redistributed here; detailed enrichment remains abstract-grounded until the full article is locally reviewed.",
    "license": "CC BY 4.0"
  },
  "resources": {
    "code": "https://github.com/SoftwareImpacts/SIMPAC-2023-463",
    "data": null,
    "slides": null,
    "demo": "https://codeocean.com/capsule/8351293/tree/v1"
  },
  "citation_guidance": {
    "when_to_cite": "Cite this paper when evaluating a two-stage IoT detector that screens anomalies before CNN-BiLSTM attack classification.",
    "points": [
      "Decision-tree binary screening followed by CNN-BiLSTM classification.",
      "SMOTE and PSO feature selection over IoT flow features.",
      "The IoTID20 and N-BaIoT benchmark results.",
      "The labeled-data and unseen-attack generalization caveat."
    ],
    "canonical_version_id": "published-version"
  },
  "provenance": {
    "metadata_verified_on": "2026-08-26",
    "metadata_source": [
      "Local PDF reviewed, including two-tier architecture, preprocessing, IoTID20/N-BaIoT datasets, and metric tables",
      "ScienceDirect article DOI: https://doi.org/10.1016/j.simpa.2024.100646",
      "ScienceDirect record: https://www.sciencedirect.com/science/article/pii/S2665963824000904"
    ],
    "summary_written_by": "AI-assisted",
    "summary_verified_by": "full-text-grounded catalog review; author approval pending",
    "linked_preprint_record": null,
    "author_order_note": null
  },
  "batch": {
    "phase": 2,
    "batch_label": "expanded forty-paper release",
    "status": "included_in_expanded_catalog",
    "selected_at": "2026-08-28"
  }
}