Toward AI-driven IoT cybersecurity: A preprocessing framework for benchmark datasets

  1. Martinez-Fuentes, Virginia 1
  2. Arroyo, Angel 1
  3. Granados López, Diego 1
  4. Herrero, Alvaro 1
  1. 1 Universidad de Burgos
    info
    Universidad de Burgos

    Burgos, España

    ROR https://ror.org/049da5t36

    Geographic location of the organization Universidad de Burgos
Journal:
International Journal of Information Security

ISSN: 1615-5270

Year of publication: 2026

Volume: 25

Issue: 2

Type: Article

DOI: 10.1007/S10207-026-01235-Z GOOGLE SCHOLAR lock_openOpen access editor

More publications in: International Journal of Information Security

Sustainable development goals

info

SDG classification obtained using Aurora SDG artificial intelligence model.

Abstract

The rapid expansion of Internet of Things (IoT) systems, found in environments such as smart homes, poses growing cybersecurity challenges. In response, research has examined the role of artificial intelligence, particularly machine learning, in enhancing IoT security. To support this effort, machine learning models have been developed and evaluated on benchmark datasets. However, preparing datasets for machine learning requires preprocessing techniques that are tailored to the specific characteristics of the data. In this context, exploratory data analysis provides insights into dataset structure and distribution, thereby supporting informed preprocessing decisions prior to modeling. Accordingly, this study introduces a reproducible five-step preprocessing framework for IoT cybersecurity datasets and demonstrates its application to the NF-ToN-IoT V1 dataset. The proposed framework is organized into two phases: an exploratory data analysis phase consisting of (1) dataset overview and identification of categorical and numerical features, (2) analysis of missing and zero values, (3) assessment of categorical feature distributions, and (4) assessment of numerical feature distributions; and a preprocessing phase consisting of (5) proportional stratified random downsampling to produce a reduced dataset that preserves the original class distribution. By establishing a systematic, data-driven framework, this study contributes to the preparation of structured datasets for attack detection in IoT environments, with potential applications in smart homes.

Funding information

Funders

Bibliographic References

  • Fortino, G., Savaglio, C., Spezzano, G., Zhou, M.: Internet of Things as System of Systems: a Review of Methodologies, Frameworks, Platforms, and Tools. IEEE Trans. Syst. Man Cybern. Syst. 51(1), 223 (2021). https://doi.org/10.1109/TSMC.2020.3042898
  • IEEE Standard for an Architectural Framework for the Internet of Things (IoT) (IEEE Std 2413–2019). IEEE Std 2413–2019 (2020). https://doi.org/10.1109/IEEESTD.2020.9032420
  • Li, W., Yigitcanlar, T., Erol, I., Liu, A.: Motivations, barriers and risks of smart home adoption: from systematic literature review to conceptual framework. Energy Res. Soc. Sci. 80, 102211 (2021). https://doi.org/10.1016/j.erss.2021.102211
  • Statista Research Department. Penetration rate of smart homes worldwide 2019–2028. https://www.statista.com/forecasts/887636/penetration-rate-of-smart-homes-in-the-world (2025). Accessed: 29 October 2025
  • Vailshery, L.S.: Number of Internet of Things (IoT) connections worldwide from 2022 to 2023, with forecasts from 2024 to 2034 (in billions). https://www.statista.com/statistics/1183457/iot-connected-devices-worldwide (2025). Accessed: 29 October 2025
  • Cybersecurity - EUR-Lex - European Union. https://eur-lex.europa.eu/EN/legal-content/glossary/cybersecurity.html (n.d). Accessed: 29 October 2025
  • ENISA Reference Incident Classification Taxonomy. https://www.enisa.europa.eu/publications/reference-incident-classification-taxonomy (2018). Accessed: 29 October 2025
  • Alaeifar, P., Pal, S., Jadidi, Z., Hussain, M., Foo, E.: Current approaches and future directions for cyber threat intelligence. J. Inf. Secur. Appl. 83, 103786 (2024). https://doi.org/10.1016/j.jisa.2024.103786
  • Kaur, R., Gabrijelčič, D., Klobučar, T.: Artificial intelligence for cybersecurity: literature review and future research directions. Inform. Fusion 97, 101804 (2023). https://doi.org/10.1016/j.inffus.2023.101804
  • Sarker, I.H., Khan, A.I., Abushark, Y.B., Alsolami, F.: Internet of things (IoT) security intelligence: a comprehensive overview, machine learning solutions and research directions. Mobile Netw. Appl. 28, 296 (2023). https://doi.org/10.1007/s11036-022-01937-3
  • Gil-Fuster, E., Eisert, J., Bravo-Prieto, C.: Understanding quantum machine learning also requires rethinking generalization. Nat. Commun. 15(1), 2277 (2024). https://doi.org/10.1038/s41467-024-45882-z
  • Yu, L., Xie, W., Xie, D., Zou, Y., Zhang, D., Sun, Z., Zhang, L., Zhang, Y., Jiang, T.: Deep reinforcement learning for smart home energy management. IEEE Internet Things J. 7(4), 2751 (2020). https://doi.org/10.1109/JIOT.2019.2957289
  • Nguyen, T.T., Reddi, V.J.: Deep reinforcement learning for cyber security. IEEE Trans. Neural Netw. Learn. Syst. 34(8), 3779 (2023). https://doi.org/10.1109/TNNLS.2021.3121870
  • Moustafa, N., Turnbull, B., Choo, K.K.R.: An ensemble intrusion detection technique based on proposed statistical flow features for protecting network traffic of internet of things. IEEE Internet Things J. 6(3), 4815 (2019). https://doi.org/10.1109/JIOT.2018.2871719
  • Ebrahimi, F., Javidan, R., Akbari, R., Hosseini, Y.: Intrusion detection in the internet of things using convolutional neural networks: an explainable AI approach. Cybersecurity 8(1), 66 (2025). https://doi.org/10.1186/s42400-025-00369-2
  • Arisdakessian, S., Wahab, O.A., Mourad, A., Otrok, H., Guizani, M.: A survey on IoT intrusion detection: federated learning, game theory, social psychology, and explainable AI as future directions. IEEE Internet Things J. 10(5), 4059 (2023). https://doi.org/10.1109/JIOT.2022.3203249
  • Sarker, I.H.: Data science and analytics: an overview from data-driven smart computing. Decision-Making Appl. Perspective SN Compu. Sci. 2, 377 (2021). https://doi.org/10.1007/s42979-021-00765-8
  • Klein, C.: Exploratory analysis and the expected value of experimentation. Philos. Sci. 91(5), 1109 (2023). https://doi.org/10.1017/psa.2023.116
  • Sarhan, M., Layeghy, S., Moustafa, N., Portmann, M.: NetFlow Datasets for Machine Learning-Based Network Intrusion Detection Systems, In: Big Data Technologies and Applications, ed. by D. Zeng, H. Huang, R. Hou, S. Rho, N. Chilamkurti (Springer International Publishing, 2021), pp. 117–135. DOI: https://doi.org/10.1007/978-3-030-72802-1_9
  • HaddadPajouh, H., Dehghantanha, A., Parizi, R.M., Aledhari, M., Karimipour, H.: A survey on internet of things security: requirements, challenges, and solutions. Internet Things 14, 100129 (2021). https://doi.org/10.1016/j.iot.2019.100129
  • Bikila, D.D., Čapek, J.: Machine learning-based attack detection for the internet of things. Futur. Gener. Comput. Syst. 166, 107630 (2025). https://doi.org/10.1016/j.future.2024.107630
  • Khraisat, A., Gondal, I., Vamplew, P., Kamruzzaman, J.: Survey of intrusion detection systems: techniques, datasets and challenges. Cybersecurity 2(1), 1–22 (2019). https://doi.org/10.1186/s42400-019-0038-7
  • Saba, T., Rehman, A., Sadad, T., Kolivand, H., Bahaj, S.A.: Anomaly-based intrusion detection system for IoT networks through deep learning Model. Comput. Electr. Eng. 99, 107810 (2022). https://doi.org/10.1016/j.compeleceng.2022.107810
  • Wang, M., Yang, N., Weng, N.: Securing a smart home with a transformer-based IoT intrusion detection system. Electronics 12(9), 2100 (2023). https://doi.org/10.3390/electronics12092100
  • ntop nProbe User’s Guide: NetFlow v9 Format Reference (IPFIX – RFC 3917). https://www.ntop.org/guides/nprobe/flow_information_elements.html (2022). Accessed: 29 October 2025
  • Paparis, G., Zarras, A., Farao, A., Xenakis, C.: CRASHED: cyber risk assessment for smart home electronic devices. J. Inform. Secur. Appl. 91, 104054 (2025). https://doi.org/10.1016/j.jisa.2025.104054
  • Thakkar, A., Lohiya, R.: A review on machine learning and deep learning perspectives of IDS for IoT: recent updates. Secur. Issues Challeng. Archives Comput. Methods Eng. 28, 3211 (2021). https://doi.org/10.1007/s11831-020-09496-0
  • Araya, J.I.I., Rifà-Pous, H.: Anomaly-based cyberattacks detection for smart homes: a systematic literature review. Internet Things 22, 100792 (2023). https://doi.org/10.1016/j.iot.2023.100792
  • Anthi, E., Williams, L., Słowińska, M., Theodorakopoulos, G., Burnap, P.: A supervised intrusion detection system for smart home IoT devices. IEEE Internet Things J. 6(5), 9042 (2019). https://doi.org/10.1109/JIOT.2019.2926365
  • Pramilarani, K., Kumari, P.V.: Cost based random forest classifier for intrusion detection system in internet of things. Appl. Soft Comput. 151, 111125 (2024). https://doi.org/10.1016/j.asoc.2023.111125
  • Rahman, M.M., Bouhafs, F., Hoseini, S.A., den Hartog, F., HomeNet, U.N.S.W.: A network traffic flow dataset for AI-based smart home device classification. Comput. Ind. Eng. 204, 111041 (2025). https://doi.org/10.1016/j.cie.2025.111041
  • Alsaedi, A., Moustafa, N., Tari, Z., Mahmood, A., Anwar, A.: TON_IoT telemetry dataset: a new generation dataset of IoT and IIoT for data-driven intrusion detection systems. IEEE Access 8, 165130 (2020). https://doi.org/10.1109/ACCESS.2020.3022862
  • Moustafa, N.: A new distributed architecture for evaluating AI-based security systems at the edge: network TON_IoT datasets. Sustain. Cities Soc. 72, 102994 (2021). https://doi.org/10.1016/j.scs.2021.102994
  • Ferrag, M.A., Friha, O., Hamouda, D., Maglaras, L., Janicke, H.: Edge-IIoTset: a new comprehensive realistic cyber security dataset of IoT and IIoT applications for centralized and federated learning. IEEE Access 10, 40281 (2022). https://doi.org/10.1109/ACCESS.2022.3165809
  • Neto, E.C.P., Dadkhah, S., Ferreira, R., Zohourian, A., Lu, R., Ghorbani, A.A.: CICIoT2023: a real-time dataset and benchmark for large-scale attacks in IoT environment. Sensors 23(13), 5941 (2023). https://doi.org/10.3390/s23135941
  • Moustafa, N.: A Systemic IoT-Fog-Cloud Architecture for Big-Data Analytics and Cyber Security Systems: a Review of Fog Computing. arXiv preprint arXiv:1906.01055 [cs.CR], Cornell University (2019). https://doi.org/10.48550/arXiv.1906.01055
  • Moustafa, N.: New Generations of Internet of Things Datasets for Cybersecurity Applications based Machine Learning: TON_IoT Datasets. Proceedings of the eResearch Australasia Conference, Brisbane, Australia. https://conference.eresearch.edu.au/wp-content/uploads/2019/08/2019_eResearch_59_New-Generations-of-Internet-of Things-Datasets-for-Cybersecurity.pdf, slides available at https://conference.eresearch.edu.au/wp-content/uploads/2019/11/Presentation_Nour_-123-Moustafa-Nour.pdf (2019). Accessed: 30 October 2025
  • Moustafa, N., Ahmed, M., Ahmed, S.: Data Analytics-Enabled Intrusion Detection: Evaluations of ToN_IoT Linux Datasets, In: Proceedings of the 2020 IEEE 19th International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom) (2020), pp. 727–735. https://doi.org/10.1109/TrustCom50675.2020.00100
  • Moustafa, N., Keshk, M., Debie, E., Janicke, H.: Federated ToN_IoT Windows Datasets for Evaluating AI-Based Security Applications, In: Proceedings of the 2020 IEEE 19th International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom) (2020), pp. 848–855. doi: https://doi.org/10.1109/TrustCom50675.2020.00114
  • Ashraf, J., Keshk, M., Moustafa, N., Abdel-Basset, M., Khurshid, H., Bakhshi, A.D., Mostafa, R.R.: IoTBoT-IDS: a novel statistical learning-enabled botnet detection framework for protecting networks of smart cities. Sustain. Cities Soc. 74, 103041 (2021). https://doi.org/10.1016/j.scs.2021.103041
  • Booij, T.M., Chiscop, I., Meeuwissen, E., Moustafa, N., Hartog, F.T.H.D.: ToN_IoT: the role of heterogeneity and the need for standardization of features and attack types in IoT network intrusion data sets. IEEE Internet Things J. 9(1), 485 (2022). https://doi.org/10.1109/JIOT.2021.3085194
  • Li, J., Othman, M.S., Chen, H., Yusuf, L.M.: Optimizing IoT intrusion detection system: feature selection versus feature extraction in machine learning. J. Big Data 11(1), 36 (2024). https://doi.org/10.1186/s40537-024-00892-y
  • Sarhan, M., Layeghy, S., Moustafa, N., Gallagher, M., Portmann, M.: Feature extraction for machine learning-based intrusion detection in IoT networks. Digital Commun. Netw. 10(1), 205 (2024). https://doi.org/10.1016/j.dcan.2022.08.012
  • Tareq, I., Elbagoury, B.M., El-Regaily, S., El-Horbaty, E.S.M.: Analysis of ToN-IoT, UNSW-NB15, and Edge-IIoT Datasets Using DL in Cybersecurity for IoT. Appl. Sci. 12(19), 9572 (2022). https://doi.org/10.3390/app12199572
  • Alshehri, J., Alhamed, A., Frikha, M., Rahman, M.M.H.: Comparison of Machine Learning Algorithms for Malware Detection Using EDGE-IIoTset Dataset in IoT, International Journal of Advanced Computer Science and Applications 16(1) (2025). DOI: https://doi.org/10.14569/IJACSA.2025.01601118
  • Becerra-Suarez, F.L., Tuesta-Monteza, V.A., Mejia-Cabrera, H.I., Arcila-Diaz, J.: Performance evaluation of deep learning models for classifying cybersecurity attacks in IoT networks. Informatics 11(2), 32 (2024). https://doi.org/10.3390/informatics11020032
  • Duarte, J.D., Bispo, G.D., Rodrigues, G.A.P., Serrano, A.L.M., Saiki, G.M., Gonçalves, V.P.: Synthetic minority over-sampling technique for detecting malicious traffic targeting internet of things’ devices. J. Internet Services Appl. 16(1), 332 (2025). https://doi.org/10.5753/jisa.2025.5251
  • Portmann, M.: Machine Learning-Based NIDS Datasets. https://staff.itee.uq.edu.au/marius/NIDS_datasets (2020). Accessed: 30 October 2025
  • Ayad, A.G., Sakr, N.A., Hikal, N.A.: A Hybrid approach for efficient feature selection in anomaly intrusion detection for IoT networks. J. Supercomput. 80, 26942 (2024). https://doi.org/10.1007/s11227-024-06409-x
  • Ozdogan, E.: A comprehensive analysis of the machine learning algorithms in IoT IDS systems. IEEE Access 12, 46785 (2024). https://doi.org/10.1109/ACCESS.2024.3382539
  • Eren, K.K., Küçük, K., Özyurt, F., Alhazmi, O.H.: Simple yet powerful: machine learning-based IoT intrusion system With smart preprocessing and feature generation rivals deep learning. IEEE Access 13, 41435 (2025). https://doi.org/10.1109/ACCESS.2025.3547642
  • Chen, W., Yang, K., Yu, Z., Shi, Y., Chen, C.L.P.: A survey on imbalanced learning: latest research, applications and future directions. Artif. Intell. Rev. 57, 137 (2024). https://doi.org/10.1007/s10462-024-10759-6
  • Vargas, V.W.D., Aranda, J.A.S., Costa, R.D.S., Pereira, P.R.D.S., Barbosa, J.L.V.: Imbalanced data preprocessing techniques for machine learning: a systematic mapping study. Knowl. Inf. Syst. 65, 31 (2023). https://doi.org/10.1007/s10115-022-01772-8
  • Martinez-Fuentes, V., Granados López, D., Arroyo, A., Herrero, A.: Downsampled NF-ToN-IoT V1 Dataset. University of Burgos Repository (RIUBU) (2025). https://doi.org/10.71486/wyx0-x933