PT-TrafficAnalyzer: A weighted ensemble prediction tree for IoT attack detection


ARSLAN R. S.

Internet of Things (The Netherlands), cilt.36, 2026 (SCI-Expanded, Scopus) identifier

  • Yayın Türü: Makale / Tam Makale
  • Cilt numarası: 36
  • Basım Tarihi: 2026
  • Doi Numarası: 10.1016/j.iot.2026.101874
  • Dergi Adı: Internet of Things (The Netherlands)
  • Derginin Tarandığı İndeksler: Science Citation Index Expanded (SCI-EXPANDED), Scopus
  • Anahtar Kelimeler: CICIoT2023, Cybersecurity, Internet of Things (IoT), Intrusion detection, Prediction Tree, Weighted hard voting ensemble
  • Kayseri Üniversitesi Adresli: Evet

Özet

The Internet of Things has a network structure that is vulnerable to cyberattacks and susceptible to attackers. Ensuring the privacy of organizations and individuals is a crucial issue in IoT networks, where sensitive data is transmitted and various types of attacks are prevalent. The importance of Intrusion Detection Systems (IDS) in detecting attacks and infiltration attempts on IoT networks is increasing daily. In this way, it will contribute to the resistance against attackers and the spread of this modern technology. In this study, Prediction Tree Traffic Analyzer (PT-TAnalyzer), an IDS system capable of detecting and classifying attacks on IoT networks, is proposed. PT-TAnalyzer features an ensemble model structure, where weighting is determined by the validation scores of machine learning models, and a prediction tree comprising eight ensemble models trained on the CIC-IoT-2023 dataset. This proposed model detects 34 attack types (including 33 malicious and one benign) with high success rates, due to its unique attack-detection approach, and does so efficiently and cost-effectively. Unlike traditional studies, it achieves this by using eight trained models rather than classifying all attacks with a single model and a single prediction structure within the tree architecture. In the tests performed, PT-TAnalyzer achieved 99.76 % accuracy in the binary classification experiment (Benign vs. Malicious) and 98.70 % accuracy in the 34-class experiment, yielding a similar F1 Score. The test time per sample is less than 0.1 ms. Compared with previous frameworks using the same dataset, PT-TAnalyzer shows a 2 % improvement in overall accuracy and a lower processing time. In practice, the proposed model can be deployed on IoT gateways or edge devices to provide real-time, low-cost, and scalable intrusion detection capabilities. The model outperforms previous studies using the same dataset, while also addressing the limitations.