Ensembles within Ensembles: Nested Boosting and Stacking for Smart-Home IoT Intrusion Detection

Tarfa Hamed

Abstract


Smart home networks connect many low-cost IoT devices that exchange traffic continuously. This is a very attractive target for attackers and a difficult setting for intrusion detection. In this paper we investigate a hierarchical dependent ensemble approach in which one dependent ensemble algorithm is nested inside another. Three algorithms, AdaBoostM1, MultiBoostAB, and Stacking, were combined in all six possible outer-inner configurations and evaluated in WEKA on the DS2OS smart home traffic dataset using stratified 3-fold cross-validation, with the dataset's naturally imbalanced class distribution left intact. Five of the six configurations reached near-perfect results, with accuracy between 99.9964% and 99.9997%, Kappa between 0.9993 and 0.9999, and a false alarm rate of effectively zero. The AdaBoostM1→MultiBoostAB configuration, which relied on OneR rather than J48 as its weak learner, achieved 99.11% accuracy and a Kappa of 0.837, and it failed to detect the Data Type Probing and Wrong Setup classes altogether. Confusion matrix analysis showed that the nesting order of the ensembles had little effect on detection once the base classifier was held constant, whereas the choice of weak learner had a large one. Configurations with Stacking as the outer ensemble were also the fastest to train. Finally, we show that the near-ceiling scores are likely inflated by device-identifier attributes in DS2OS and discuss what this means for how intrusion detection results on this dataset should be reported and interpreted.

Keywords


AdaBoostM1; ensemble learning; Internet of Things (IoT); intrusion detection; MultiBoostAB; stacking

Full Text:

PDF

References


A. Kadam and P. S. Lokhande, “Design of an Intrusion Detection Model for IoT-Enabled Smart Home,” SSRN Electronic Journal, 2024, DOI: 10.2139/ssrn.4833390.

M. Amru et al., “Network Intrusion Detection System by Applying Ensemble Model for Smart Home,” International Journal of Electrical and Computer Engineering, Vol. 14, No. 3, pp. 3485–3494, 2024, DOI: 10.11591/ijece.v14i3.pp3485-3494.

Y. Cao, Z. Wang, H. Ding, J. Zhang, and B. Li, “An Intrusion Detection System based on Stacked Ensemble Learning for IoT Network,” Computers and Electrical Engineering, Vol. 110, Art. No. 108836, 2023, DOI: 10.1016/j.compeleceng.2023.108836.

D. Rani, N. S. Gill, P. Gulia, and J. M. Chatterjee, “An Ensemble-based Multiclass Classifier for Intrusion Detection using Internet of Things,” Computational Intelligence and Neuroscience, Vol. 2022, No. 1, Art. No. 1668676, 2022, DOI: 10.1155/2022/1668676.

N. U. Sama, S. Ullah, S. M. A. Kazmi, and M. Mazzara, “Cutting-Edge Intrusion Detection in IoT Networks: A Focus on Ensemble Models,” IEEE Access, Vol. 13, pp. 8375–8392, 2025, DOI: 10.1109/ACCESS.2024.3491831.

D. V. Premalatha and S. Ramanujam, “Ensemble-based Intrusion Detection for IoT Networks using the CICIoT2023 Dataset,” Journal of Information Systems Engineering and Management, Vol. 10, No. 21s, pp. 743–755, 2025, DOI: 10.52783/jisem.v10i21s.3407.

R. Lazzarini, H. Tianfield, and V. Charissis, “A Stacking Ensemble of Deep Learning Models for IoT Intrusion Detection,” Knowledge-based Systems, Vol. 279, Art. No. 110941, 2023, DOI: 10.1016/j.knosys.2023.110941.

Z. Zheng, W. Gai, P. Zhang, and M. Zhou, “Enhancing Feature Selection in IoT Intrusion Detection using the Ensemble Stacking,” in 2024 IEEE International Symposium on Parallel and Distributed Processing with Applications (ISPA), 2024, pp. 2151–2156, DOI: 10.1109/ISPA63168.2024.00293.

M. Tawfik, “Optimized Intrusion Detection in IoT and Fog Computing using Ensemble Learning and Advanced Feature Selection,” PLoS ONE, Vol. 19, No. 8, Art. No. e0304082, 2024, DOI: 10.1371/journal.pone.0304082.

A. Aldaej, I. Ullah, T. A. Ahanger, and M. Atiquzzaman, “Ensemble Technique of Intrusion Detection for IoT-Edge Platform,” Scientific Reports, Vol. 14, No. 1, Art. No. 11703, 2024, DOI: 10.1038/s41598-024-62435-y.

Y. Freund and R. E. Schapire, “Experiments with a New Boosting Algorithm,” in Proceedings of the 13th International Conference on Machine Learning (ICML), Bari, Italy, 1996, pp. 148–156, DOI: 10.5555/3091696.3091715.

G. I. Webb, “MultiBoosting: A Technique for Combining Boosting and Wagging,” Machine Learning, Vol. 40, No. 2, pp. 159–196, 2000, DOI: 10.1023/A:1007659514849.

D. H. Wolpert, “Stacked generalization,” Neural Networks, Vol. 5, No. 2, pp. 241–259, 1992, DOI: 10.1016/S0893-6080(05)80023-1.

S. H. Rafique, A. Abdallah, N. S. Musa, and T. Murugan, “Machine Learning and Deep Learning Techniques for Internet of Things Network Anomaly Detection-Current Research Trends,” Sensors, Vol. 24, No. 6, Art. No. 1968, 2024, DOI: 10.3390/s24061968.

S. Cheng and X. Feng, “Ensemble-based Detection of Distributed Denial-of-Service Attacks in IoT Networks using Majority Decision Mechanisms,” Scientific Reports, Vol. 16, Art. No. 10886, 2026, DOI: 10.1038/s41598-025-23638-z.




DOI: https://doi.org/10.32520/stmsi.v15i10.7012

Article Metrics

Abstract view : 0 times
PDF - 0 times

Refbacks

  • There are currently no refbacks.


Creative Commons License
This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License.