Hybrid Autoencoder and Isolation Forest for IoT Anomaly Detection with a Novel Model
Received: 3 October 2025 | Revised: 17 October 2025, 30 October 2025, and 3 November 2025 | Accepted: 6 November 2025 | Online: 3 December 2025
Corresponding author: Mohamed Bachar
Abstract
Securing the Internet of Things (IoT) in everyday life remains a significant challenge, which makes anomaly detection in these devices both important and necessary. In this work, we propose a hybrid approach that employs Autoencoders (AEs) for feature extraction and Isolation Forest (IF) for anomaly identification. To address errors caused by variations in sensor data, we further introduce a whitening method, which normalizes input features before detection. Experiments on the CIC IOT-DIAD 2024 dataset show that the hybrid AE+IF method achieves an accuracy of 0.98, outperforming either technique used independently. Incorporating covariance information through the whitening method further improves performance to an accuracy of 0.99. We compared the results with other datasets, such as N-BaIoT, TON_IoT, and UNSW-NB15, and observed that the model also delivers good performance on these datasets. Overall, the study provides a practical and interpretable framework that can be scaled for deployment in real IoT environments.
Keywords:
Internet of Things (IoT), artificial intelligence, cybersecurity, cyberattacks, machine learning, deep learning, anomaly detectionDownloads
References
M. Raj et al., "A survey on the role of Internet of Things for adopting and promoting Agriculture 4.0," Journal of Network and Computer Applications, vol. 187, Aug. 2021, Art. no. 103107. DOI: https://doi.org/10.1016/j.jnca.2021.103107
M. Bachar, A. Khiat, and A. Bahnasse, "A Comparative Study Between Solutions Proposed to Secure IoT Networks," in 2025 International Conference on Circuit, Systems and Communication, Fez, Morocco, 2025, pp. 1–7. DOI: https://doi.org/10.1109/ICCSC66714.2025.11135134
M. Fahim and A. Sillitti, "Anomaly Detection, Analysis and Prediction Techniques in IoT Environment: A Systematic Literature Review," IEEE Access, vol. 7, pp. 81664–81681, 2019. DOI: https://doi.org/10.1109/ACCESS.2019.2921912
M. A. Alqarni and S. H. Chauhdary, "A Security Scheme for Statistical Anomaly Detection and the Mitigation of Rank Attacks in RPL Networks (IoT Environment)," Engineering, Technology & Applied Science Research, vol. 13, no. 6, pp. 12409–12414, Dec. 2023. DOI: https://doi.org/10.48084/etasr.6433
F. Giannoni, M. Mancini, and F. Marinelli, "Anomaly Detection Models for IoT Time Series Data." arXiv, Nov. 30, 2018.
A. Vafaei Sadr, B. A. Bassett, and M. Kunz, "A flexible framework for anomaly Detection via dimensionality reduction," Neural Computing and Applications, vol. 35, no. 2, pp. 1157–1167, Jan. 2023. DOI: https://doi.org/10.1007/s00521-021-05839-5
A. Diro, N. Chilamkurti, V.-D. Nguyen, and W. Heyne, "A Comprehensive Study of Anomaly Detection Schemes in IoT Networks Using Machine Learning Algorithms," Sensors, vol. 21, no. 24, Dec. 2021, Art. no. 8320. DOI: https://doi.org/10.3390/s21248320
M. Almansoori and M. Telek, "Anomaly Detection using combination of Autoencoder and Isolation Forest," in 1st Workshop on Intelligent Infocommunication Networks, Systems and Services, Budapest, Hungary, 2023, pp. 25–30. DOI: https://doi.org/10.3311/WINS2023-005
A. Haque and H. Soliman, "A Transformer-Based Autoencoder with Isolation Forest and XGBoost for Malfunction and Intrusion Detection in Wireless Sensor Networks for Forest Fire Prediction," Future Internet, vol. 17, no. 4, Apr. 2025, Art. no. 164. DOI: https://doi.org/10.3390/fi17040164
H. Xu, G. Pang, Y. Wang, and Y. Wang, "Deep Isolation Forest for Anomaly Detection," IEEE Transactions on Knowledge and Data Engineering, vol. 35, no. 12, pp. 12591–12604, Dec. 2023. DOI: https://doi.org/10.1109/TKDE.2023.3270293
H. Xiang et al., "Federated Learning-Based Anomaly Detection with Isolation Forest in the IoT-Edge Continuum," ACM Transactions on Multimedia Computing, Communications and Applications, Nov. 2024.
D. Liu et al., "Sensors Anomaly Detection of Industrial Internet of Things Based on Isolated Forest Algorithm and Data Compression," Scientific Programming, vol. 2021, no. 1, 2021, Art. no. 6699313. DOI: https://doi.org/10.1155/2021/6699313
A. Singh, S. Singh, M. N. Alam, and G. Singh, "Deep Learning for Anomaly Detection in IoT Systems: Techniques, Applications, and Future Directions," International Journal For Multidisciplinary Research, vol. 6, no. 4, July 2024, Art. no. IJFMR240424601. DOI: https://doi.org/10.36948/ijfmr.2024.v06i04.24601
C. Y. Priyanto, Hendry, and H. D. Purnomo, "Combination of Isolation Forest and LSTM Autoencoder for Anomaly Detection," in 2021 2nd International Conference on Innovative and Creative Information Technology, Salatiga, Indonesia, 2021, pp. 35–38. DOI: https://doi.org/10.1109/ICITech50181.2021.9590143
Y. K. Saheed, A. A. Usman, F. D. Sukat, and M. Abdulrahman, "A novel hybrid autoencoder and modified particle swarm optimization feature selection for intrusion detection in the internet of things network," Frontiers in Computer Science, vol. 5, Apr. 2023, Art. no. 997159. DOI: https://doi.org/10.3389/fcomp.2023.997159
M. Rabbani et al., "Device Identification and Anomaly Detection in IoT Environments," IEEE Internet of Things Journal, vol. 12, no. 10, pp. 13625–13643, May 2025. DOI: https://doi.org/10.1109/JIOT.2024.3522863
Y. Meidan et al., "N-BaIoT—Network-Based Detection of IoT Botnet Attacks Using Deep Autoencoders," IEEE Pervasive Computing, vol. 17, no. 3, pp. 12–22, July 2018. DOI: https://doi.org/10.1109/MPRV.2018.03367731
N. Moustafa, "A new distributed architecture for evaluating AI-based security systems at the edge: Network TON_IoT datasets," Sustainable Cities and Society, vol. 72, Sept. 2021, Art. no. 102994. DOI: https://doi.org/10.1016/j.scs.2021.102994
N. Moustafa and J. Slay, "UNSW-NB15: a comprehensive data set for network intrusion detection systems (UNSW-NB15 network data set)," in 2015 Military Communications and Information Systems Conference, Canberra, Australia, 2015, pp. 1–6. DOI: https://doi.org/10.1109/MilCIS.2015.7348942
N. Koroniotis, N. Moustafa, E. Sitnikova, and B. Turnbull, "Towards the development of realistic botnet dataset in the Internet of Things for network forensic analytics: Bot-IoT dataset," Future Generation Computer Systems, vol. 100, pp. 779–796, Nov. 2019. DOI: https://doi.org/10.1016/j.future.2019.05.041
I. Ullah and Q. H. Mahmoud, "A Scheme for Generating a Dataset for Anomalous Activity Detection in IoT Networks," in 33rd Canadian Conference on Artificial Intelligence, Canadian AI 2020, Ottawa, Canada, 2020, pp. 508–520. DOI: https://doi.org/10.1007/978-3-030-47358-7_52
M. A. Ferrag, O. Friha, D. Hamouda, L. Maglaras, and H. Janicke, "Edge-IIoTset: A New Comprehensive Realistic Cyber Security Dataset of IoT and IIoT Applications for Centralized and Federated Learning," IEEE Access, vol. 10, pp. 40281–40306, 2022. DOI: https://doi.org/10.1109/ACCESS.2022.3165809
Downloads
How to Cite
License
Copyright (c) 2025 Mohamed Bachar, Azeddine Khiat, Kamal El Guemmat
This work is licensed under a Creative Commons Attribution 4.0 International License.
Authors who publish with this journal agree to the following terms:
- Authors retain the copyright and grant the journal the right of first publication with the work simultaneously licensed under a Creative Commons Attribution License that allows others to share the work with an acknowledgement of the work's authorship and initial publication in this journal.
- Authors are able to enter into separate, additional contractual arrangements for the non-exclusive distribution of the journal's published version of the work (e.g., post it to an institutional repository or publish it in a book), with an acknowledgement of its initial publication in this journal.
- Authors are permitted and encouraged to post their work online (e.g., in institutional repositories or on their website) after its publication in ETASR with an acknowledgement of its initial publication in this journal.
