A two-stage hybrid model for IoT anomaly detection by integrating kmedoids clustering and lightweight decision trees

Abstract

The rapid proliferation of Internet of Things (IoT) devices has introduced significant security vulnerabilities due to their limited computational resources and susceptibility to evolving cyber threats. Traditional security mechanisms, such as signature-based detection, are ineffective against novel attacks, while existing anomaly detection models struggle with high false positives, computational inefficiency, and data heterogeneity in IoT environments. This study proposes a two-stage hybrid anomaly detection model that integrates K-Medoids clustering and Lightweight Decision Trees (LWDT) to address these challenges. The first stage employs K-Medoids clustering to group unlabeled IoT network traffic into normal and anomalous clusters, leveraging its robustness to noise and outliers. The second stage refines these clusters using a Lightweight Decision Tree (LWDT) classifier, optimized for resource-constrained IoT devices, to reduce false positives and improve detection accuracy. The model was evaluated on three benchmark datasets (CICIDS2017, IoT-23, BoT-IoT), achieving >99% accuracy across all datasets while maintaining sub-microsecond prediction times. Comparative analysis demonstrated superior performance over existing models, including deep learning and ensemble techniques. This model can be applied to improve security of IoT devices.