{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,11,18]],"date-time":"2025-11-18T07:45:51Z","timestamp":1763451951043,"version":"3.45.0"},"reference-count":44,"publisher":"Wiley","issue":"6","license":[{"start":{"date-parts":[[2025,11,17]],"date-time":"2025-11-17T00:00:00Z","timestamp":1763337600000},"content-version":"vor","delay-in-days":16,"URL":"http:\/\/onlinelibrary.wiley.com\/termsAndConditions#vor"}],"content-domain":{"domain":["onlinelibrary.wiley.com"],"crossmark-restriction":true},"short-container-title":["Security and Privacy"],"published-print":{"date-parts":[[2025,11]]},"abstract":"<jats:title>ABSTRACT<\/jats:title>\n                  <jats:p>The rapid growth of IoT technology brings unprecedented connectivity and convenience but also introduces serious security challenges. Addressing these vulnerabilities is critical, necessitating robust intrusion detection techniques. Anomaly\u2010based Network Intrusion Detection Systems (NIDS) play a pivotal role in securing IoT networks, acting as a cornerstone of modern cybersecurity infrastructure. However, due to the resource constraints and protocol diversity inherent in IoT environments, effective and efficient feature selection becomes essential. This research proposes a novel anomaly\u2010based NIDS framework that incorporates an adaptive, attack\u2010aware feature selection strategy. Initially, two well\u2010established filter\u2010based techniques\u2014one\u2010way ANOVA and Correlation Feature Selection (CFS)\u2014are employed to score feature relevance. Rather than applying a static selection threshold uniformly across the dataset, we introduce a percentile\u2010based adaptive thresholding mechanism that adjusts dynamically based on the imbalance and statistical distribution of each attack category. This ensures that feature selection remains sensitive to the varying relevance of features across different attack types, enabling better generalization and discrimination in heterogeneous traffic patterns. Selected features from ANOVA and CFS are then integrated using union and intersection operations derived from set theory to construct optimal feature subsets. These refined subsets are fed into a two\u2010level stacking ensemble classifier trained on attack\u2010specific patterns. Our framework is evaluated on three benchmark datasets\u2014NSL\u2010KDD, UNSW\u2010NB15, and CICIDS\u20102017\u2014where it consistently outperforms existing methods. Notably, it achieves 98.126% accuracy on UNSW\u2010NB15 (a 3.026\u2010point improvement over [23]), 99.435% on NSL\u2010KDD (surpassing [22] by 3.835 points), and a near\u2010perfect 99.96% on CICIDS\u20102017\u2014the highest reported accuracy in the current literature. These results validate the effectiveness of the proposed adaptive approach and establish new benchmarks for intrusion detection in IoT ecosystems.<\/jats:p>","DOI":"10.1002\/spy2.70142","type":"journal-article","created":{"date-parts":[[2025,11,18]],"date-time":"2025-11-18T01:29:57Z","timestamp":1763429397000},"update-policy":"https:\/\/doi.org\/10.1002\/crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["Anomaly Based Network Intrusion Detection System Using Filter\u2010Based Hybrid Feature Selection and Stacking Classifier for\n                    <scp>IoT<\/scp>\n                    Networks"],"prefix":"10.1002","volume":"8","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-5840-9429","authenticated-orcid":false,"given":"Supongmen","family":"Walling","sequence":"first","affiliation":[{"name":"National Institute of Technology  Dimapur Nagaland India"}]},{"given":"Sibesh","family":"Lodh","sequence":"additional","affiliation":[{"name":"National Institute of Technology  Dimapur Nagaland India"}]}],"member":"311","published-online":{"date-parts":[[2025,11,17]]},"reference":[{"key":"e_1_2_11_2_1","doi-asserted-by":"crossref","first-page":"76","DOI":"10.1109\/MDAT.2016.2526612","article-title":"The Changing Computing Paradigm With Internet Of Things: A Tutorial Introduction","volume":"33","author":"Ray S.","year":"2016","journal-title":"IEEE Design & Test"},{"key":"e_1_2_11_3_1","unstructured":"J.Diechmann K.Heineke T.Reinbacher andD.Wee \u201cThe Internet of Things: How to Capture the Value of IoT. Technical Report Technical ReportMay 1\u2013124 \u201d2018."},{"key":"e_1_2_11_4_1","doi-asserted-by":"crossref","DOI":"10.1007\/s10922-021-09615-7","article-title":"Towards Model Generalization for Intrusion Detection: Unsupervised Machine Learning Techniques","volume":"30","author":"Verkerken M.","year":"2021","journal-title":"Journal of Network and Systems Management"},{"volume-title":"\u201cComparison Deep Learning Method to Traditional Methods Using for Network Intrusion detection.\u201d 2016 8th IEEE International Conference on Communication Software and Networks (ICCSN)","year":"2016","author":"Dong Bo W. X.","key":"e_1_2_11_5_1"},{"issue":"5","key":"e_1_2_11_6_1","doi-asserted-by":"crossref","first-page":"9042","DOI":"10.1109\/JIOT.2019.2926365","article-title":"A Supervised Intrusion Detection System for Smart Home IoT Devices","volume":"6","author":"Anthi E.","year":"2019","journal-title":"IEEE Internet of Things Journal"},{"key":"e_1_2_11_7_1","doi-asserted-by":"publisher","DOI":"10.1186\/s13677\u2010018\u20100123\u20106"},{"key":"e_1_2_11_8_1","doi-asserted-by":"publisher","DOI":"10.1186\/s42400\u2010019\u20100038\u20107"},{"key":"e_1_2_11_9_1","doi-asserted-by":"crossref","first-page":"447","DOI":"10.1007\/s11235-018-0475-8","article-title":"A Comprehensive Survey on Network Anomaly Detection","volume":"70","author":"Fernandes G.","year":"2019","journal-title":"Telecommunication Systems"},{"key":"e_1_2_11_10_1","doi-asserted-by":"crossref","DOI":"10.1016\/j.engappai.2021.104216","article-title":"Supervised Feature Selection Techniques In Network Intrusion Detection: A Critical Review","volume":"101","author":"Di Mauro M.","year":"2021","journal-title":"Engineering Applications of Artificial Intelligence"},{"key":"e_1_2_11_11_1","doi-asserted-by":"crossref","first-page":"350","DOI":"10.1016\/j.eswa.2018.11.006","article-title":"Embedded Feature Selection Accounting for Unknown Data Heterogeneity","volume":"119","author":"Lu M.","year":"2019","journal-title":"Expert Systems with Applications"},{"key":"e_1_2_11_12_1","doi-asserted-by":"crossref","first-page":"47","DOI":"10.1007\/s12065-019-00291-w","article-title":"UIDS: A Unified Intrusion Detection System for IoT Environment","volume":"14","author":"Kumar V.","year":"2021","journal-title":"Evolutionary Intelligence"},{"key":"e_1_2_11_13_1","first-page":"152","volume-title":"Intrusion Detection In IoT Using Artificial Neural Networks On UNSW\u201015 Dataset","author":"Hanif S.","year":"2019"},{"key":"e_1_2_11_14_1","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2020.2973730"},{"key":"e_1_2_11_15_1","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2019.2928048"},{"key":"e_1_2_11_16_1","article-title":"Toward a Lightweight Intrusion Detection System for the Internet of Things","volume":"7","author":"Jan S. U.","year":"2019","journal-title":"IEEE Access"},{"key":"e_1_2_11_17_1","first-page":"69","volume-title":"International conference on intelligent systems design and applications","author":"Khan N. M.","year":"2018"},{"issue":"6","key":"e_1_2_11_18_1","doi-asserted-by":"crossref","first-page":"389","DOI":"10.14569\/IJACSA.2017.080651","article-title":"A two\u2010Stage Classifier Approach Using Reptree Algorithm for Network Intrusion Detection","volume":"8","author":"Belouch M.","year":"2017","journal-title":"International Journal of Advanced Computer Science and Applications"},{"key":"e_1_2_11_19_1","doi-asserted-by":"crossref","DOI":"10.1155\/2021\/5557577","article-title":"Improving the Performance of Machine Learning\u2010Based Network Intrusion Detection Systems on the UNSW\u2010NB15 Dataset","volume":"2021","author":"Moualla S.","year":"2021","journal-title":"Computational Intelligence and Neuroscience"},{"key":"e_1_2_11_20_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2017.06.005"},{"key":"e_1_2_11_21_1","doi-asserted-by":"crossref","first-page":"82512","DOI":"10.1109\/ACCESS.2019.2923640","article-title":"An Adaptive Ensemble Machine Learning Model for Intrusion Detection","volume":"7","author":"Gao X.","year":"2019","journal-title":"IEEE Access"},{"key":"e_1_2_11_22_1","doi-asserted-by":"publisher","DOI":"10.3390\/ai3010002"},{"key":"e_1_2_11_23_1","doi-asserted-by":"publisher","DOI":"10.3390\/s22041396"},{"key":"e_1_2_11_24_1","doi-asserted-by":"publisher","DOI":"10.7717\/peerj\u2010cs.820"},{"key":"e_1_2_11_25_1","doi-asserted-by":"crossref","first-page":"276","DOI":"10.1016\/j.future.2021.09.027","article-title":"A Lightweight Supervised Intrusion Detection Mechanism for IoT Networks","volume":"127","author":"Souradip Roy J. L.","year":"2022","journal-title":"Future Generation Computer Systems"},{"key":"e_1_2_11_26_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2020.107247"},{"key":"e_1_2_11_27_1","first-page":"2","volume-title":"In Proceedings of the 2021 2nd International Conference on Advances in Computing, Communication, Embedded and Secure Systems (ACCESS)","author":"Karna I.","year":"2021"},{"key":"e_1_2_11_28_1","doi-asserted-by":"publisher","DOI":"10.1109\/JIOT.2021.3119055"},{"key":"e_1_2_11_29_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.eswa.2020.113249"},{"key":"e_1_2_11_30_1","first-page":"1","article-title":"The Evaluation of Network Anomaly Detection Systems: Statistical Analysis of the UNSW\u2010NB15 Dataset and the Comparison With the KDD99 Dataset","volume":"25","author":"Moustafa N.","year":"2016","journal-title":"Information Security Journal: A Global Perspective"},{"volume-title":"4th International Conference on Information Systems Security and Privacy (ICISSP)","year":"2018","author":"Sharafaldin I.","key":"e_1_2_11_31_1"},{"key":"e_1_2_11_32_1","first-page":"803","volume-title":"International Conference on Electronics and Sustainable Communication Systems (ICESC)","author":"Waskle S.","year":"2020"},{"key":"e_1_2_11_33_1","doi-asserted-by":"crossref","first-page":"125","DOI":"10.1145\/3335484.3335488","volume-title":"Proceedings of the 2019 4th International Conference on Big Data and Computing","author":"Yang L.","year":"2019"},{"key":"e_1_2_11_34_1","doi-asserted-by":"crossref","first-page":"3418","DOI":"10.1016\/j.procs.2020.09.055","article-title":"Application of Logistic Regression Models to Assess Household Financial Decisions Regarding Debt","volume":"176","author":"Strzelecka A.","year":"2020","journal-title":"Procedia Computer Science"},{"volume-title":"Proceedings of the 2021 IEEE World AI IoT Congress (AIIoT)","year":"2019","author":"Albulayhi K.","key":"e_1_2_11_35_1"},{"key":"e_1_2_11_36_1","doi-asserted-by":"publisher","DOI":"10.3390\/jsan12020029"},{"key":"e_1_2_11_37_1","doi-asserted-by":"crossref","unstructured":"D. A.Cieslak N. V.Chawla andA.Striegel \u201cCombating Imbalance in Network Intrusion Datasets \u201d2006 https:\/\/doi.org\/10.1109\/grc.2006.1635905.","DOI":"10.1109\/GRC.2006.1635905"},{"key":"e_1_2_11_38_1","first-page":"1322","volume-title":"IEEE International Joint Conference on Neural Networks (IEEE World Congress on Computational Intelligence)","author":"He H.","year":"2008"},{"key":"e_1_2_11_39_1","doi-asserted-by":"publisher","DOI":"10.3837\/tiis.2018.10.024"},{"key":"e_1_2_11_40_1","doi-asserted-by":"publisher","DOI":"10.1109\/MCOM.2017.1700048"},{"key":"e_1_2_11_41_1","doi-asserted-by":"crossref","first-page":"250","DOI":"10.1016\/j.ins.2016.01.033","article-title":"An improved Method to Construct Basic Probability Assignment Based on the Confusion Matrix for Classification Problem","volume":"340","author":"Deng X.","year":"2016","journal-title":"Information Sciences"},{"key":"e_1_2_11_42_1","doi-asserted-by":"publisher","DOI":"10.3390\/fi16070255"},{"key":"e_1_2_11_43_1","doi-asserted-by":"publisher","DOI":"10.15587\/1729\u20104061.2024.305685"},{"key":"e_1_2_11_44_1","doi-asserted-by":"publisher","DOI":"10.32604\/cmc.2024.048443"},{"key":"e_1_2_11_45_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2024.110495"}],"container-title":["SECURITY AND PRIVACY"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/onlinelibrary.wiley.com\/doi\/pdf\/10.1002\/spy2.70142","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,11,18]],"date-time":"2025-11-18T07:42:23Z","timestamp":1763451743000},"score":1,"resource":{"primary":{"URL":"https:\/\/onlinelibrary.wiley.com\/doi\/10.1002\/spy2.70142"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,11]]},"references-count":44,"journal-issue":{"issue":"6","published-print":{"date-parts":[[2025,11]]}},"alternative-id":["10.1002\/spy2.70142"],"URL":"https:\/\/doi.org\/10.1002\/spy2.70142","archive":["Portico"],"relation":{},"ISSN":["2475-6725","2475-6725"],"issn-type":[{"type":"print","value":"2475-6725"},{"type":"electronic","value":"2475-6725"}],"subject":[],"published":{"date-parts":[[2025,11]]},"assertion":[{"value":"2024-06-18","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2025-10-28","order":2,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2025-11-17","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}],"article-number":"e70142"}}