{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,8]],"date-time":"2026-03-08T20:33:50Z","timestamp":1773002030374,"version":"3.50.1"},"reference-count":83,"publisher":"Wiley","issue":"1","license":[{"start":{"date-parts":[[2025,9,22]],"date-time":"2025-09-22T00:00:00Z","timestamp":1758499200000},"content-version":"vor","delay-in-days":264,"URL":"http:\/\/creativecommons.org\/licenses\/by\/4.0\/"},{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"tdm","delay-in-days":0,"URL":"http:\/\/doi.wiley.com\/10.1002\/tdm_license_1.1"}],"content-domain":{"domain":["onlinelibrary.wiley.com"],"crossmark-restriction":true},"short-container-title":["International Journal of Intelligent Systems"],"published-print":{"date-parts":[[2025,1]]},"abstract":"<jats:p>The proliferation of Internet of Things (IoT) devices has significantly increased the attack surface, making IoT security a critical concern. Traditional intrusion detection systems often fall short in addressing the complex and staged nature of IoT attacks. In this study, we propose a dual\u2010layered intrusion detection system to enhance IoT security. The first layer employs the extreme gradient boosting algorithm to detect reconnaissance attacks, which are typically the initial stage of a multistage cyberattack. In the second layer, an artificial neural network is utilized to classify various IoT\u2010specific attacks. Our model is evaluated using three benchmark datasets: UNSW\u2010NB15, BoT\u2010IoT, and IoT\u2010ID20. The proposed model demonstrates a first\u2010stage accuracy of 99.98%, sensitivity of 99.14%, and specificity of 94.47%. In the second stage, we achieved accuracy rates of 96.97%, 99.99%, and 98.70% across the datasets. This two\u2010stage approach not only improves detection accuracy but also ensures early intervention by identifying reconnaissance attacks, thereby reducing the potential impact of subsequent attack stages. The primary objective of this model is to efficiently detect reconnaissance attacks with minimal resource consumption, thereby reducing the workload of the ANN model. Our findings underscore the importance of a staged defense mechanism in IoT networks, leveraging the strengths of different machine learning algorithms to provide robust security.<\/jats:p>","DOI":"10.1155\/int\/8884584","type":"journal-article","created":{"date-parts":[[2025,9,22]],"date-time":"2025-09-22T17:04:22Z","timestamp":1758560662000},"update-policy":"https:\/\/doi.org\/10.1002\/crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["IoT Intrusion Detection: Implementing a Dual\u2010Layered Security Approach"],"prefix":"10.1155","volume":"2025","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-3339-0493","authenticated-orcid":false,"given":"Erdal","family":"\u00d6zdo\u011fan","sequence":"first","affiliation":[]},{"ORCID":"https:\/\/orcid.org\/0000-0003-2147-0506","authenticated-orcid":false,"given":"Onur","family":"Ceran","sequence":"additional","affiliation":[]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6934-4421","authenticated-orcid":false,"given":"Mevl\u00fct","family":"Uysal","sequence":"additional","affiliation":[]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6198-2819","authenticated-orcid":false,"given":"Mutlu Tahsin","family":"\u00dcst\u00fcnda\u011f","sequence":"additional","affiliation":[]}],"member":"311","published-online":{"date-parts":[[2025,9,22]]},"reference":[{"key":"e_1_2_12_1_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.engappai.2022.105669"},{"key":"e_1_2_12_2_2","doi-asserted-by":"publisher","DOI":"10.1109\/TII.2021.3116085"},{"key":"e_1_2_12_3_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.jestch.2022.101322"},{"key":"e_1_2_12_4_2","doi-asserted-by":"publisher","DOI":"10.1007\/s42452-020-2414-z"},{"key":"e_1_2_12_5_2","doi-asserted-by":"publisher","DOI":"10.3390\/s22010140"},{"key":"e_1_2_12_6_2","doi-asserted-by":"publisher","DOI":"10.1016\/B978-0-12-804180-2.00002-6"},{"key":"e_1_2_12_7_2","doi-asserted-by":"crossref","unstructured":"NaikN. JenkinsP. GraceP. andSongJ. Comparing Attack Models for IT Systems: Lockheed Martin\u2019s Cyber Kill Chain MITRE ATT&CK Framework and Diamond Model 2022 IEEE International Symposium on Systems Engineering (ISSE) October 2022 Vienna Austria IEEE 1\u20137 https:\/\/doi.org\/10.1109\/ISSE54508.2022.10005490.","DOI":"10.1109\/ISSE54508.2022.10005490"},{"key":"e_1_2_12_8_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.comcom.2021.08.026"},{"key":"e_1_2_12_9_2","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2015.2467358"},{"key":"e_1_2_12_10_2","first-page":"472","volume-title":"Communications in Computer and Information Science","author":"Abid A.","year":"2022"},{"key":"e_1_2_12_11_2","doi-asserted-by":"publisher","DOI":"10.1007\/s11042-023-17576-z"},{"key":"e_1_2_12_12_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-18305-3_1"},{"key":"e_1_2_12_13_2","doi-asserted-by":"publisher","DOI":"10.1080\/00949655.2014.925192"},{"key":"e_1_2_12_14_2","doi-asserted-by":"crossref","unstructured":"LeevyJ. L. HancockJ. KhoshgoftaarT. M. andSeliyaN. IoT Reconnaissance Attack Classification With Random Undersampling and Ensemble Feature Selection 2021 IEEE 7th International Conference on Collaboration and Internet Computing (CIC) December 2021 Atlanta GA USA IEEE 41\u201349 https:\/\/doi.org\/10.1109\/CIC52973.2021.00016.","DOI":"10.1109\/CIC52973.2021.00016"},{"key":"e_1_2_12_15_2","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2022.3231847"},{"key":"e_1_2_12_16_2","volume-title":"A Reconnaissance Attack Mechanism for Fixed-Priority Real-Time Systems","author":"Chen C.-Y.","year":"2017"},{"key":"e_1_2_12_17_2","doi-asserted-by":"crossref","unstructured":"KeshavamurthyP.andKulkarniS. Early Detection of Reconnaissance Attacks on IoT Devices by Analyzing Performance and Traffic Characteristics 2023 IEEE International Conference on Cyber Security and Resilience (CSR) July 2023 Venice Italy IEEE 187\u2013193 https:\/\/doi.org\/10.1109\/CSR57506.2023.10224986.","DOI":"10.1109\/CSR57506.2023.10224986"},{"key":"e_1_2_12_18_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-90708-2_2"},{"key":"e_1_2_12_19_2","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2024.3382539"},{"key":"e_1_2_12_20_2","doi-asserted-by":"crossref","unstructured":"AlmomaniO. AlmaiahM. A. MadiM. AlsaaidahA. AlmomaniM. A. andSmadiS. Reconnaissance Attack Detection via Boosting Machine Learning Classifiers AIP Conference Proceedings 2979 Presented at the Proceedings of the 4th International Computer Sciences and Informatics Conference (ICSIC 2022) 2023 Amman Jordan https:\/\/doi.org\/10.1063\/5.0174730.","DOI":"10.1063\/5.0174730"},{"key":"e_1_2_12_21_2","doi-asserted-by":"publisher","DOI":"10.4108\/eetiot.6574"},{"key":"e_1_2_12_22_2","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2020.3009849"},{"key":"e_1_2_12_23_2","doi-asserted-by":"crossref","unstructured":"BhatiaK.andOjhaS. S. Federated Learning Framework for Early Detection of Reconnaissance Attacks in Smart Grid Environments 2024 2nd International Conference on Device Intelligence Computing and Communication Technologies (DICCT) March 2024 Dehradun India IEEE 1\u20136 https:\/\/doi.org\/10.1109\/DICCT61038.2024.10533039.","DOI":"10.1109\/DICCT61038.2024.10533039"},{"key":"e_1_2_12_24_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2024.110655"},{"key":"e_1_2_12_25_2","doi-asserted-by":"publisher","DOI":"10.1002\/itl2.493"},{"key":"e_1_2_12_26_2","doi-asserted-by":"publisher","DOI":"10.1007\/s11276-022-03212-5"},{"key":"e_1_2_12_27_2","doi-asserted-by":"publisher","DOI":"10.1186\/s40537-021-00531-w"},{"key":"e_1_2_12_28_2","doi-asserted-by":"publisher","DOI":"10.3390\/electronics9010173"},{"key":"e_1_2_12_29_2","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2021.3118573"},{"key":"e_1_2_12_30_2","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2021.3118361"},{"key":"e_1_2_12_31_2","doi-asserted-by":"publisher","DOI":"10.14569\/IJACSA.2020.0110236"},{"key":"e_1_2_12_32_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.procs.2021.03.065"},{"key":"e_1_2_12_33_2","doi-asserted-by":"publisher","DOI":"10.3390\/fi12030044"},{"key":"e_1_2_12_34_2","doi-asserted-by":"publisher","DOI":"10.1155\/2021\/5579851"},{"key":"e_1_2_12_35_2","doi-asserted-by":"publisher","DOI":"10.1109\/JIOT.2021.3090909"},{"key":"e_1_2_12_36_2","doi-asserted-by":"crossref","unstructured":"ManzanoR. GoelN. ZamanM. JoshiR. andNaikK. Design of a Machine Learning Based Intrusion Detection Framework and Methodology for IoT Networks 2022 IEEE 12th Annual Computing and Communication Workshop and Conference (CCWC) January 2022 Las Vegas NV USA IEEE 0191\u20130198 https:\/\/doi.org\/10.1109\/CCWC54503.2022.9720857.","DOI":"10.1109\/CCWC54503.2022.9720857"},{"key":"e_1_2_12_37_2","doi-asserted-by":"publisher","DOI":"10.3390\/jsan11010006"},{"key":"e_1_2_12_38_2","doi-asserted-by":"publisher","DOI":"10.1109\/JBHI.2021.3101686"},{"key":"e_1_2_12_39_2","doi-asserted-by":"publisher","DOI":"10.55546\/jmm.995091"},{"key":"e_1_2_12_40_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.jnca.2020.102630"},{"key":"e_1_2_12_41_2","doi-asserted-by":"crossref","unstructured":"NascitaA. CerasuoloF. MondaD. D. GarciaJ. T. A. MontieriA. andPescapeA. Machine and Deep Learning Approaches for IoT Attack Classification IEEE INFOCOM 2022-IEEE Conference on Computer Communications Workshops (INFOCOM WKSHPS) May 2022 New York NY USA IEEE 1\u20136 https:\/\/doi.org\/10.1109\/INFOCOMWKSHPS54753.2022.9797971.","DOI":"10.1109\/INFOCOMWKSHPS54753.2022.9797971"},{"key":"e_1_2_12_42_2","doi-asserted-by":"crossref","unstructured":"MoustafaN.andSlayJ. UNSW-NB15: A Comprehensive Data Set for Network Intrusion Detection Systems (UNSW-NB15 Network Data Set) 2015 Military Communications and Information Systems Conference (MilCIS) November. 2015 Canberra Australia IEEE 1\u20136 https:\/\/doi.org\/10.1109\/MilCIS.2015.7348942 2-s2.0-84969651789.","DOI":"10.1109\/MilCIS.2015.7348942"},{"key":"e_1_2_12_43_2","doi-asserted-by":"publisher","DOI":"10.1080\/19393555.2015.1125974"},{"key":"e_1_2_12_44_2","doi-asserted-by":"publisher","DOI":"10.1109\/TBDATA.2017.2715166"},{"key":"e_1_2_12_45_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-59439-2_5"},{"key":"e_1_2_12_46_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.future.2020.03.042"},{"key":"e_1_2_12_47_2","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2020.3036728"},{"key":"e_1_2_12_48_2","first-page":"30","volume-title":"Lecture Notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering","author":"Koroniotis N.","year":"2018"},{"key":"e_1_2_12_49_2","doi-asserted-by":"publisher","DOI":"10.21928\/uhdjst.v7n1y2023.pp53-65"},{"key":"e_1_2_12_50_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-47358-7_52"},{"key":"e_1_2_12_51_2","doi-asserted-by":"publisher","DOI":"10.1186\/s12911-022-01821-w"},{"key":"e_1_2_12_52_2","doi-asserted-by":"publisher","DOI":"10.3390\/app13064006"},{"key":"e_1_2_12_53_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.catena.2018.12.018"},{"key":"e_1_2_12_54_2","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2024.3353055"},{"key":"e_1_2_12_55_2","doi-asserted-by":"publisher","DOI":"10.1109\/TII.2023.3308784"},{"key":"e_1_2_12_56_2","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2024.3365495"},{"key":"e_1_2_12_57_2","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2024.3372859"},{"key":"e_1_2_12_58_2","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2024.3376434"},{"key":"e_1_2_12_59_2","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2024.3400213"},{"key":"e_1_2_12_60_2","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2024.3376400"},{"key":"e_1_2_12_61_2","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2024.3398007"},{"key":"e_1_2_12_62_2","doi-asserted-by":"publisher","DOI":"10.1007\/s11227-024-06108-7"},{"key":"e_1_2_12_63_2","doi-asserted-by":"publisher","DOI":"10.1007\/s11227-024-05994-1"},{"key":"e_1_2_12_64_2","doi-asserted-by":"publisher","DOI":"10.1007\/s40747-023-01313-y"},{"key":"e_1_2_12_65_2","doi-asserted-by":"publisher","DOI":"10.1186\/s40537-024-00886-w"},{"key":"e_1_2_12_66_2","doi-asserted-by":"publisher","DOI":"10.1007\/s10586-023-04179-4"},{"key":"e_1_2_12_67_2","doi-asserted-by":"publisher","DOI":"10.1007\/s10207-023-00803-x"},{"key":"e_1_2_12_68_2","doi-asserted-by":"publisher","DOI":"10.1007\/s42979-024-02913-2"},{"key":"e_1_2_12_69_2","doi-asserted-by":"publisher","DOI":"10.1007\/s10586-023-04163-y"},{"key":"e_1_2_12_70_2","doi-asserted-by":"publisher","DOI":"10.1007\/s00500-023-09452-7"},{"key":"e_1_2_12_71_2","doi-asserted-by":"publisher","DOI":"10.1007\/s00500-023-09408-x"},{"key":"e_1_2_12_72_2","doi-asserted-by":"publisher","DOI":"10.5755\/j01.itc.53.1.34933"},{"key":"e_1_2_12_73_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.jfranklin.2024.107440"},{"key":"e_1_2_12_74_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2025.104515"},{"key":"e_1_2_12_75_2","doi-asserted-by":"publisher","DOI":"10.1007\/s10586-024-04334-5"},{"key":"e_1_2_12_76_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.compeleceng.2025.110226"},{"key":"e_1_2_12_77_2","doi-asserted-by":"publisher","DOI":"10.1007\/s11042-023-16436-0"},{"key":"e_1_2_12_78_2","doi-asserted-by":"publisher","DOI":"10.4108\/eetsis.4887"},{"key":"e_1_2_12_79_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.jisa.2025.104009"},{"key":"e_1_2_12_80_2","doi-asserted-by":"publisher","DOI":"10.3390\/s25072288"},{"key":"e_1_2_12_81_2","doi-asserted-by":"publisher","DOI":"10.32604\/cmc.2024.059271"},{"key":"e_1_2_12_82_2","doi-asserted-by":"publisher","DOI":"10.1038\/s41598-024-51154-z"},{"key":"e_1_2_12_83_2","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2024.3375878"}],"container-title":["International Journal of Intelligent Systems"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/onlinelibrary.wiley.com\/doi\/pdf\/10.1155\/int\/8884584","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/onlinelibrary.wiley.com\/doi\/full-xml\/10.1155\/int\/8884584","content-type":"application\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/onlinelibrary.wiley.com\/doi\/pdf\/10.1155\/int\/8884584","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,3,8]],"date-time":"2026-03-08T18:08:59Z","timestamp":1772993339000},"score":1,"resource":{"primary":{"URL":"https:\/\/onlinelibrary.wiley.com\/doi\/10.1155\/int\/8884584"}},"subtitle":[],"editor":[{"given":"Mohammad Rezwan","family":"Habib","sequence":"additional","affiliation":[]}],"short-title":[],"issued":{"date-parts":[[2025,1]]},"references-count":83,"journal-issue":{"issue":"1","published-print":{"date-parts":[[2025,1]]}},"alternative-id":["10.1155\/int\/8884584"],"URL":"https:\/\/doi.org\/10.1155\/int\/8884584","archive":["Portico"],"relation":{},"ISSN":["0884-8173","1098-111X"],"issn-type":[{"value":"0884-8173","type":"print"},{"value":"1098-111X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,1]]},"assertion":[{"value":"2024-06-10","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2025-08-12","order":2,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2025-09-22","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}],"article-number":"8884584"}}