{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,1,6]],"date-time":"2026-01-06T13:44:09Z","timestamp":1767707049652,"version":"build-2065373602"},"reference-count":28,"publisher":"MDPI AG","issue":"7","license":[{"start":{"date-parts":[[2025,7,17]],"date-time":"2025-07-17T00:00:00Z","timestamp":1752710400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"Higher Education Commission (HEC) of Pakistan","award":["20-17332\/NRPU\/R&D\/HEC\/2021-2020"],"award-info":[{"award-number":["20-17332\/NRPU\/R&D\/HEC\/2021-2020"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Computers"],"abstract":"<jats:p>The Internet of Things (IoT) holds transformative potential in fields such as power grid optimization, defense networks, and healthcare. However, the constrained processing capacities and resource limitations of IoT networks make them especially susceptible to cyber threats. This study addresses the problem of detecting intrusions in IoT environments by evaluating the performance of deep learning (DL) models under different data and algorithmic conditions. We conducted a comparative analysis of three widely used DL models\u2014Convolutional Neural Networks (CNNs), Long Short-Term Memory (LSTM), and Bidirectional LSTM (biLSTM)\u2014across four benchmark IoT intrusion detection datasets: BoTIoT, CiCIoT, ToNIoT, and WUSTL-IIoT-2021. Each model was assessed under balanced and imbalanced dataset configurations and evaluated using three loss functions (cross-entropy, focal loss, and dual focal loss). By analyzing model efficacy across these datasets, we highlight the importance of generalizability and adaptability to varied data characteristics that are essential for real-world applications. The results demonstrate that the CNN trained using the cross-entropy loss function consistently outperforms the other models, particularly on balanced datasets. On the other hand, LSTM and biLSTM show strong potential in temporal modeling, but their performance is highly dependent on the characteristics of the dataset. By analyzing the performance of multiple DL models under diverse datasets, this research provides actionable insights for developing secure, interpretable IoT systems that can meet the challenges of designing a secure IoT system.<\/jats:p>","DOI":"10.3390\/computers14070283","type":"journal-article","created":{"date-parts":[[2025,7,17]],"date-time":"2025-07-17T10:33:47Z","timestamp":1752748427000},"page":"283","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":1,"title":["Comparative Analysis of Deep Learning Models for Intrusion Detection in IoT Networks"],"prefix":"10.3390","volume":"14","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-8917-460X","authenticated-orcid":false,"given":"Abdullah","family":"Waqas","sequence":"first","affiliation":[{"name":"Department of Computer Science, National University of Technology, Islamabad 44000, Pakistan"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-7406-8441","authenticated-orcid":false,"given":"Sultan Daud","family":"Khan","sequence":"additional","affiliation":[{"name":"Department of Computer Science, National University of Technology, Islamabad 44000, Pakistan"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2200-4868","authenticated-orcid":false,"given":"Zaib","family":"Ullah","sequence":"additional","affiliation":[{"name":"Department of Computer Engineering, Universit\u00e1 Telematica Giustino Fortunato, 82100 Benevento, Italy"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-0222-6340","authenticated-orcid":false,"given":"Mohib","family":"Ullah","sequence":"additional","affiliation":[{"name":"Intelligent Systems and Analytics (ISA) Research Group, Department of Computer Science (IDI), Norwegian University of Science and Technology (NTNU), 2815 Gj\u00f8vik, Norway"}]},{"given":"Habib","family":"Ullah","sequence":"additional","affiliation":[{"name":"Faculty of Science and Technology (REALTEK), Norwegian University of Life Sciences (NMBU), 1433 \u00c5s, Norway"}]}],"member":"1968","published-online":{"date-parts":[[2025,7,17]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"110","DOI":"10.1016\/j.iotcps.2023.09.003","article-title":"Deep learning for cyber threat detection in IoT networks: A review","volume":"4","author":"Aldhaheri","year":"2023","journal-title":"Internet Things-Cyber-Phys. Syst."},{"key":"ref_2","doi-asserted-by":"crossref","first-page":"104964","DOI":"10.1016\/j.micpro.2023.104964","article-title":"A framework for detection of cyber attacks by the classification of intrusion detection datasets","volume":"105","author":"Srivastava","year":"2024","journal-title":"Microprocess. Microsyst."},{"key":"ref_3","unstructured":"Heyden, W., Ullah, H., Siddiqui, M.S., and Machot, F.A. (2024). RevCD\u2013Reversed Conditional Diffusion for Generalized Zero-Shot Learning. arXiv."},{"key":"ref_4","doi-asserted-by":"crossref","first-page":"100862","DOI":"10.1109\/ACCESS.2024.3419708","article-title":"Deep Learning based Models for Paddy Disease Identification and Classification: A Systematic Survey","volume":"12","author":"Tasfe","year":"2024","journal-title":"IEEE Access"},{"key":"ref_5","doi-asserted-by":"crossref","first-page":"80348","DOI":"10.1109\/ACCESS.2023.3296444","article-title":"Comparative analysis of intrusion detection systems and machine learning based model analysis through decision tree","volume":"11","author":"Azam","year":"2023","journal-title":"IEEE Access"},{"key":"ref_6","first-page":"1801","article-title":"Towards Machine Learning Based Intrusion Detection in IoT Networks","volume":"69","author":"Islam","year":"2021","journal-title":"Comput. Mater. Contin."},{"key":"ref_7","doi-asserted-by":"crossref","first-page":"414","DOI":"10.1016\/j.future.2020.02.051","article-title":"Real time dataset generation framework for intrusion detection systems in IoT","volume":"108","author":"Hussain","year":"2020","journal-title":"Future Gener. Comput. Syst."},{"key":"ref_8","doi-asserted-by":"crossref","unstructured":"Sharafaldin, I., Lashkari, A.H., and Ghorbani, A.A. (2018, January 22\u201324). Toward generating a new intrusion detection dataset and intrusion traffic characterization. Proceedings of the 4th International Conference on Information Systems Security and Privacy (ICISSP 2018), Madeira, Portugal.","DOI":"10.5220\/0006639801080116"},{"key":"ref_9","unstructured":"Parmisano, A., Garcia, S., and Erquiaga, M.J. (2020). A Labeled Dataset with Malicious and Benign IoT Network Traffic, Stratosphere Laboratory."},{"key":"ref_10","doi-asserted-by":"crossref","unstructured":"Lamjid, A., Ariffin, K.A.Z., Aziz, M.J.A., and Sani, N.S. (2022, January 6\u20137). Determine the optimal Hidden Layers and Neurons in the Generative Adversarial Networks topology for the Intrusion Detection Systems. Proceedings of the 2022 International Conference on Cyber Resilience (ICCR), Dubai, United Arab Emirates.","DOI":"10.1109\/ICCR56254.2022.9996040"},{"key":"ref_11","doi-asserted-by":"crossref","first-page":"471","DOI":"10.1007\/978-981-15-0637-6_40","article-title":"Deep learning approach for IDS: Using DNN for network anomaly detection","volume":"Volume 1","author":"Liu","year":"2020","journal-title":"Proceedings of the Fourth International Congress on Information and Communication Technology: ICICT 2019"},{"key":"ref_12","doi-asserted-by":"crossref","first-page":"41525","DOI":"10.1109\/ACCESS.2019.2895334","article-title":"Deep learning approach for intelligent intrusion detection system","volume":"7","author":"Vinayakumar","year":"2019","journal-title":"IEEE Access"},{"key":"ref_13","doi-asserted-by":"crossref","first-page":"353","DOI":"10.1016\/j.inffus.2022.09.026","article-title":"Fusion of statistical importance for feature selection in Deep Neural Network-based Intrusion Detection System","volume":"90","author":"Thakkar","year":"2023","journal-title":"Inf. Fusion"},{"key":"ref_14","first-page":"711","article-title":"Deep-intrusion detection system with enhanced UNSW-NB15 dataset based on deep learning techniques","volume":"16","author":"Aleesa","year":"2021","journal-title":"J. Eng. Sci. Technol."},{"key":"ref_15","doi-asserted-by":"crossref","unstructured":"Tang, C., Luktarhan, N., and Zhao, Y. (2020). SAAE-DNN: Deep learning method on intrusion detection. Symmetry, 12.","DOI":"10.3390\/sym12101695"},{"key":"ref_16","doi-asserted-by":"crossref","unstructured":"Mennour, H., and Mostefai, S. (2020, January 9\u201311). A hybrid deep learning strategy for an anomaly based N-ids. Proceedings of the 2020 International Conference on Intelligent Systems and Computer Vision (ISCV), Fez, Morocco.","DOI":"10.1109\/ISCV49265.2020.9204227"},{"key":"ref_17","doi-asserted-by":"crossref","unstructured":"Al-Emadi, S., Al-Mohannadi, A., and Al-Senaid, F. (2020, January 2\u20135). Using deep learning techniques for network intrusion detection. Proceedings of the 2020 IEEE International Conference on Informatics, IoT, and Enabling Technologies (ICIoT), Doha, Qatar.","DOI":"10.1109\/ICIoT48696.2020.9089524"},{"key":"ref_18","doi-asserted-by":"crossref","first-page":"75729","DOI":"10.1109\/ACCESS.2021.3082147","article-title":"A hybrid intrusion detection system based on scalable K-means+ random forest and deep learning","volume":"9","author":"Liu","year":"2021","journal-title":"IEEE Access"},{"key":"ref_19","doi-asserted-by":"crossref","first-page":"37131","DOI":"10.1109\/ACCESS.2023.3266979","article-title":"A novel two-stage deep learning model for network intrusion detection: LSTM-AE","volume":"11","author":"Hnamte","year":"2023","journal-title":"IEEE Access"},{"key":"ref_20","doi-asserted-by":"crossref","first-page":"386","DOI":"10.1016\/j.ins.2019.10.069","article-title":"A hybrid deep learning model for efficient intrusion detection in big data environment","volume":"513","author":"Hassan","year":"2020","journal-title":"Inf. Sci."},{"key":"ref_21","doi-asserted-by":"crossref","first-page":"115524","DOI":"10.1016\/j.eswa.2021.115524","article-title":"A bidirectional LSTM deep learning approach for intrusion detection","volume":"185","author":"Imrana","year":"2021","journal-title":"Expert Syst. Appl."},{"key":"ref_22","doi-asserted-by":"crossref","first-page":"110368","DOI":"10.1016\/j.compeleceng.2025.110368","article-title":"Cyber threat detection in industry 4.0: Leveraging GloVe and self-attention mechanisms in BiLSTM for enhanced intrusion detection","volume":"124","author":"Vellela","year":"2025","journal-title":"Comput. Electr. Eng."},{"key":"ref_23","doi-asserted-by":"crossref","first-page":"779","DOI":"10.1016\/j.future.2019.05.041","article-title":"Towards the development of realistic botnet dataset in the internet of things for network forensic analytics: Bot-iot dataset","volume":"100","author":"Koroniotis","year":"2019","journal-title":"Future Gener. Comput. Syst."},{"key":"ref_24","doi-asserted-by":"crossref","unstructured":"Neto, E.C.P., Dadkhah, S., Ferreira, R., Zohourian, A., Lu, R., and Ghorbani, A.A. (2023). CICIoT2023: A real-time dataset and benchmark for large-scale attacks in IoT environment. Sensors, 23.","DOI":"10.20944\/preprints202305.0443.v1"},{"key":"ref_25","doi-asserted-by":"crossref","first-page":"102994","DOI":"10.1016\/j.scs.2021.102994","article-title":"A new distributed architecture for evaluating AI-based security systems at the edge: Network TON_IoT datasets","volume":"72","author":"Moustafa","year":"2021","journal-title":"Sustain. Cities Soc."},{"key":"ref_26","doi-asserted-by":"crossref","first-page":"485","DOI":"10.1109\/JIOT.2021.3085194","article-title":"ToN_IoT: The role of heterogeneity and the need for standardization of features and attack types in IoT network intrusion data sets","volume":"9","author":"Booij","year":"2021","journal-title":"IEEE Internet Things J."},{"key":"ref_27","unstructured":"Zolanvari, M., Teixeira, M.A., Gupta, L., Khan, K.M., and Jain, R. (2021). WUSTL-IIOT-2021 Dataset for IIoT Cybersecurity Research, Washington University."},{"key":"ref_28","doi-asserted-by":"crossref","first-page":"100699","DOI":"10.1016\/j.iot.2023.100699","article-title":"A deep learning approach for intrusion detection in Internet of Things using focal loss function","volume":"22","author":"Dina","year":"2023","journal-title":"Internet Things"}],"container-title":["Computers"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2073-431X\/14\/7\/283\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,9]],"date-time":"2025-10-09T18:11:06Z","timestamp":1760033466000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2073-431X\/14\/7\/283"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,7,17]]},"references-count":28,"journal-issue":{"issue":"7","published-online":{"date-parts":[[2025,7]]}},"alternative-id":["computers14070283"],"URL":"https:\/\/doi.org\/10.3390\/computers14070283","relation":{},"ISSN":["2073-431X"],"issn-type":[{"type":"electronic","value":"2073-431X"}],"subject":[],"published":{"date-parts":[[2025,7,17]]}}}