{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,22]],"date-time":"2026-04-22T05:49:59Z","timestamp":1776836999622,"version":"3.51.2"},"reference-count":42,"publisher":"MDPI AG","issue":"2","license":[{"start":{"date-parts":[[2023,1,29]],"date-time":"2023-01-29T00:00:00Z","timestamp":1674950400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"Key R&amp;D and promotion projects of Henan Province (Technological research)","award":["212102210143"],"award-info":[{"award-number":["212102210143"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Information"],"abstract":"<jats:p>Internet of Things (IoT) devices and services provide convenience but face serious security threats. The network intrusion detection system is vital in ensuring the security of the IoT environment. In the IoT environment, we propose a novel two-stage intrusion detection model that combines machine learning and deep learning to deal with the class imbalance of network traffic data and achieve fine-grained intrusion detection on large-scale flow data. The superiority of the model is verified on the newer and larger CSE-CIC-IDS2018 dataset. In Stage-1, the LightGBM algorithm recognizes normal and abnormal network traffic data and compares six classic machine learning techniques. In Stage-2, the Convolutional Neural Network (CNN) performs fine-grained attack class detection on the samples predicted to be abnormal in Stage-1. The Stage-2 multiclass classification achieves a detection rate of 99.896%, F1score of 99.862%, and an MCC of 95.922%. The total training time of the two-stage model is 74.876 s. The detection time of a sample is 0.0172 milliseconds. Moreover, we set up an optional Synthetic Minority Over-sampling Technique based on the imbalance ratio (IR-SMOTE) of the dataset in Stage-2. Experimental results show that, compared with SMOTE technology, the two-stage intrusion detection model can adapt to imbalanced datasets well and reveal higher efficiency and better performance when processing large-scale flow data, outperforming state-of-the-art intrusion detection systems.<\/jats:p>","DOI":"10.3390\/info14020077","type":"journal-article","created":{"date-parts":[[2023,1,30]],"date-time":"2023-01-30T10:19:28Z","timestamp":1675073968000},"page":"77","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":25,"title":["An Efficient Two-Stage Network Intrusion Detection System in the Internet of Things"],"prefix":"10.3390","volume":"14","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-3485-8470","authenticated-orcid":false,"given":"Hongpo","family":"Zhang","sequence":"first","affiliation":[{"name":"School of Cyber Science and Engineering, Zhengzhou University, Zhengzhou 450001, China"},{"name":"Cooperative Innovation Center of Internet Healthcare, Zhengzhou University, Zhengzhou 450001, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-5658-9262","authenticated-orcid":false,"given":"Bo","family":"Zhang","sequence":"additional","affiliation":[{"name":"School of Cyber Science and Engineering, Zhengzhou University, Zhengzhou 450001, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-0133-2627","authenticated-orcid":false,"given":"Lulu","family":"Huang","sequence":"additional","affiliation":[{"name":"Cooperative Innovation Center of Internet Healthcare, Zhengzhou University, Zhengzhou 450001, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2417-6348","authenticated-orcid":false,"given":"Zhaozhe","family":"Zhang","sequence":"additional","affiliation":[{"name":"School of Cyber Science and Engineering, Zhengzhou University, Zhengzhou 450001, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2338-2430","authenticated-orcid":false,"given":"Haizhaoyang","family":"Huang","sequence":"additional","affiliation":[{"name":"School of Cyber Science and Engineering, Zhengzhou University, Zhengzhou 450001, China"}]}],"member":"1968","published-online":{"date-parts":[[2023,1,29]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"2787","DOI":"10.1016\/j.comnet.2010.05.010","article-title":"The internet of things: A survey","volume":"54","author":"Atzori","year":"2010","journal-title":"Comput. Netw."},{"key":"ref_2","doi-asserted-by":"crossref","first-page":"4436","DOI":"10.1109\/TIA.2020.2971952","article-title":"A visualized botnet detection system based deep learning for the internet of things networks of smart cities","volume":"56","author":"Vinayakumar","year":"2020","journal-title":"IEEE Trans. Ind. Appl."},{"key":"ref_3","doi-asserted-by":"crossref","first-page":"1654","DOI":"10.1109\/TC.2020.3015584","article-title":"MTHAEL: Cross-architecture IoT malware detection based on neural network advanced ensemble learning","volume":"69","author":"Vasan","year":"2020","journal-title":"IEEE Trans. Comput."},{"key":"ref_4","unstructured":"Rehman, A., Paul, A., Yaqub, M.A., and Rathore, M.M.U. (April, January 30). Trustworthy Intelligent Industrial Monitoring Architecture for Early Event Detection by Exploiting Social IoT. Proceedings of the 35th Annual ACM Symposium on Applied Computing, SAC \u201920, Virtual."},{"key":"ref_5","doi-asserted-by":"crossref","unstructured":"Liu, H., and Lang, B. (2019). Machine learning and deep learning methods for intrusion detection systems: A survey. Appl. Sci., 9.","DOI":"10.3390\/app9204396"},{"key":"ref_6","doi-asserted-by":"crossref","unstructured":"Mahfouz, A.M., Venugopal, D., and Shiva, S.G. (2019, January 27\u201328). Comparative analysis of ML classifiers for Nnetwork intrusion detection. Proceedings of the Fourth International Congress on Information and Communication Technology, London, UK.","DOI":"10.1007\/978-981-32-9343-4_16"},{"key":"ref_7","doi-asserted-by":"crossref","unstructured":"Tesfahun, A., and Bhaskari, D.L. (2013, January 15\u201316). Intrusion detection using random forests classifier with SMOTE and feature reduction. Proceedings of the 2013 International Conference on Cloud & Ubiquitous Computing & Emerging Technologies, Pune, India.","DOI":"10.1109\/CUBE.2013.31"},{"key":"ref_8","doi-asserted-by":"crossref","unstructured":"Bhavani, T.T., Rao, M.K., and Reddy, A.M. (2019, January 29\u201330). Network intrusion detection system using random forest and decision tree machine learning techniques. Proceedings of the First International Conference on Sustainable Technologies for Computational Intelligence, Jaipur, India.","DOI":"10.1007\/978-981-15-0029-9_50"},{"key":"ref_9","doi-asserted-by":"crossref","first-page":"314","DOI":"10.1109\/TETC.2016.2633228","article-title":"A two-layer dimension reduction and two-tier classification model for anomaly-based intrusion detection in IoT backbone networks","volume":"7","author":"Pajouh","year":"2019","journal-title":"IEEE Trans. Emerg. Top. Comput."},{"key":"ref_10","doi-asserted-by":"crossref","first-page":"2735","DOI":"10.1007\/s10489-018-01408-x","article-title":"A new hybrid approach for intrusion detection using machine learning methods","volume":"49","author":"Cavusoglu","year":"2019","journal-title":"Appl. Intell."},{"key":"ref_11","doi-asserted-by":"crossref","first-page":"32150","DOI":"10.1109\/ACCESS.2020.2973219","article-title":"Increasing the performance of machine learning-based IDSs on an imbalanced and up-to-date dataset","volume":"8","author":"Karatas","year":"2020","journal-title":"IEEE Access"},{"key":"ref_12","first-page":"30","article-title":"Towards developing network forensic mechanism for botnet activities in the IoT based on machine learning techniques","volume":"235","author":"Koroniotis","year":"2018","journal-title":"Mob. Netw. Manag."},{"key":"ref_13","doi-asserted-by":"crossref","unstructured":"Dhaliwal, S.S., Nahid, A.A., and Abbas, R. (2018). Effective Intrusion Detection System Using XGBoost. Information, 9.","DOI":"10.3390\/info9070149"},{"key":"ref_14","first-page":"102564","article-title":"Inter-dataset generalization strength of supervised machine learning methods for intrusion detection","volume":"54","author":"Wauters","year":"2020","journal-title":"J. Inf. Secur. Appl."},{"key":"ref_15","doi-asserted-by":"crossref","first-page":"418","DOI":"10.1016\/j.future.2018.07.023","article-title":"Anomaly detection in wide area network meshes using two machine learning algorithms","volume":"93","author":"Zhang","year":"2019","journal-title":"Futur. Gener. Comp. Syst."},{"key":"ref_16","doi-asserted-by":"crossref","first-page":"107315","DOI":"10.1016\/j.comnet.2020.107315","article-title":"An effective convolutional neural network based on SMOTE and gaussian mixture model for intrusion detection in imbalanced dataset","volume":"117","author":"Zhang","year":"2020","journal-title":"Comput. Netw."},{"key":"ref_17","doi-asserted-by":"crossref","first-page":"123","DOI":"10.1016\/j.ins.2019.09.055","article-title":"A convolutional neural-based learning classifier system for detecting database intrusion via insider attack","volume":"512","author":"Bu","year":"2020","journal-title":"Inf. Sci."},{"key":"ref_18","doi-asserted-by":"crossref","first-page":"418","DOI":"10.1016\/j.future.2020.07.042","article-title":"Genetic convolutional neural network for intrusion detection systems","volume":"113","author":"Nguyen","year":"2020","journal-title":"Future Gener. Comput. Syst."},{"key":"ref_19","doi-asserted-by":"crossref","first-page":"101748","DOI":"10.1016\/j.cose.2020.101748","article-title":"Image-based malware classification using ensemble of CNN architectures (IMCEC)","volume":"92","author":"Vasan","year":"2020","journal-title":"Comput. Secur."},{"key":"ref_20","doi-asserted-by":"crossref","first-page":"102031","DOI":"10.1016\/j.simpat.2019.102031","article-title":"Deep recurrent neural network for IoT intrusion detection system","volume":"101","author":"Almiani","year":"2020","journal-title":"Simul. Model. Pract. Theory"},{"key":"ref_21","doi-asserted-by":"crossref","unstructured":"Zhang, H., Wu, C.Q., Gao, S., Wang, Z., Xu, Y., and Liu, Y. (2018, January 20\u201324). An effective deep learning based scheme for network intrusion detection. Proceedings of the 2018 24th International Conference on Pattern Recognition (ICPR), Beijing, China.","DOI":"10.1109\/ICPR.2018.8546162"},{"key":"ref_22","doi-asserted-by":"crossref","unstructured":"Kanimozhi, V., and Jacob, T.P. (2019, January 4\u20136). Artificial intelligence based network intrusion detection with hyper-parameter optimization tuning on the realistic cyber dataset CSE-CIC-IDS2018 using cloud computing. Proceedings of the 2019 International Conference on Communication and Signal Processing (ICCSP), Melmaruvathur, India.","DOI":"10.1109\/ICCSP.2019.8698029"},{"key":"ref_23","doi-asserted-by":"crossref","first-page":"463","DOI":"10.1109\/TSMCC.2011.2161285","article-title":"A review on ensembles for the class imbalance problem: Bagging-, boosting-, and hybrid-based approaches","volume":"42","author":"Galar","year":"2012","journal-title":"IEEE Trans. Syst. Man Cybern. Part C"},{"key":"ref_24","doi-asserted-by":"crossref","first-page":"105","DOI":"10.1016\/j.jnca.2018.10.021","article-title":"Internet of things (IoT), mobile cloud, cloudlet, mobile IoT, IoT cloud, fog, mobile edge, and edge emerging computing paradigms: Disambiguation and research directions","volume":"128","author":"Elazhary","year":"2019","journal-title":"J. Netw. Comput. Appl."},{"key":"ref_25","doi-asserted-by":"crossref","first-page":"18","DOI":"10.1016\/j.jnca.2020.102630","article-title":"Machine learning based solutions for security of internet of things (IoT): A survey","volume":"161","author":"Tahsien","year":"2020","journal-title":"J. Netw. Comput. Appl."},{"key":"ref_26","doi-asserted-by":"crossref","unstructured":"Lopez-Martin, M., Carro, B., Sanchez-Esguevillas, A., and Lloret, J. (2017). Conditional variational autoencoder for prediction and feature recovery applied to intrusion detection in IoT. Sensors, 17.","DOI":"10.3390\/s17091967"},{"key":"ref_27","doi-asserted-by":"crossref","unstructured":"Rathore, M.M., Saeed, F., Rehman, A., Paul, A., and Daniel, A. (2018, January 14\u201316). Intrusion Detection Using Decision Tree Model in High-Speed Environment. Proceedings of the 2018 International Conference on Soft-computing and Network Security (ICSNS), Coimbatore, India.","DOI":"10.1109\/ICSNS.2018.8573631"},{"key":"ref_28","doi-asserted-by":"crossref","first-page":"15","DOI":"10.1016\/j.comnet.2020.107168","article-title":"New hybrid method for attack detection using combination of evolutionary algorithms, SVM, and ANN","volume":"173","author":"Hosseini","year":"2020","journal-title":"Comput. Netw."},{"key":"ref_29","doi-asserted-by":"crossref","unstructured":"Almaiah, M.A., Almomani, O., Alsaaidah, A., Al-Otaibi, S., Bani-Hani, N., Hwaitat, A.K.A., Al-Zahrani, A., Lutfi, A., Awad, A.B., and Aldhyani, T.H.H. (2022). Performance Investigation of Principal Component Analysis for Intrusion Detection System Using Different Support Vector Machine Kernels. Electronics, 11.","DOI":"10.3390\/electronics11213571"},{"key":"ref_30","doi-asserted-by":"crossref","unstructured":"Alzaqebah, A., Aljarah, I., Al-Kadi, O., and Dama\u0161evi\u010dius, R. (2022). A Modified Grey Wolf Optimization Algorithm for an Intrusion Detection System. Mathematics, 10.","DOI":"10.3390\/math10060999"},{"key":"ref_31","doi-asserted-by":"crossref","first-page":"102767","DOI":"10.1016\/j.jnca.2020.102767","article-title":"Deep learning methods in network intrusion detection: A survey and an objective comparison","volume":"169","author":"Gamage","year":"2020","journal-title":"J. Netw. Comput. Appl."},{"key":"ref_32","doi-asserted-by":"crossref","unstructured":"Abdulhammed, R., Musafer, H., Alessa, A., Faezipour, M., and Abuzneid, A. (2019). Features dimensionality reduction approaches for machine learning based network intrusion detection. Electronics, 8.","DOI":"10.3390\/electronics8030322"},{"key":"ref_33","doi-asserted-by":"crossref","first-page":"102177","DOI":"10.1016\/j.adhoc.2020.102177","article-title":"IGAN-IDS: An imbalanced generative adversarial network towards intrusion detection system in ad-hoc networks","volume":"105","author":"Huang","year":"2020","journal-title":"Ad Hoc Netw."},{"key":"ref_34","doi-asserted-by":"crossref","unstructured":"Lin, P., Ye, K., and Xu, C.Z. (2019, January 25\u201330). Dynamic network anomaly detection system by using deep learning techniques. Proceedings of the International Conference on Cloud Computing, San Diego, CA, USA.","DOI":"10.1007\/978-3-030-23502-4_12"},{"key":"ref_35","unstructured":"(2022, November 27). CSE-CIC-IDS2018 Dataset. Available online: https:\/\/www.unb.ca\/cic\/datasets\/ids-2018.html."},{"key":"ref_36","doi-asserted-by":"crossref","unstructured":"Sharafaldin, I., Lashkari, A.H., and Ghorbani, A.A. (2018, January 22\u201324). Toward generating a new intrusion detection dataset and intrusion traffic characterization. Proceedings of the 4th International Conference on Information Systems Security and Privacy, Funchal, Portugal.","DOI":"10.5220\/0006639801080116"},{"key":"ref_37","unstructured":"Guyon, I., Luxburg, U.V., Bengio, S., Wallach, H., Fergus, R., Vishwanathan, S., and Garnett, R. (2017). Advances in Neural Information Processing Systems 30, Neural Information Processing Systems (Nips). Advances in Neural Information Processing Systems."},{"key":"ref_38","doi-asserted-by":"crossref","first-page":"321","DOI":"10.1613\/jair.953","article-title":"SMOTE: Synthetic minority over-sampling technique","volume":"16","author":"Chawla","year":"2002","journal-title":"J. Artif. Intell. Res."},{"key":"ref_39","doi-asserted-by":"crossref","first-page":"2231","DOI":"10.1109\/TNNLS.2018.2881194","article-title":"Visualization methods for image transformation convolutional neural networks","volume":"30","author":"Protas","year":"2019","journal-title":"IEEE Trans. Neural Netw. Learn. Syst."},{"key":"ref_40","unstructured":"Simonyan, K., and Zisserman, A. (2015). Very deep convolutional networks for large-scale image recognition. arXiv."},{"key":"ref_41","doi-asserted-by":"crossref","unstructured":"Chicco, D., and Jurman, G. (2020). The advantages of the matthews correlation coefficient (MCC) over F1 score and accuracy in binary classification evaluation. BMC Genom., 21.","DOI":"10.1186\/s12864-019-6413-7"},{"key":"ref_42","first-page":"102419","article-title":"Deep learning for cyber security intrusion detection: Approaches, datasets, and comparative study","volume":"50","author":"Ferrag","year":"2020","journal-title":"J. Inf. Secur. Appl."}],"container-title":["Information"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2078-2489\/14\/2\/77\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,10]],"date-time":"2025-10-10T18:18:48Z","timestamp":1760120328000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2078-2489\/14\/2\/77"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,1,29]]},"references-count":42,"journal-issue":{"issue":"2","published-online":{"date-parts":[[2023,2]]}},"alternative-id":["info14020077"],"URL":"https:\/\/doi.org\/10.3390\/info14020077","relation":{},"ISSN":["2078-2489"],"issn-type":[{"value":"2078-2489","type":"electronic"}],"subject":[],"published":{"date-parts":[[2023,1,29]]}}}