{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,15]],"date-time":"2026-07-15T17:19:42Z","timestamp":1784135982620,"version":"3.55.0"},"reference-count":68,"publisher":"MDPI AG","issue":"11","license":[{"start":{"date-parts":[[2023,6,2]],"date-time":"2023-06-02T00:00:00Z","timestamp":1685664000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Sensors"],"abstract":"<jats:p>IoT devices have grown in popularity in recent years. Statistics show that the number of online IoT devices exceeded 35 billion in 2022. This rapid growth in adoption made these devices an obvious target for malicious actors. Attacks such as botnets and malware injection usually start with a phase of reconnaissance to gather information about the target IoT device before exploitation. In this paper, we introduce a machine-learning-based detection system for reconnaissance attacks based on an explainable ensemble model. Our proposed system aims to detect scanning and reconnaissance activity of IoT devices and counter these attacks at an early stage of the attack campaign. The proposed system is designed to be efficient and lightweight to operate in severely resource-constrained environments. When tested, the implementation of the proposed system delivered an accuracy of 99%. Furthermore, the proposed system showed low false positive and false negative rates at 0.6% and 0.05%, respectively, while maintaining high efficiency and low resource consumption.<\/jats:p>","DOI":"10.3390\/s23115298","type":"journal-article","created":{"date-parts":[[2023,6,2]],"date-time":"2023-06-02T10:08:41Z","timestamp":1685700521000},"page":"5298","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":19,"title":["XRecon: An Explainbale IoT Reconnaissance Attack Detection System Based on Ensemble Learning"],"prefix":"10.3390","volume":"23","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-4324-1774","authenticated-orcid":false,"given":"Mohammed M.","family":"Alani","sequence":"first","affiliation":[{"name":"Cybersecurity Research Lab, Toronto Metropolitan University, Toronto, ON M5B 2K3, Canada"},{"name":"School of IT Administration and Security, Seneca College, Toronto, ON M2J 2X5, Canada"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9557-6496","authenticated-orcid":false,"given":"Ernesto","family":"Damiani","sequence":"additional","affiliation":[{"name":"Center of Cyber-Physical Systems (C2PS), Khalifa University, Abu Dhabi 127788, United Arab Emirates"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2023,6,2]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"1645","DOI":"10.1016\/j.future.2013.01.010","article-title":"Internet of Things (IoT): A vision, architectural elements, and future directions","volume":"29","author":"Gubbi","year":"2013","journal-title":"Future Gener. Comput. Syst."},{"key":"ref_2","unstructured":"(2021, April 26). 2020\u2019s Internet of Things Statistics, Facts & Predictions. Available online: https:\/\/review42.com\/resources\/internet-of-things-stats."},{"key":"ref_3","unstructured":"(2021, April 29). Android|The Platform Pushing What\u2019s Possible. Available online: https:\/\/www.android.com\/intl\/en_ca."},{"key":"ref_4","unstructured":"The Raspberry Pi Foundation (2023, January 21). Operating System Images\u2014Raspberry Pi. Available online: https:\/\/www.raspberrypi.org\/software\/operating-systems."},{"key":"ref_5","unstructured":"Alani, M.M. (2022). Advances in Nature-Inspired Cyber Security and Resilience, Springer International Publishing."},{"key":"ref_6","unstructured":"(2022, September 05). IoT Devices Installed Base Worldwide 2015\u20132025|Statista. Available online: https:\/\/www.statista.com\/statistics\/471264\/iot-number-of-connected-devices-worldwide."},{"key":"ref_7","unstructured":"(2021, May 01). OT\/IoT Security Report February 2021|Nozomi Networks. Available online: https:\/\/www.nozominetworks.com\/landing\/ot-iot-security-report-february-2021\/."},{"key":"ref_8","first-page":"390","article-title":"A Survey on Various Cyber Attacks and their Classification","volume":"15","author":"Uma","year":"2013","journal-title":"IJ Netw. Secur."},{"key":"ref_9","doi-asserted-by":"crossref","unstructured":"Yadav, T., and Rao, A.M. (2015, January 10\u201313). Technical aspects of cyber kill chain. Proceedings of the International Symposium on Security in Computing and Communication, Kochi, India.","DOI":"10.1007\/978-3-319-22915-7_40"},{"key":"ref_10","doi-asserted-by":"crossref","unstructured":"Alani, M.M. (2023). An explainable efficient flow-based Industrial IoT intrusion detection system. Comput. Electr. Eng., 19.","DOI":"10.1016\/j.compeleceng.2023.108732"},{"key":"ref_11","unstructured":"(2021, October 21). Nmap. Available online: https:\/\/nmap.org."},{"key":"ref_12","unstructured":"(2021, April 30). Shodan. Available online: https:\/\/www.shodan.io."},{"key":"ref_13","unstructured":"(2021, April 30). Home\u2014Censys. Available online: https:\/\/censys.io."},{"key":"ref_14","unstructured":"(2021, October 21). Drupal\u2014Open Source CMS. Available online: https:\/\/www.drupal.org."},{"key":"ref_15","unstructured":"(2021, April 30). CVE\u2014CVE. Available online: https:\/\/cve.mitre.org."},{"key":"ref_16","unstructured":"(2021, October 21). CVE\u2014CVE-2014-3704. Available online: https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2014-3704."},{"key":"ref_17","unstructured":"(2021, April 30). Metasploit|Penetration Testing Software, Pen Testing Security|Metasploit. Available online: https:\/\/www.metasploit.com."},{"key":"ref_18","unstructured":"(2021, May 01). OT\/IoT Security Report: Rising IoT Botnets and Shifting Ransomware Escalate Enterprise Risk. Available online: https:\/\/www.nozominetworks.com\/blog\/what-it-needs-to-know-about-ot-io-security-threats-in-2020."},{"key":"ref_19","doi-asserted-by":"crossref","first-page":"378","DOI":"10.1016\/j.comnet.2012.07.021","article-title":"Botnets: A survey","volume":"57","author":"Silva","year":"2013","journal-title":"Comput. Netw."},{"key":"ref_20","doi-asserted-by":"crossref","first-page":"53","DOI":"10.1016\/j.comcom.2022.06.039","article-title":"BotStop: Packet-based efficient and explainable IoT botnet detection using machine learning","volume":"193","author":"Alani","year":"2022","journal-title":"Comput. Commun."},{"key":"ref_21","unstructured":"Author, G. (2023, January 21). Inside the infamous Mirai IoT Botnet: A Retrospective Analysis. Cloudflare Blog. Available online: https:\/\/blog.cloudflare.com\/inside-mirai-the-infamous-iot-botnet-a-retrospective-analysis."},{"key":"ref_22","unstructured":"O\u2019Donnell, L. (2023, January 21). Latest Mirai Variant Targets SonicWall, D-Link and IoT Devices. Threatpost. Available online: https:\/\/threatpost.com\/mirai-variant-sonicwall-d-link-iot\/164811."},{"key":"ref_23","unstructured":"Montalbano, E. (2023, January 21). New Mirai Variant \u2018Mukashi\u2019 Targets Zyxel NAS Devices. Threatpost. Available online: https:\/\/threatpost.com\/new-mirai-variant-mukashi-targets-zyxel-nas-devices\/153982."},{"key":"ref_24","unstructured":"(2021, May 01). Mirai Variant Targeting New IoT Vulnerabilities, Network Security Devices. Available online: https:\/\/unit42.paloaltonetworks.com\/mirai-variant-iot-vulnerabilities."},{"key":"ref_25","doi-asserted-by":"crossref","first-page":"80","DOI":"10.1109\/MC.2017.201","article-title":"DDoS in the IoT: Mirai and other botnets","volume":"50","author":"Kolias","year":"2017","journal-title":"Computer"},{"key":"ref_26","doi-asserted-by":"crossref","first-page":"339","DOI":"10.14257\/ijfgcn.2016.9.6.32","article-title":"Rule-Based Network Intrusion Detection System for Port Scanning with Efficient Port Scan Detection Rules Using Snort","volume":"9","author":"Patel","year":"2016","journal-title":"Int. J. Future Gener. Commun. Netw."},{"key":"ref_27","unstructured":"(2021, May 02). Snort\u2014Network Intrusion Detection & Prevention System. Available online: https:\/\/www.snort.org."},{"key":"ref_28","doi-asserted-by":"crossref","unstructured":"Sforzin, A., M\u00e1rmol, F.G., Conti, M., and Bohli, J.M. (2016, January 18\u201321). Rpids: Raspberry pi ids\u2014A fruitful intrusion detection system for iot. Proceedings of the 2016 International IEEE Conferences on Ubiquitous Intelligence & Computing, Advanced and Trusted Computing, Scalable Computing and Communications, Cloud and Big Data Computing, Internet of People, and Smart World Congress (UIC\/ATC\/ScalCom\/CBDCom\/IoP\/SmartWorld), Toulouse, France.","DOI":"10.1109\/UIC-ATC-ScalCom-CBDCom-IoP-SmartWorld.2016.0080"},{"key":"ref_29","doi-asserted-by":"crossref","unstructured":"Ananin, E.V., Nikishova, A.V., and Kozhevnikova, I.S. (2017, January 14\u201316). Port scanning detection based on anomalies. Proceedings of the 2017 Dynamics of Systems, Mechanisms and Machines (Dynamics), Omsk, Russia.","DOI":"10.1109\/Dynamics.2017.8239427"},{"key":"ref_30","doi-asserted-by":"crossref","first-page":"1098","DOI":"10.1109\/TNSM.2017.2724239","article-title":"Deceiving network reconnaissance using SDN-based virtual topologies","volume":"14","author":"Achleitner","year":"2017","journal-title":"IEEE Trans. Netw. Serv. Manag."},{"key":"ref_31","doi-asserted-by":"crossref","unstructured":"Das, A.K., Nayak, J., Naik, B., Dutta, S., and Pelusi, D. (2022). Computational Intelligence in Pattern Recognition, Springer.","DOI":"10.1007\/978-981-16-2543-5"},{"key":"ref_32","doi-asserted-by":"crossref","unstructured":"Viet, H.N., Van, Q.N., Trang, L.L.T., and Nathan, S. (2018, January 25\u201327). Using Deep Learning Model for Network Scanning Detection. Proceedings of the 4th International Conference on Frontiers of Educational Technologies\u2014ICFET\u201918, Moscow, Russia.","DOI":"10.1145\/3233347.3233379"},{"key":"ref_33","unstructured":"(2021, May 02). NSL-KDD|Datasets|Research|Canadian Institute for Cybersecurity|UNB. Available online: https:\/\/www.unb.ca\/cic\/datasets\/nsl.html."},{"key":"ref_34","doi-asserted-by":"crossref","unstructured":"Moustafa, N., and Slay, J. (2015, January 10\u201312). UNSW-NB15: A comprehensive data set for network intrusion detection systems (UNSW-NB15 network data set). Proceedings of the 2015 Military Communications and Information Systems Conference (MilCIS), Canberra, Australia.","DOI":"10.1109\/MilCIS.2015.7348942"},{"key":"ref_35","doi-asserted-by":"crossref","first-page":"12","DOI":"10.1109\/MPRV.2018.03367731","article-title":"N-baiot\u2014Network-based detection of iot botnet attacks using deep autoencoders","volume":"17","author":"Meidan","year":"2018","journal-title":"IEEE Pervasive Comput."},{"key":"ref_36","doi-asserted-by":"crossref","unstructured":"Anthi, E., Williams, L., and Burnap, P. (2018, January 28\u201329). Pulse: An adaptive intrusion detection for the internet of things. Proceedings of the Living in the Internet of Things: Cybersecurity of the IoT 2018, London, UK.","DOI":"10.1049\/cp.2018.0035"},{"key":"ref_37","doi-asserted-by":"crossref","first-page":"9042","DOI":"10.1109\/JIOT.2019.2926365","article-title":"A Supervised Intrusion Detection System for Smart Home IoT Devices","volume":"6","author":"Anthi","year":"2019","journal-title":"IEEE Internet Things J."},{"key":"ref_38","doi-asserted-by":"crossref","first-page":"66","DOI":"10.1016\/j.asoc.2018.06.017","article-title":"Securing the operations in SCADA-IoT platform based industrial control system using ensemble of deep belief networks","volume":"71","author":"Huda","year":"2018","journal-title":"Appl. Soft Comput."},{"key":"ref_39","doi-asserted-by":"crossref","unstructured":"Hasan, M., Islam, M.M., Zarif, M.I.I., and Hashem, M. (2019). Attack and anomaly detection in IoT sensors in IoT sites using machine learning approaches. Internet Things, 7.","DOI":"10.1016\/j.iot.2019.100059"},{"key":"ref_40","unstructured":"G\u00e9ron, A. (2019). Hands-On Machine Learning with Scikit-Learn, Keras, and TensorFlow: Concepts, Tools, and Techniques to Build Intelligent Systems, O\u2019Reilly Media."},{"key":"ref_41","doi-asserted-by":"crossref","unstructured":"Tzagkarakis, C., Petroulakis, N., and Ioannidis, S. (2019, January 17\u201321). Botnet attack detection at the IoT edge based on sparse representation. Proceedings of the 2019 Global IoT Summit (GIoTS), Aarhus, Denmark.","DOI":"10.1109\/GIOTS.2019.8766388"},{"key":"ref_42","doi-asserted-by":"crossref","first-page":"45","DOI":"10.1109\/TNSM.2020.2966951","article-title":"IoT-KEEPER: Detecting malicious IoT network activity using online traffic analysis at the edge","volume":"17","author":"Hafeez","year":"2020","journal-title":"IEEE Trans. Netw. Serv. Manag."},{"key":"ref_43","doi-asserted-by":"crossref","unstructured":"Kim, J., Shim, M., Hong, S., Shin, Y., and Choi, E. (2020). Intelligent detection of iot botnets using machine learning and deep learning. Appl. Sci., 10.","DOI":"10.3390\/app10197009"},{"key":"ref_44","doi-asserted-by":"crossref","unstructured":"Nsabimana, T., Hounsou, J.T., Damiani, E., Houngbo, P., and Frati, F. (2022). Hybrid Intrusion Detection and Prevention Systems Using Hierarchical Radial Basis Function Neural Networks. SSRN Electronic J.","DOI":"10.2139\/ssrn.4231425"},{"key":"ref_45","doi-asserted-by":"crossref","unstructured":"Sudharsan, B., Sundaram, D., Patel, P., Breslin, J.G., and Ali, M.I. (2021, January 22\u201326). Edge2guard: Botnet attacks detecting offline models for resource-constrained iot devices. Proceedings of the 2021 IEEE International Conference on Pervasive Computing and Communications Workshops and other Affiliated Events (PerCom Workshops), Kassel, Germany.","DOI":"10.1109\/PerComWorkshops51409.2021.9431086"},{"key":"ref_46","doi-asserted-by":"crossref","unstructured":"Alhowaide, A., Alsmadi, I., and Tang, J. (2021). Ensemble detection model for IoT IDS. Internet Things, 16.","DOI":"10.1016\/j.iot.2021.100435"},{"key":"ref_47","doi-asserted-by":"crossref","unstructured":"Alani, M.M., and Miri, A. (2022). Towards an Explainable Universal Feature Set for IoT Intrusion Detection. Sensors, 22.","DOI":"10.3390\/s22155690"},{"key":"ref_48","doi-asserted-by":"crossref","first-page":"1164","DOI":"10.1109\/OJCOMS.2022.3188750","article-title":"\u201cWhy Should I Trust Your IDS?\u201d: An Explainable Deep Learning Framework for Intrusion Detection Systems in Internet of Things Networks","volume":"3","author":"Brik","year":"2022","journal-title":"IEEE Open J. Commun. Soc."},{"key":"ref_49","doi-asserted-by":"crossref","first-page":"1000","DOI":"10.1109\/TITS.2022.3188671","article-title":"An Explainable Deep Learning Framework for Resilient Intrusion Detection in IoT-Enabled Transportation Networks","volume":"24","author":"Oseni","year":"2022","journal-title":"IEEE Trans. Intell. Transp. Syst."},{"key":"ref_50","doi-asserted-by":"crossref","first-page":"683","DOI":"10.1109\/TII.2022.3192035","article-title":"An Intelligent Two-Layer Intrusion Detection System for the Internet of Things","volume":"19","author":"Alani","year":"2022","journal-title":"IEEE Trans. Ind. Inform."},{"key":"ref_51","doi-asserted-by":"crossref","first-page":"163412","DOI":"10.1109\/ACCESS.2021.3131014","article-title":"A Two-Fold Machine Learning Approach to Prevent and Detect IoT Botnet Attacks","volume":"9","author":"Hussain","year":"2021","journal-title":"IEEE Access"},{"key":"ref_52","doi-asserted-by":"crossref","first-page":"3930","DOI":"10.1109\/JIOT.2021.3100755","article-title":"Federated deep learning for zero-day botnet attack detection in IoT-edge devices","volume":"9","author":"Popoola","year":"2021","journal-title":"IEEE Internet Things J."},{"key":"ref_53","doi-asserted-by":"crossref","first-page":"3692","DOI":"10.1109\/TII.2021.3108464","article-title":"Concept Drift Analysis by Dynamic Residual Projection for Effectively Detecting Botnet Cyber-Attacks in IoT Scenarios","volume":"18","author":"Qiao","year":"2021","journal-title":"IEEE Trans. Ind. Inform."},{"key":"ref_54","doi-asserted-by":"crossref","unstructured":"Alani, M.M. (2014). Guide to OSI and TCP\/IP Models, Springer.","DOI":"10.1007\/978-3-319-05152-9"},{"key":"ref_55","doi-asserted-by":"crossref","unstructured":"Sagi, O., and Rokach, L. (2018). Ensemble learning: A survey. Wired Data Min. Knowl. Discov., 8.","DOI":"10.1002\/widm.1249"},{"key":"ref_56","doi-asserted-by":"crossref","first-page":"122","DOI":"10.1016\/j.ins.2023.03.085","article-title":"Robust ML Model Ensembles via Risk-driven Anti-clustering of Training Data","volume":"633","author":"Mauri","year":"2023","journal-title":"Inf. Sci."},{"key":"ref_57","unstructured":"Kang, H., Ahn, D.H., Lee, G.M., Yoo, J.D., Park, K.H., and Kim, H.K. (2019). IoT network intrusion dataset. IEEE Dataport."},{"key":"ref_58","unstructured":"(2021, April 26). tshark\u2014The Wireshark Network Analyzer 3.4.5. Available online: https:\/\/www.wireshark.org\/docs\/man-pages\/tshark.html."},{"key":"ref_59","unstructured":"Raschka, S., Liu, Y.H., Mirjalili, V., and Dzhulgakov, D. (2022). Machine Learning with PyTorch and Scikit-Learn: Develop Machine Learning and Deep Learning Models with Python, Packt Publishing Ltd."},{"key":"ref_60","unstructured":"Moustafa, N. (2019, January 21\u201325). New Generations of Internet of Things Datasets for Cybersecurity Applications based Machine Learning: TON_IoT Datasets. Proceedings of the eResearch Australasia Conference, Brisbane, Australia."},{"key":"ref_61","unstructured":"(2021, October 27). TCPDUMP\/LIBPCAP Public Repository. Available online: https:\/\/www.tcpdump.org."},{"key":"ref_62","unstructured":"Lundberg, S.M., and Lee, S.I. (2017, January 4\u20139). A unified approach to interpreting model predictions. Proceedings of the Annual Conference on Neural Information Processing Systems 2017, Long Beach, CA, USA."},{"key":"ref_63","doi-asserted-by":"crossref","unstructured":"Kamath, U., and Liu, J. (2021). Explainable Artificial Intelligence: An Introduction to Interpretable Machine Learning, Springer.","DOI":"10.1007\/978-3-030-83356-5"},{"key":"ref_64","unstructured":"Morris, T., and Gao, W. (2014, January 17\u201319). Industrial control system traffic data sets for intrusion detection research. Proceedings of the International Conference on Critical Infrastructure Protection, Arlington, VA, USA."},{"key":"ref_65","doi-asserted-by":"crossref","first-page":"276","DOI":"10.1016\/j.future.2021.09.027","article-title":"A lightweight supervised intrusion detection mechanism for IoT networks","volume":"127","author":"Roy","year":"2022","journal-title":"Future Gener. Comput. Syst."},{"key":"ref_66","doi-asserted-by":"crossref","unstructured":"Lo, W.W., Layeghy, S., Sarhan, M., Gallagher, M., and Portmann, M. (2022, January 25\u201329). E-GraphSAGE: A Graph Neural Network based Intrusion Detection System for IoT. Proceedings of the NOMS 2022\u20142022 IEEE\/IFIP Network Operations and Management Symposium, Budapest, Hungary.","DOI":"10.1109\/NOMS54207.2022.9789878"},{"key":"ref_67","unstructured":"Khan, M.A., Khan Khattk, M.A., Latif, S., Shah, A.A., Ur Rehman, M., Boulila, W., Driss, M., and Ahmad, J. (2022). Advances on Smart and Soft Computing, Springer."},{"key":"ref_68","doi-asserted-by":"crossref","unstructured":"Awotunde, J.B., Abiodun, K.M., Adeniyi, E.A., Folorunso, S.O., and Jimoh, R.G. (2021, January 25\u201327). A deep learning-based intrusion detection technique for a secured IoMT system. Proceedings of the International Conference on Informatics and Intelligent Applications, Ota, Nigeria.","DOI":"10.1007\/978-3-030-95630-1_4"}],"container-title":["Sensors"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1424-8220\/23\/11\/5298\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,10]],"date-time":"2025-10-10T19:48:08Z","timestamp":1760125688000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1424-8220\/23\/11\/5298"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,6,2]]},"references-count":68,"journal-issue":{"issue":"11","published-online":{"date-parts":[[2023,6]]}},"alternative-id":["s23115298"],"URL":"https:\/\/doi.org\/10.3390\/s23115298","relation":{},"ISSN":["1424-8220"],"issn-type":[{"value":"1424-8220","type":"electronic"}],"subject":[],"published":{"date-parts":[[2023,6,2]]}}}