Machine Learning in IoT Security: Current Solutions and Future Challenges

IoT foundations

• IoT comprises interconnected embedded systems and physical objects with limited computation, storage, and communication capabilities.These objects use sensors, actuators, software, and connectivity to collect, process, and exchange data.Source: §I · p. 1
• IoT spans applications from critical infrastructure and healthcare to agriculture, military, home appliances, transportation, and manufacturing.Its broad deployment creates challenges in device management, data handling, storage, communication, computation, security, and privacy.Source: §I · p. 1

Network characteristics

• IoT devices communicate through heterogeneous standards and paradigms while operating under variable hardware-resource constraints.Communication may use cellular, Ethernet, wired, wireless, device-centric, or content-centric approaches.Source: A. Characteristics of IoT Networks · p. 2
• Massive-scale deployment requires networking and storage architectures, efficient communication protocols, proactive attack protection, and technology standardization.IoT is expected to involve billions of interconnected devices whose scale may exceed current Internet capabilities.Source: A. Characteristics of IoT Networks · p. 2
• IoT connectivity can be local or global, supporting applications such as connected cars, sensor swarms, smart homes, and critical-infrastructure management.Devices may be accessible from anywhere and anytime depending on the service and application.Source: A. Characteristics of IoT Networks · p. 2

Operational requirements

• Critical IoT applications require ultra-reliable, low-latency communication, while massive connectivity requires ultra-low-power and low-cost operation.Industrial automation, remote surgery, and intelligent transportation are examples of latency- and reliability-sensitive applications.Source: A. Characteristics of IoT Networks · p. 2
• Self-organization, self-healing, and dynamic device behavior support IoT operation when infrastructure reliance is limited and sleep, wakeup, and communication patterns change.These characteristics are especially relevant in emergency or disaster situations.Source: A. Characteristics of IoT Networks · p. 2

Intelligence and safety

• IoT intelligence processes device-generated data to support timely decisions and actions, while safety protects consumers, devices, shared data, privacy, and device security.The scale of connected devices can jeopardize personal data shared through IoT systems.Source: A. Characteristics of IoT Networks · p. 2

Security challenges

• Security and privacy are central to commercializing IoT services, while constrained devices and operating environments create additional protection challenges.IoT security concerns span communication, data, privacy, architecture, identity management, and malware analysis.Source: B. Security Challenges in IoT Deployment · p. 2
• Resource constraints hinder adoption of sophisticated existing security solutions and motivate cross-layer designs with optimized cryptographic and other algorithms.IoT security issues share fundamental similarities with traditional IT but differ in the severity of device limitations.Source: C. Gaps in the Existing Security… · p. 2
• Complex security problems such as DDoS and intrusion detection can produce false positives that reduce solution effectiveness and consumer trust.The paper therefore calls for holistic, intelligent, robust, evolutionary, and scalable security and privacy mechanisms.Source: C. Gaps in the Existing Security… · p. 3

Machine learning

• ML builds behavioral models from example data or past experience and uses them to make predictions on newly input data.The paper describes ML as useful where human expertise is unavailable or problem solutions change over time.Source: D. Machine Learning: A Solution to IoT… · p. 3
• ML and DL are promising for IoT because devices generate large data volumes and can perform complex sensing and recognition tasks during real-time interactions.Applications discussed include face recognition, character recognition, malicious-code identification, and DDoS detection.Source: D. Machine Learning: A Solution to IoT… · p. 3
• Applying ML and DL in IoT remains challenging because diverse application data, effective labeling, and learning with minimal labeled data complicate model development.The paper highlights these challenges as multifaceted rather than confined to a single algorithmic issue.Source: D. Machine Learning: A Solution to IoT… · p. 3

Existing surveys

• Existing surveys generally do not focus on ML techniques or cover the full security and privacy spectrum of IoT networks.This paper addresses that gap through a comprehensive survey of ML and DL techniques used in IoT security.Source: E. Existing Surveys · p. 3

Scope

• The survey reviews IoT security requirements, threats, attacks, and ML- and DL-based security solutions.Source: F. Scope of This Survey and… · pp. 3–4

Contributions

• The paper examines research challenges and future directions for applying ML and DL in IoT networks.Source: F. Scope of This Survey and… · p. 4

Scope

• It investigates the limitations of existing IoT security solutions that motivate applying ML and DL techniques.Source: F. Scope of This Survey and… · p. 4

Motivation

• Resource-constrained IoT devices make sophisticated security mechanisms difficult to deploy against attacks.Source: §II · p. 4
• IoT security is complicated by heterogeneous communication technologies and security issues inherited from underlying systems.Source: B. Physical (PHY) and Link Layer… · pp. 4–5, §II · p. 4

Network layer

• Network-layer attacks target routing, data and traffic analysis, spoofing, man-in-the-middle attacks, and Sybil identities.Source: C. Network Layer Attacks · p. 5

Transport layer

• Denial-of-service attacks at the transport layer can choke networks and deny services to IoT applications.Source: D. Transport Layer Attacks · p. 5

Application layer

• Application-layer threats include buffer overflows, malware, denial of service, phishing, WebApp exploitation, cryptographic, side-channel, and man-in-the-middle attacks.Source: E. Application Layer Attacks · pp. 5, 7
• OWASP-identified vulnerabilities can enable malicious code injection, SQL injection, cross-site scripting, and object-referencing attacks.Source: E. Application Layer Attacks · p. 7, F. Multi-Layered Attacks · p. 7

Multilayer attacks

• Multilayer attacks include traffic analysis, side channels, replay, man-in-the-middle, and protocol attacks, with traffic monitoring difficult to detect.Source: F. Multi-Layered Attacks · p. 7

Cloud-based IoT

• Cloud computing handles massive IoT data through storage, processing, device management, resource management, and analysis services.Source: G. Security Issues in Cloud-Based IoT · pp. 7–8

ML classes

• Machine learning is categorized into supervised, unsupervised, semi-supervised, and reinforcement learning.Source: A. Basic Machine Learning Algorithms · p. 8
• Supervised learning uses labeled inputs and desired outputs, whereas unsupervised learning groups unlabeled data by similarity.Source: A. Basic Machine Learning Algorithms · p. 8
• Semi-supervised learning addresses settings where labeling is costly and only some observations are labeled.Source: A. Basic Machine Learning Algorithms · p. 8
• Reinforcement learning selects actions from environmental feedback to maximize long-term rewards.Source: A. Basic Machine Learning Algorithms · p. 8

DL and DRL

• DL and RL are combined when state spaces and data dimensionality are large and environments are non-stationary.Source: B. Deep Learning (DL) and Deep… · p. 9

Security applications

• The surveyed security applications include authentication, attack detection and mitigation, DDoS detection, anomaly and intrusion detection, and malware analysis.Source: C. Machine Learning Techniques Used in… · p. 9

Supervised learning

• Supervised algorithms use labeled data for IoT security and include classification and regression techniques such as SVM, Naive Bayes, and Random Forest.Source: C. Machine Learning Techniques Used in… · p. 9

Unsupervised learning

• Unsupervised learning supports anomaly, fault, and intrusion detection using methods such as K-means and hierarchical clustering.Source: C. Machine Learning Techniques Used in… · p. 10
• K-means requires the number of clusters in advance and performs poorly when clusters are not globular.Source: C. Machine Learning Techniques Used in… · p. 11

Reinforcement learning

• Reinforcement learning does not require extensive training data but requires state-transition knowledge and may converge slowly.Source: C. Machine Learning Techniques Used in… · p. 11

Deep learning

• DL-based algorithms are described as offering lower latency and complexity than conventional theoretical approaches under IoT resource constraints.Source: C. Machine Learning Techniques Used in… · p. 11

Data and computational constraints

• IoT traffic has high volume, diversity, variable speed, and uncertainty, challenging the efficiency and scalability of traditional ML techniques.The paper notes that traditional ML may require considerable modification to manage IoT data at this scale.Source: D. Limitations in Applying Machine… · p. 12
• Conventional ML has memory, computational, sample-complexity, and scalability limitations that make direct deployment unsuitable for energy- and processing-constrained IoT devices.IoT devices typically have limited processing power and require real-time data processing.Source: 1) Processing power and energy · p. 12

Data heterogeneity

• ML training commonly assumes complete data availability and stable statistical properties, whereas IoT data can arrive at unprecedented volume and vary across sources or dataset regions.These conditions create difficulties for traditional ML algorithms and can reduce predictive ability as dimensionality increases.Source: 1) Processing power and energy · p. 12, 2) Data management and analytics · p. 12
• IoT data is syntactically and semantically heterogeneous, complicating efficient unified generalization across diverse types, formats, meanings, and datasets.The passage identifies heterogeneity as a serious data-management challenge across IoT applications.Source: 2) Data management and analytics · p. 12

Security-solution scope

• The paper surveys existing ML-based solutions for different IoT security issues, including authentication, access control, attack detection, and intrusion detection.The surveyed access-control literature includes role-, context-, policy-, attribute-, usage-, capability-, and organization-based mechanisms.Source: §IV · p. 12, A. Authentication and Access Control… · pp. 12–13

Authentication and access control

• Physical-layer authentication uses signal strength and combines game theory with ML to isolate spoofing nodes from benign IoT users.The mechanism is formulated as a zero-sum game between spoofing nodes and benign users.Source: 1) ML-based authentication and access… · p. 13
• WiFi channel-state information supports user authentication by combining coarse-grained activity recognition with human identification.Activity recognition uses fewer features and coarser-grained data than identification.Source: 2) DL-based authentication and access… · p. 13

Attack detection architectures

• IoT attack detection studies apply semi-supervised ELM with FCM, ML comparisons in smart grids, and DL mechanisms deployed near infrastructure in fog ecosystems.The ESFCM approach handles labeled data and is implemented in fog infrastructure, while fog-based DL reduces communication latency and uses available resources.Source: 1) ML-based attack detection and… · p. 13, 2) DL-based attack detection and… · pp. 13–14

DoS and DDoS challenges

• DoS and DDoS mitigation is difficult because IoT combines massive connectivity, heterogeneity, weak device security, cross-platform communication, and large-scale traffic.The literature reports that traditional mechanisms can suffer from inaccurate detection and false positives.Source: B. Attack Detection and Mitigation · p. 13, C. DoS and Distributed DoS (DDoS)… · p. 14
• Multi-level DDoS mitigation frameworks distribute monitoring across edge, fog, and cloud layers, using SDN gateways, controllers, traffic analysis, and honeypots.The described framework gathers network traffic at the fog level for analysis after edge-level processing.Source: C. DoS and Distributed DoS (DDoS)… · p. 14
• The literature concludes that resource-constrained IoT networks lack a single DDoS solution, while false positives may still block benign requests.These limitations motivate more intelligent detection and mitigation mechanisms.Source: C. DoS and Distributed DoS (DDoS)… · p. 14

ML-based DDoS detection

• DDoS detection studies compare K-nearest neighbors, decision trees, neural networks, random forests, and SVM, while other work applies SVM in SDN environments.The compared methods exploit distinctive communication patterns between IoT devices and endpoints.Source: 1) ML-based techniques to address DoS… · p. 14
• Multivariate Correlation Analysis detects DDoS through behavioral analysis of traffic flows between back-end servers used for IoT data gathering and processing.The mechanism focuses on server-side traffic rather than only device-side behavior.Source: 1) ML-based techniques to address DoS… · p. 14
• A SINR-based CPS DoS detector models the interaction between sensor and attacker as a multi-energy-level game and uses Nash Q-learning to establish equilibrium.The formulation accounts for sensor transmission-power consumption and attacker interference-power consumption.Source: 1) ML-based techniques to address DoS… · pp. 14–15
• Supervised ANNs and MLPs have been used to detect or thwart DDoS and DoS attacks in IoT and sensor networks.These approaches represent neural-network-based alternatives among the surveyed detection methods.Source: 2) DL-based Techniques to Address DoS… · p. 15

Intrusion detection motivation

• Traditional signature- and behavior-based schemes fail to detect zero-day intrusions, motivating AI-based intrusion detection in SDN-driven IoT.The surveyed AI mechanism captures network traffic flow and applies algorithms for feature processing.Source: D. Anomaly/Intrusion Detection · p. 15
• IoT intrusion detection requires attention to underlying technologies because security mechanisms and platforms are heterogeneous across sensor networks, Bluetooth, RFID, and WiFi.Surveyed work addresses intrusion detection across different networking paradigms and IoT architectures.Source: D. Anomaly/Intrusion Detection · p. 15

ML-based IDS approaches

• A lightweight IDS for 6LoWPAN combines K-means, decision trees, and a hybrid method to detect wormhole attacks in low-power IoT networks.The approach combines unsupervised and supervised learning techniques.Source: 1) ML-based IDS in IoT · p. 15
• IoT intrusion and anomaly detection also uses outlier detection, naive Bayes, RNNs, decision trees, DL, and game-theoretic methods.Some work targets unhealthy data, while other work considers the balance between energy consumption and intrusion detection.Source: 1) ML-based IDS in IoT · pp. 15–16
• Deep-learning IDS implementations include LSTM-based RNNs for heterogeneous IoT and two-layer random neural networks for fast anomaly detection in low-power networks.The surveyed systems learn normal behavior or train recurrent architectures for intrusion detection.Source: 2) DL-based IDS in IoT · p. 16

Malware threats

• IoT devices face malicious-code injection and execution through vulnerabilities involving application security, authentication, authorization, and physical tampering.The expanding number and heterogeneity of devices increase the attack surface described in the survey.Source: E. Malware Analysis in IoT · p. 16
• Internet-connected devices without proper security can be compromised individually or recruited at massive scale for attacks such as DDoS.The paper cites vulnerable smart devices, including music devices and web cameras, as examples.Source: E. Malware Analysis in IoT · p. 16
• Malware attacks against IoT include WanaCry, Cryptlocker, Mirai, and Stuxnet, with reported financial and reputational losses for industry.The paper presents these as optimized malware families targeting IoT devices.Source: E. Malware Analysis in IoT · p. 16
• Attackers select vulnerabilities from sources such as OWASP and deliver payloads through phishing, updates, rootkits, or other channels.The described attack process begins by identifying a vulnerability applicable to a device class.Source: E. Malware Analysis in IoT · p. 16

• Sophisticated malware can evade traditional detection, motivating behavior-based intelligent malware analysis for IoT networks.Source: 1) Malware evasion techniques · pp. 16–17
• ML-based malware detection has used random forests, SVMs, PCA, n-gram anomaly detection, and ensemble methods across Android, wireless multimedia, and home-router settings.Source: 2) ML-based malware analysis in IoT · p. 17
• SVM and PCA have also been applied to detect false-data injection and stealthy attacks using supervised and unsupervised learning.Source: 2) ML-based malware analysis in IoT · p. 17
• DL malware analysis has examined ARM-based IoT applications and IoBT OpCode sequences using RNNs, deep eigenspace learning, and deep convolutional networks.Source: 3) DL-based malware analysis in IoT · p. 17
• MalDozer uses ANN-based analysis of Android API-call sequences, permissions, and method calls while automatically engineering features during training.Source: 3) DL-based malware analysis in IoT · p. 17
• DL, RL, and related methods can extract complex features from high-dimensional unsupervised data, but their computational and storage overhead may limit IoT suitability.Source: F. Lessons Learned · pp. 17–18

• Deep-learning models trained for one problem may perform poorly on another and usually require retraining with corresponding data.Source: 1) DL – one size does not fit all · p. 18
• Application-specific retraining is especially difficult for real-time IoT systems, where models must adapt across similar problems and changing settings.Source: 1) DL – one size does not fit all · p. 18
• Deep neural networks are treated as black boxes, making their decision-making process difficult to inspect or predict in attack and intrusion detection.Source: 2) Neural networks are black boxes · p. 18
• RL convergence can become NP-hard and too slow for real-time or safety-critical applications such as autonomous driving.Source: 3) Longer convergence time · p. 18

• Small input perturbations can create enormous changes in learned outputs, enabling attackers to destabilize ML and DL systems.Source: 4) Butterfly effect of ML and DL · p. 18
• DL overhead, IoT data volume, and training time make deployment on edge devices difficult, especially for real-time and time-critical applications.Source: 5) Challenges for DL in the edge · p. 18
• Input manipulation can make deep-learning systems vulnerable to malicious control, including potential adversarial influence over self-driving vehicles.Source: 6) Vulnerability to security breaches · p. 18
• Heterogeneous, high-frequency IoT data creates challenges in collection, security, dependency, and the availability of sufficient datasets.Source: B. Challenges Related to IoT Data · pp. 18–19
• IoT data collection is constrained by privacy-sensitive sources, restricted network access, and policies governing cross-platform and cross-organization use.Source: 1) Data collection · p. 19, 2) Proximity effect · p. 19
• DL algorithms are data hungry and can fail when enough high-quality data is unavailable.Source: 3) Data dependency · p. 19
• Profound, authentic datasets and learning policies remain necessary to compare ML, DL, and RL performance in real physical environments.Source: 4) Unavailability of training datasets · p. 19

• Security-mechanism sophistication depends on device and system capabilities because advanced solutions require substantial computing, storage, and communication resources.Source: C. Efficiency of Security Solutions · p. 19
• Resource constraints create a trade-off between IoT security level and device capabilities, requiring low-cost and efficient mechanisms for mission-critical applications.Source: C. Efficiency of Security Solutions · p. 19
• Compromised IoT devices can distort application outcomes, with consequences varying across applications such as smart homes and healthcare.Source: 1) Complex cyber threats · p. 19
• IoT analytical data can reveal user identities, behavior, lifestyles, and health information, making privacy preservation necessary.Source: 2) Privacy preservation in ML- and… · pp. 19–20
• Anonymization can be hacked and training models can be compromised through false-data injection, threatening ML- and DL-based analytics.Source: 2) Privacy preservation in ML- and… · p. 20
• Adversarial Machine Learning exploits learning systems by manipulating training parameters or inputs to mislead their behavior.Source: 3) Adversarial machine learning and IoT · p. 20
• ML and DL can help IoT devices adapt to dynamic environments through distributed learning and statistical processing without centralized device-controller communication.Source: §VI · p. 20
• Scarce datasets make benchmarking ML- and DL-based IoT security solutions difficult, motivating stronger theoretical foundations and hybrid learning strategies.Source: §VI · p. 20