Enhancing IoT anomaly detection with the Dwarf Mongoose-Chaos optimized deep belief framework

Abstract

Anomaly detection is essential for identifying deviations from normal patterns in data, enabling the detection of security breaches or system faults, particularly in Internet of Things (IoT) networks. However, traditional machine learning (ML) and deep learning (DL) methods often struggle with the dynamic and complex nature of IoT environments, where attack patterns are non-linear, continuously evolving, and context-dependent. These models typically require large labeled datasets and retraining to adapt to new threats, which limits their responsiveness and scalability. Additionally, their high computational demands make real-time deployment on resource-constrained IoT devices challenging. Furthermore, many ML/DL models exhibit poor generalization, performing well in controlled scenarios but failing to maintain accuracy across diverse, real-world IoT settings with varying devices, protocols, and data distributions. To address these issues, this work proposes the Dwarf Mongoose-Chaos Optimized Deep Belief (DCODB) Framework, which combines advanced preprocessing, feature selection (FS), and classification techniques. Initial preprocessing involves Min-Max Normalization and One-Hot Encoding to scale numerical features and transform categorical data for effective model input. FS is optimized by the novel Dwarf Mongoose-Chaos Fusion Optimization (DMCFO), which is a swarm intelligence algorithm that leverages chaotic maps to improve the effectiveness of the Dwarf Mongoose Optimization Algorithm (DMO), reducing dimensionality and improving classification accuracy. The refined features are then classified using a Deep Belief Network (DBN), which processes hierarchical feature representations to differentiate between normal and anomalous behaviors in the NSL-KDD dataset. The proposed framework has been thoroughly assessed using diverse metrics, demonstrating its effectiveness in anomaly detection by achieving above 99 % Balanced Accuracy, along with exceptional Precision, Recall, F1 Score, Specificity, and the AUC-ROC curve. These high-performance metrics affirm the model's capability to deliver reliable and scalable anomaly detection in IoT environments, strengthening overall security.