The Internet of Things (IoT) is expanding and transforming industries from healthcare to smart cities. However, IoT devices' increasing connectivity and diversity still raise significant security concerns. Traditional security systems make networks more resilient to distributed and resource-constrained IoT [1].

environments. Attacks such as Distributed Denial of Service (DDoS), ransomware, and unauthorized data deletion are becoming increasingly frequent and sophisticated, posing significant challenges to the IoT ecosystem. These challenges require new solutions. Machine Learning (ML) holds promise for improving IoT security by detecting malicious activity from data patterns [2]. However, relying solely on supervision or unsupervised training can be limiting. Pattern tracking is good at identifying known attack patterns but struggles to detect new, unseen threats [3]. On the other hand, unsupervised models can flag anomalies without prior knowledge of attack patterns, but they are more likely to be negative. Supervised and unsupervised techniques are used to develop threats in IoT systems. Using both methods, hybrid models can detect various threats, from stealth attacks to zero-day attacks. Our solutions are evaluated using a real-world IoT dataset, and the results are evaluated using traditional machine-learning methods [4].

Let X represent the input data, the IoT traffic features extracted from the devices. Let y represent the known traffic labels (e.g., normal or malicious). Y' is the predicted label from the ML model. f(X) is the decision function applied by the supervised learning model. L(y,y’ ) is the loss function that minimizes the error between the actual and predicted values. Z represents the latent features from the unsupervised learning module (e.g., for anomaly detection). D(X, Z) represents the decision function of the hybrid model combining supervised and unsupervised results. The basic prediction of a supervised model can be represented as

Y' =f(X), (1)

where f(X) is the function learned by the supervised classifier to predict the output based on input features X. For the loss function that measures the error between actual and predicted values, the cross-entropy loss is commonly used in classification problems:

L(y,y’) =−∑ y log (y’). (2) In a hybrid model, the anomaly detection function (unsupervised) for IoT traffic can be defined as

Z=g(X), (3)

where g(X) extracts latent variables or anomalies in the data. The final decision function in the hybrid model, combining supervised and unsupervised techniques, can be written as

D(X, Z)=αf(X)+βg(X), (4)

where α and β are weights assigned to supervised and unsupervised learning components, depending on their contribution to the overall prediction.

These equations explain the relationships between various components of your hybrid ML model for IoT Security and how supervised and unsupervised techniques work together for threat detection.

Many studies have applied ML techniques to IoT security. Supervised learning algorithms such as random forest and Support Vector Machines (SVM) have been used in intrusion detection and have shown high accuracy in classifying known threats [5]. For example, Fleury et al. [6] used SVM to analyze network connections in a smart home environment and obtain high-level classification. However, this technique requires logging and cannot detect zero-day attacks. This model works well without log information but often suffers from unpleasant consequences. Priyadarshini et al. [7] investigate the use of autoencoders to identify vulnerabilities in smart city infrastructure, highlighting the potential and challenges of vulnerability. Promise. The hybrid model provides the advantages of supervised and unsupervised learning. Mirsky et al. [8] demonstrated the potential of hybrid models in detecting known and unknown threats in critical systems. Based on this process, our model aims to improve detection accuracy further while reducing the vulnerability in the IoT environment.

The proposed hybrid model consists of two primary components: anomaly detection and supervised classification. These components are integrated to detect known and unknown threats in IoT traffic.

The author would like to thank Kiit university for providing support and resources that played a significant role in completing the research on hybrid ML models for IoT security. We are particularly grateful to Hitesh Mahapatra for his expert guidance and thoughtful approach, which played a significant role in developing the established standard of research and practice. The staff for assistance in setting up and maintaining the necessary IoT infrastructure for operational testing. We would also like to thank our colleagues for their collaboration and suggestions, whose comments helped improve our process and contributed to all this great work.

This research received no specific grant from funding agencies in the public, commercial, or not-for-profit sectors. The authors carried out all work independently in their respective institutional research activities. KIIT University provided the infrastructure and computational resources for this research.

The data used in this research, including the IoT-23 dataset, is publicly available and can be accessed from the Stratosphere Laboratory at the following link: https://www.stratosphereips.org/datasets-iot23. Any additional data generated or analyzed during this study is available from the corresponding author upon reasonable request.

The authors declare that there are no conflicts of interest regarding the publication of this paper. They have no financial, personal, or professional relationships that could be perceived as influencing the research presented here. Additionally, the authors confirm that no competing interests from any third-party organizations or funding sources could have affected the design, execution, or reporting of the findings. This study was conducted independently as part of the authors' academic work, with no external influence or bias. All conclusions drawn are based solely on the data and analysis performed.