Anomaly Based Network Intrusion Detection System Using Filter‐Based Hybrid Feature Selection and Stacking Classifier for IoT Networks

The rapid growth of IoT technology brings unprecedented connectivity and convenience but also introduces serious security challenges. Addressing these vulnerabilities is critical, necessitating robust intrusion detection techniques. Anomaly‐based Network Intrusion Detection Systems (NIDS) play a pivotal role in securing IoT networks, acting as a cornerstone of modern cybersecurity infrastructure. However, due to the resource constraints and protocol diversity inherent in IoT environments, effective and efficient feature selection becomes essential. This research proposes a novel anomaly‐based NIDS framework that incorporates an adaptive, attack‐aware feature selection strategy. Initially, two well‐established filter‐based techniques—one‐way ANOVA and Correlation Feature Selection (CFS)—are employed to score feature relevance. Rather than applying a static selection threshold uniformly across the dataset, we introduce a percentile‐based adaptive thresholding mechanism that adjusts dynamically based on the imbalance and statistical distribution of each attack category. This ensures that feature selection remains sensitive to the varying relevance of features across different attack types, enabling better generalization and discrimination in heterogeneous traffic patterns. Selected features from ANOVA and CFS are then integrated using union and intersection operations derived from set theory to construct optimal feature subsets. These refined subsets are fed into a two‐level stacking ensemble classifier trained on attack‐specific patterns. Our framework is evaluated on three benchmark datasets—NSL‐KDD, UNSW‐NB15, and CICIDS‐2017—where it consistently outperforms existing methods. Notably, it achieves 98.126% accuracy on UNSW‐NB15 (a 3.026‐point improvement over [23]), 99.435% on NSL‐KDD (surpassing [22] by 3.835 points), and a near‐perfect 99.96% on CICIDS‐2017—the highest reported accuracy in the current literature. These results validate the effectiveness of the proposed adaptive approach and establish new benchmarks for intrusion detection in IoT ecosystems.