WISE : A Weighted Hybrid Ensemble of CNN and Tree‐Based Models for Robust IoT Intrusion Detection

Intelligent and dependable Intrusion Detection Systems are crucial considering that the cyberattack surface has grown due to the exponential growth of the Internet of Things (IoT). However, traditional and single‐model ML approaches are ineffective, particularly in detecting uncommon attacks, due to the high dimensionality, complexity, and stark class imbalance of real‐world IoT network data. Equal‐weight voting in hybrid ensembles fails to address class imbalance and lacks a principled weighting strategy. WISE addresses this gap with an adaptive weighted averaging mechanism for imbalanced IoT intrusion detection. For reliable IoT intrusion detection, we propose WISE, a weighted hybrid ensemble model that combines a 1D‐CNN, Random Forest (RF), and XGBoost via weighted averaging. CNN's sensitivity to rare attacks is prioritized while utilizing the accuracy of the tree models on common classes through the use of a strategic weighted averaging technique (CNN = 0.4, RF = 0.3, XGBoost = 0.3). Using the unbalanced RT‐IOT2022 dataset, WISE outperformed eight baseline models and successfully mitigated class imbalance across all 12 attack classes, achieving a state‐of‐the‐art accuracy of 0.9978 and a superior macro F1‐score of 0.9757, with high recall for rare attack classes such as Mirai and Bashlite. Additionally, Grad‐CAM's Explainable AI (XAI) improves the model's decision‐making process by revealing detected attacks. This weighted hybrid ensemble offers great promise as a dependable and successful IoT intrusion detection paradigm. In contrast to current hybrid ensembles that employ majority voting or simple averaging, WISE introduces a strategically weighted fusion mechanism that leverages the accuracy of tree‐based models on common classes while prioritizing CNN's sensitivity to uncommon attacks. This approach has been validated through rigorous statistical testing and XAI.