Adaptive genetic multistep detection framework: Enhancing IoT network security against evolving cyber threats

The rapid growth of the Internet of Things has profoundly transformed the digital landscape by enabling seamless interconnectivity across multiple domains. Despite its benefits, this advancement has brought about notable cybersecurity issues such as imbalanced data distributions, constrained processing capabilities, and the ever-evolving landscape of cyber threats. These challenges arise primarily from the distributed, heterogeneous, and resourceconstrained characteristics of IoT devices. To address these issues, this work introduces an Adaptive Genetic-Based Multistep Detection Framework designed to improve the accuracy and efficiency of intrusion detection within IoT network environments. The framework integrates three key components: Adaptive Robust Scaler Sampling (ARS-sampling) to mitigate data imbalance and outlier sensitivity; a Genetic-Optimized Heuristic Algorithm (GOHA) for effective feature selection and dimensionality reduction; and a hybrid Multistep CNN-Stacked LSTM model for robust classification. ARS-sampling employs an adaptive neighbourhood-based strategy to generate synthetic instances for minority classes, ensuring that the statistical characteristics of the original dataset are maintained. GOHA enhances computational efficiency by selecting an optimal subset of features, reducing redundancy and improving generalization. The final classification stage leverages CNNs for spatial pattern recognition and LSTM layers for temporal dependency modeling, enabling the detection of evolving attack behaviors. Experimental evaluation on two benchmark datasets CICIoT2023 and IoTID20 demonstrates that the proposed framework consistently achieves over 98% accuracy, precision, recall, and F1-score. Comparative and ablation studies validate the individual and collective contributions of each framework component. The findings validated that the proposed approach demonstrated high accuracy, highlighting its adaptability and applicability. These attributes establish it as a notable contribution to the advancement of cybersecurity within IoT environments.