Data-Driven Learning Models for Internet of Things Security: Emerging Trends, Applications, Challenges and Future Directions

Abstract

The prospect of integrating every object under a unified infrastructure, which provides humans with the possibility to monitor, access, and control objects and systems, has played a significant role in the geometric growth of the Internet of Things (IoT) paradigm, across various applications. However, despite the numerous possibilities that the IoT paradigm offers, security and privacy within and between the different interconnected devices and systems are integral to the long-term growth of IoT networks. Various sophisticated intrusions and attack variants have continued to plague the sustainability of IoT technologies and networks. Thus, effective methodologies for the prompt identification, detection, and mitigation of these menaces are priorities for stakeholders. Recently, data-driven artificial intelligence (AI) models have been considered effective in numerous applications. Hence, in recent literature studies, various single and ensemble AI subset models, such as deep learning and reinforcement learning models, have been proposed, resulting in effective decision-making for the secured operation of IoT networks. Considering the growth trends, this study presents a critical review of recently published articles whereby learning models were proposed for IoT security analysis. The aim is to highlight emerging IoT security issues, current conventional strategies, methodology procedures, achievements, and also, importantly, the limitations and research gaps identified in those specific IoT security analysis studies. By doing so, this study provides a research-based resource for scholars researching IoT and general industrial control systems security. Finally, some research gaps, as well as directions for future studies, are discussed.

1. Introduction

In recent times, the Internet of Things (IoT) paradigm has continued to be an important topic in every space and field. Its applications broadly cover various domains ranging from home automation to industries, health, education, etc. [1,2,3]. Due to technological advancements, the global adoption rate of IoT devices and tools is increasing geometrically [4]. Figure 1 presents the estimated projection of the number of IoT-connected devices globally over the next decade [5]. As shown in Figure 1, the global adoption of IoT-connected devices in the year 2033 is expected to be double the current amount. However, while the adoption of IoT tools and associated advanced technologies continues to grow exponentially, the adoption also brings along a series of challenges in terms of cyber-intrusions and attacks [6]. Intruders can exploit various vulnerabilities to access sensitive data, launch a variety of sophisticated attacks into networks, and/or assume control of critical infrastructure [7,8]. The secure operation of various IoT networks is a top priority for stakeholders, including governments and standard manufacturers, as most social, political, and economic activities are potentially at risk [9,10]. As the number of connected devices soars, so does the potential for security breaches and intrusions. Adversaries can physically attack or tamper with network end nodes, software, or communication standards and protocols, thereby inflicting unimaginable damage to users [10,11,12,13].

In recent years, various documented incidents such as the 2021 Verkada hack [14], the 2016 Lappeenranta cyberattack [15], the 2019–2021 Mozi botnet attack [3], the 2016 Mirai botnet attack, and so on, have shown the devastating consequences of data breaches, intrusions, and attacks. In 2018, the United States Food and Drug Administration issued a statement that focused on vulnerabilities in two models of Medtronic programmers that are deployed with cardiac implantable electrophysiology devices, including pacemakers, implantable defibrillators, and implantable cardiac monitors. It was reported that attackers could potentially hack and manipulate their various features [16]. Various literature studies have discussed similar episodes [17,18,19,20,21]. The World Economic Forum acknowledged cyber threats as a key threat to the global economy in its 2019 Global Risk Report [22]. The global consulting firm; McKinsey and Company estimated that cyberattacks’ damages will cost an estimated USD 10.5 trillion annually by 2025—a 300% increase compared to the figure a decade ago [23]. As expected, expenditures on cyber-security have soared in response to the menace. The IoT security market size is expected to expand from USD 35.6 billion in 2024 to USD 383.11 billion by 2034, expanding at a compound annual growth rate of 26.82% over the estimated period [24]. Figure 2 presents the estimated projection of IoT security market size over the next 5 years [24]. As shown in Figure 2, the market size is projected to grow at a geometric rate. The IoT security market size by the year 2030 is projected to be triple the amount it is currently in the year 2025.

Various studies have identified important security requirements, including adequate authorization and authentication, access control, monitoring and tracking systems, data and information integrity, mutual trust, privacy, etc., as being essential for mitigating and reducing cyber-attacks and associated risks [2,7,13,15,25]. Over the years, various traditional models and variations of popular techniques, including tamper proof, secure element, end-to-end encryption, etc., have been proposed to achieve these goals.

Table 1. Comparison of some popular traditional security methods that are deployed across different layers/domains of typical IoT networks [2,4,13,15,17].

IoT Layer/Domain	Security Measures	Strengths	Limitations
Node devices/hardware devices	Tamper seals	Offer visible and digital evidence of intrusions. Seals cannot be restored once unsealed. Trust and deterrence on physical devices.	Easily triggered by environmental factors. Expensive to maintain.
	Firmware updates	Easily fix exploitable bugs. Good performances (both functional and non-functional elements).	Compatibility issues. Easily exploitable trigger updates.
	Secure element	Tamper resistance to physical attacks and injections. Storage opportunity for cryptographic keys and certificates.	Implementation cost and complexity of integration.
Data communication/Network protocol	Encryption, authentication, and access control models	Scalable, cheap, and efficient. Provide security against a wide range of attacks.	Cumbersome and computationally expensive.
	Blockchain	Decentralized and transparent security solution. Immutability applies.	Cost and energy inefficient, scalability concerns. Application complexities.
Application layer	Secure bootstrapping techniques	High effective solution.	Expensive. Scalability issues.

presents a comparison of some popular traditional security methods that are deployed across different layers/domains of typical IoT networks.

Despite demonstrating satisfactory performances in some cases, the methods and models have shown symptoms of being computationally expensive and inefficient in adapting to the heterogeneous yet diverse nature of IoT networks. International Data Corporation estimated that the sum total of global data will reach 175 ZB by 2025, whereby 90 ZB of the data will be generated from IoT end nodes [26]. The traditional methods are overburdened and unreliable with the massive data generated from the complex IoT network topologies. Additionally, considering that emerging cyber-attacks, intrusions, and data breaches are conducted in a coordinated, furtive, and sophisticated manner, conventional methods are systemically inept at effectively tackling the menace. In recent times, data-driven automation models, particularly variants of machine learning, including deep learning techniques and reinforcement learning models, have been extensively used to model and monitor complex applications. Unlike conventional schemes, data-driven models can effectively learn and understand the dynamic characteristics of IoT networks and applications. With generated datasets containing millions of instances with numerous features, various researchers in recent times have proposed solutions in the form of automation models. The models identify and respond to intrusions without the need for constant human intervention.

In line with the increasing IoT security and vulnerability concerns, several literature studies have reviewed and analyzed the problems from various points of view. Alaba et al. [2] reviewed varieties of IoT threats and vulnerabilities in the context of application, architecture, and communication. In a related study, Pajouh et al. [27] reviewed IoT security requirements, challenges, and solutions based on the three-layer architectural structure. In a similar study, Kouicem et al. [28] provided a survey of some proposed security and privacy solutions for IoT networks. Yang et al. [29] also provided an analysis of biometrics research in IoT security, with a focus on authentication and encryption. Sadhu et al. [30] reviewed varieties of IoT security and privacy menaces, including some emerging countermeasures. The authors of [31] presented a systematic review of Industrial IoT (IIoT) security, with a special focus on how fog computing can be considered in the context of IIoT security requirements. With regard to data-driven approaches and solutions to complex network security challenges, the authors in [10] presented an analysis of recent literature studies whereby supervised learning techniques were modeled for SCADA intrusion solutions. In a similar previous study, the authors in [6] reviewed studies involving machine learning techniques that were proposed for smart power system menaces.

To bridge the research gaps, this paper analyzes emerging security challenges and solutions based on the IoT architectural layer setup. By adopting a narrative literature review approach, this paper reviews the most recent studies whereby emerging data-driven models are proposed for IoT security analysis. The analysis covers key aspects, from data generation and collection to the classification phase. Pertinent issues are highlighted and discussed extensively, as the study focuses on stressing the successes as well as the limitations of the methodologies proposed in the reviewed articles. To ensure the credibility and reliability of the analyzed studies, a comprehensive search of the topic and research questions using multiple highly rated databases such as Web of Science, Scopus, IEEE Xplore, ACM digital library, Google Scholar, and so on was conducted. The identified peer-reviewed articles that were analyzed are recent articles that were published within the last five (5) years. The relevancy of the reviewed articles is justified based on the quality and methodology adopted, using a structured narrative synthesis approach. The paper is intended for IoT communication, application, and security researchers with the intention of building analytics and AI system solutions for IoT infrastructure deploying emerging data-driven approaches. Unlike previous review articles, this study gathers different approaches, procedures, and limitations as well as identifies research gaps on data-driven applications to IoT security studies. By doing this, the study provides a research-based resource for scholars researching IoT and general industrial control systems security.

Specifically, the novel contributions of the review paper are stated briefly as follows: (1) A detailed analysis of the most recent state-of-the-art data-driven approaches and their applicability in the IoT security domain; (2) Emerging security challenges and solutions for IoT networks based on the IoT architectural layers are extensively discussed; (3) An elaborate review of the most recent benchmark datasets and pre-processing steps, as well as trending classifier models deployed in IoT security analysis; (4) Open challenges, limitations, and research gaps of the current applications of data-driven models in IoT studies and the directions for future research in this regard.

The remainder of the paper is organized as follows. An overview of IoT network security is presented in Section 2. The section analyzes the associated security challenges attributed to the architectural layers of typical IoT networks. The various emerging security menaces are also discussed. Section 3 summarizes some emerging IoT security and privacy solutions in recent literature. Section 4 presents a detailed analysis of data-driven techniques for the IoT security menaces. The section analyzed the approach in terms of data generation and pre-processing phase as well as the classification phase. Various strengths, achievements, and limitations of these phases are extensively discussed. The research gaps and future research directions are presented in Section 5, while Section 6 presents the conclusions.

2. Overview of IoT Network Security

The global acceptance and geometric growth of the IoT paradigm across all aspects of 21st-century society is mostly due to the possibility of creating an automated and connected community between humans and their environmental devices, gadgets, equipment, etc., across various societal domains and industrial sectors. The IoT paradigm provides solutions for various domains based on the integration of information technology and communication technology (ICT) with hardware and software processes. While the integration of IoT technologies continues to cut across various fields, security concerns have been globally adjudged as the biggest threat to the domination of IoT in every space. The authors in [32] explained that attacks on IoT devices can be quite simple. By identifying a weak link (for example, vulnerable node(s)) to compromise and further initiate fraudulent acts, intruders can successfully create unwanted situations from user data breaches and/or take over critical infrastructure.

2.1. IoT Network Architectural Set-Up

The most reliable and secure convergence of the various ICT tools and technologies is built on effective IoT architecture layers. These architecture layers often vary, depending on the associated task requirements. A detailed analysis of IoT network security can be described from the IoT architectural structure. IoT architecture is defined as ‘a framework which basically specifies the physical elements, network technical arrangements, operating procedures as well as the data formats that is being deployed’ [33,34]. Generally, there are three major dominant classes of IoT architectures, as depicted in Figure 3 [27,34,35].

• Three-layer architecture

Three-layer architecture is generally adjudged as the most common IoT architecture as it is quite easy to implement. As shown in Figure 3, the perception layer at the base is made up of physical hardware devices, which include sensors, Radio Frequency Identification (RFID), cameras, etc., which are equipped with sensing capability features to collect real-time information and react to physical objects’ behaviors and relay the collected data to the network layer for processing, analysis, transmission, and storage [37]. Lastly, the users interact with the applications and services at the application layer [38].

2.

Four-layer architecture

3.

Similar to the three-layer architecture, the base of the four-layer architecture is the perception/sensing layer, which includes devices such as sensors that collect data from their surroundings. The next layer is the network layer, whereby data from the sensing layer are transported, typically to the internet, via the gateway devices. The service/middleware layer handles data analysis and processing. Depending on the application, the service layer is either located in the gateway or in the cloud. Similar to the three-layer architecture, the users interact with the applications and services at the application layer [36].

4.

Five-layer architecture

With regard to the five-layer architecture, the network layer, which typically is made up of base station nodes and network access gateway, transmits the data collected from the perception layer devices to the network transmission layer, which is characterized by several network and data analytic technologies for processing, analysis, and storage. The analyzed data are often presented to the end user using the application layer technologies. At the topmost layer, the business layer tools allow users, typically system administrators, to manage and control the various associated functionalities of the IoT platforms [39,40].

Irrespective of the architectural setup, intrusion and attacks on IoT networks can be perpetrated via any layer device(s) or communication between layers. The authors in [4] categorized IoT network attacks into physical, network, and software attacks. Using the 4-layer architecture as the basis, the authors in [41] categorized various trending IoT attacks. With regard to the various layers, typical attacks on the perception layer include eavesdropping, radio frequency interference, reverse engineering, tampering, and general cyber/physical attacks [42]. Considering that some devices at the perception layers are typically exposed and vulnerable based on their location, they are easily preyed upon. The ISO/IEC 18000-63:2021 information technology—RFID standard, which is very popular among emerging perception layer devices, is well known for its apparent vulnerability. The standard is highly prone to hacks, imitation, and disabling [43]. Also, as the intermediary layers of the various architectures are typically used for processing, analysis, and storage of data collected from perception layer devices, the communication protocols and standards that enable the exchange of data between these IoT elements can be exploited for their security lapses. Devices and other distant parts of the network are integral to these processes. Typical protocols and standards such as Bluetooth Low Energy, Wi-Fi, ZigBee, Ethernet, cellular networks, and Low Power Wide Area Network standards have individual security measures in place for their operation. However, there are identified vulnerabilities that are easily exploited. For example, Bluetooth standard 5.0 uses Secure Simple Pairing (SSP) and LE Secure Connections protocols for secure key generation. This process relies on secure key distribution and Elliptic Curve Diffie-Hellman cryptography. However, the standard suffers from easy privacy/identity tracking, eavesdropping, and bluejacking. At the network layer, popular attacks include phishing, replay attacks, spoofing, DoS, etc. [42]. At the application layer, popular attacks include cross-site scripting, malware injection, Man-in-The-Middle (MiTM) attacks, sniffing, etc. By exploiting various vulnerabilities, including weak authorization and authentication protocols, malicious commands/scripts can be injected into web-based IoT dashboards or injected into an application’s input fields to alter or extract data from databases. Various authors have categorized various attacks using different criteria. The authors in [6] categorized them as internal/malicious, internal/non-malicious, external/opportunistic, and external/deliberate. In a similar study, the authors in [32] categorized IoT network attacks based on adversary location, access level, attack strategies, and information damage level.

2.2. IoT Network Popular Attacks

Irrespective of the IoT architectural setup or network scale, some of the dominant attacks on IoT networks and resources include the following:

• Denial of Service (DoS)/Distributed Denial of Service (DDoS) Attacks

Arguably one of the most popular cyber-attacks, DoS/DDoS attacks attempt to overload a network to make it inaccessible to legit users or degrade its performance. Simply put, the attack type is realized by flooding the target devices with traffic in order to trigger a crash [44]. Figure 4 presents a description of a typical DoS attack, whereby an intruder creates a scenario to flood and overwhelm the network, thereby consuming available bandwidth and making it inaccessible for legitimate network users. A DDoS attack was first documented in 1999 at the University of Minnesota, whereby a computer at the institution was infiltrated from a network of 114 other computers infected with Trin00 (malicious script). The malicious script triggered the infected computers to send superfluous packets to the institution’s infrastructures, overwhelming its computers and preventing them from handling legitimate requests [45]. Since the first documented episode, these forms of attacks have increased geometrically in volume and are a constant threat to various systems, networks, organizations, and so on [46]. The report in [47] estimated the detection of 57,116 attacks by DDoS intelligence systems by the third quarter of 2022. With the increase in volume, there was an increase from 38.69% in the third quarter of 2021 to 53.53% in the third quarter of 2022. The report detailed that the majority of the attacks were perpetrated in North America, predominantly in the United States. With the volume of IoT tools being deployed globally, there is always a need to timeously detect and mitigate this form of attack.

• Man-in-the-middle (MiTM) attacks

Considered one of the most discussed attacks in IoT ecosystems, the MiTM attack is a major menace for many security professionals [49]. Typically, the attack scenario involves the victims (IoT end nodes) and one or numerous intruder(s). The typical intruder capitalizes on the vulnerabilities in the communication channel to access, monitor, and manipulate data between the end nodes. Thus, the integrity and confidentiality of data exchange are compromised while evading the end nodes’ knowledge of its presence in the network [49,50]. Figure 5 presents a description of a typical MiTM attack. As shown in Figure 5, the intruders position themselves between legitimate communicating nodes with the goal of intercepting, manipulating, and stealing sensitive information. Typical tools, including GATTacker and BtleJuice, can be used to launch a MiTM attack in a Bluetooth-enabled IoT network [51]. Mallik [50] explained that the core objective of the MiTM attack is to steal IoT users’ vital information and credentials. The authors further explained that the information obtained during a typical attack scenario can be used for fraudulent activities in organizational settings. Also, such attack scenarios can be deployed in the infiltration phase of an Advanced Persistent Threat attack. A 2020 report estimated that MiTM attacks were responsible for approximately USD 2 billion in annual losses worldwide [52]. The report further estimated that MiTM attacks cover 19% of all successful cyber-attacks in 2021.

• Ransomware

Globally adjudged as one of the most terrifying and growing attacks targeting IoT networks, the attackers typically attempt to encrypt the victim’s data, thereby denying legitimate users access to their data. Afterward, the attacker demands ransom for the decryption key [53,54]. Figure 6 depicts an illustration of a ransomware attack. As shown in Figure 6, the attacker successfully gains access to a legitimate user’s (victim) data, encrypts the data, and requests that a ransom be paid (typically in the form of difficult-to-trace digital currencies) before the decryption key is granted to the victim. The authors in [54] explained that cybersecurity experts, standard manufacturers, law enforcement agencies, IoT users, and enthusiasts struggle to deal with this specific type of attack. Historically, the first documented ransomware attack, tagged ‘Aids Trojan’, was introduced in 1989 by Joseph Popp, a trained biologist [55]. The attack distributed 20,000 infected floppy disk drives to the participants of the World Health Organization conference [53,54,55]. Incidents such as the 2007 locker ransomware attack that targeted Russia, the 2016 devastating mamba ransomware attacks on a municipal transport system in San Francisco, United States, as well as the 2017 mamba ransomware attack on corporate networks in Saudi Arabia [53,56], have shown the devastating effects of this attack type, and it has also shown how this specific type of attack has continued to grow into large scale attacks. Consequences of ransomware attacks include temporary and sometimes permanent loss of information, disruption of services, as well as financial losses. A 2024 report by Veeam (a United States information technology company) [57], which involved a survey of 350 chief information security officers, information security professionals, and backup administrators from a variety of organizations, estimated that 96% of ransomware attacks targeted backup repositories and about 28% of the organizations who paid the ransom were unable to recover all lost data. The report also estimated that a measly 14% were able to recover their data without paying a ransom.

• Physical Damage

Considering that IoT infrastructures are ubiquitous in nature, some IoT equipment, particularly the perception layer infrastructures, are usually deployed in remote and unsecured spaces [58]. For example, emerging smart cities and smart grids are equipped with perception layer elements, including sensors, cameras, fiber and cable installations, and smart lights that are either exposed or located in rural, underground, and secluded locations that sometimes tend to be inadequately guarded. Thus, adversaries often capitalize on their vulnerabilities to access the devices and inflict physical attacks and damage to the infrastructures [59]. While there is a major focus on the cybersecurity aspect, physical security is equally important. Some physical attack variants include theft, vandalism, signal jamming, node tampering, node replication attacks, etc. These physical attack menaces typically result in disruptions in services. For example, apart from interruptions to transportation and telecommunication services, underground cable theft costs the Republic of South Africa’s economy an estimated value of ZAR 5 billion annually [60]. By stealing or tampering with IoT infrastructures, attackers can access users’ credentials and possibly inflict physical harm on users. Thus, IoT infrastructures demand adequate security measures to prevent such attacks and reduce the impact of unexpected equipment failures on networks.

• Replay Attack

This type of attack usually takes place during synchronization. The goal is to mislead the destination node such that a malicious node stores transmitted information only to retransmit it later [61]. Gargoum [62] explained that this specific form of attack involves capturing communication signals between components in an industrial control system and replaying them later to disrupt network operations. A missed frames retransmission request is usually made by transmitting data packets across a network in a repeated manner. This attack often exhausts network/system resources and back-end database resources (memory, battery, and processor). Replay attacks are classified as high-risk attacks, but they can be mitigated and prevented relatively easily. Other notable attacks that threaten the security of IoT networks include Sinkhole, Sybil, etc.

3. IoT Network Security and Privacy Solutions

Security and privacy concerns have continued to be significant issues for all stakeholders and a major concern for increased domination and adoption of IoT technologies [63]. With applications cutting across all fields of life and critical infrastructures, elevated security concerns are considered the biggest threat to the paradigm [4]. As explained in [42], without an effective system in place whereby various devices are able to share and exchange data in a private and secure manner, users may shy away from the technologies as there will be no guarantee that their personal data will be kept secured.

As with conventional information security setups, requirements including confidentiality, integrity and availability, authentication, authorization, and access control also apply to IoT security. Ensuring that IoT data are accurate and protected and that they are only used as intended, as well as ensuring that IoT data and devices are accessible when needed, is vital for the long-term goals of IoT network infrastructures. This fundamental security provision for IoT devices and networks combines both software-based security measures with hardware-based security features. Thus, irrespective of the IoT architectural setup, the hardware devices (i.e., physical objects and devices, cloud gateways, etc.), network-based infrastructures (i.e., cloud back-end, standards, protocols, etc.), and all application-based gadgets (i.e., application, firmware, interfaces, etc.) must be well secured.

In recent literature, various studies have analyzed and proposed various security solutions. Some of these proposed solutions focus on key management and encryption systems, blockchain technology, and intelligence intrusion detection systems (IDS). HaddadPajouh et al. [27] explained that IoT network layer environments should focus on (a) implementing appropriate (lightweight) encryption systems to maintain conventionality and integrity of data, (b) installing good tracing parameters for authorizing the transferred packet data, and (c) implementing appropriate threat hunting modules for detecting threats. Conventional communication and routing protocols, such as TLS and DTLS, IPSec, etc., are encouraged to provide secure communication and routing. Various encryption algorithms and associated methodologies are proposed and deployed in various standards to provide and maintain IoT technology’s end-to-end communication security [64,65,66]. Considering the enviable characteristics, including decentralized architecture, immutability, and distributed ledger nature of blockchain technology, it is a viable solution for secure data storage, effective access control, and protection against typical attacks, including resistance to DoS attacks. Thus, blockchain technology has been proposed and deployed to provide and maintain IoT technology’s end-to-end security [67,68,69,70]. Using traditional security measures often lacks flexibility and adaptability to specific IoT contexts and emerging IoT characteristics. Considering the limited energy storage and compactness of IoT devices (based on various factors including architectural design and ease of use, etc.), securing them against various threats using conventional security methodologies tends to incur additional resource demands, including extensive computation, storage, and energy resources.

As IDSs are widely recognized as an effective security methodology for information technology networks, numerous statistical formulations have been proposed for IoT security analysis and assessment. However, the majority of the statistical formulations are implicitly rigid and computationally expensive for emerging IoT setup scenarios. Also, considering factors such as the huge data associated with IoT end devices, the uncertainties with sensing and other measurement devices, as well as the computational complexities of emerging IoT applications, etc., the limitations of traditional security methodologies have been consistently exposed. Hence, the need for proactive, robust, prompt, and reliable methodologies has become essential, particularly in the face of relentless sophisticated attacks. As explained by Naha et al. [71], the need to urgently detect attack scenarios as early as possible is vital to reduce the magnitude of potential damages.

In recent times, data-driven AI models have proved extremely efficient in various applications and studies. These models are widely proposed in IoT security analysis involving the monitoring, prediction, detection, and classification of various security menaces. Using various AI subsets, the complex and diverse network data stream can be analyzed by extracting features that contain hidden trends, behaviors, and patterns. The models are capable of effectively analyzing and evaluating the features of embedded intelligence in IoT devices and networks. For example, they are capable of detecting malignant codes from an application or software within IoT networks. In real-world situations, Google utilizes machine learning extensively to protect mail users from spam. Using neural network models, Google analyzes billions of email data and identifies patterns synonymous with spam [72]. Similarly, Amazon, through its Amazon GuardDuty, leverages machine learning models to detect anomalous activity and potential threats across accounts, workloads, and data, providing real-time security monitoring and threat detection [73].

4. Performance Evaluation and Comparative Analysis of Data-Driven AI Models for IoT Network Security and Privacy Menaces

Protecting emerging IoT network infrastructures against sophisticated attacks using conventional security solutions is becoming increasingly challenging. The overwhelming quantity of data generated, with their diverse features, has contributed largely to the solutions’ poor performances. Data-driven AI models, including machine learning, deep learning, and reinforcement learning models, are proving to be viable options as they possess various characteristics, including high performance and high processing speed. These models are widely proposed in the IoT literature for monitoring, intrusion detection, prediction, and classification of security challenges that conventional security methodologies, such as whitelisting, encryption models, authentication, firewalls, etc., are incapacitated in mitigating. Xiao et al. [74] investigated IoT systems attack models and reviewed security solutions that are based on various machine learning models. Aldahiri et al. [75] reviewed various machine learning approaches and their application in IoT medical data. Bhayo et al. [76] explored key machine learning models, including naive Bayes (NB), decision tree (DT), and support vector machine (SVM) algorithms for detecting and classifying DDoS attacks in IoT network packets. Using benchmark IoT datasets, Islam et al. [77] experimented using shallow learners, including DT, SVM, and random forest (RF), as well as deep learning model variants, including deep belief network and long short-term memory, for detecting IoT network attacks.

From the conventional point of view, the methodology approach involving the deployment of data-driven learning models for IoT security studies is generally divided into two main phases: (1) the data collection and preprocessing phase and (2) the analysis/classification phase. In some literature studies, the authors deployed various optimization techniques, while some deployed an ensemble of multiple algorithms to boost classification performances.

4.1. IoT Network Data Generation and Pre-Processing Phase

As explained in [10], the core component for utilizing data-driven models in IoT security studies is the dataset/deployed testbed. Basically, IoT network security studies using data-driven learning models involve the capturing and analysis of sufficient and balanced IoT network data traffic. Furthermore, for an intruder to compromise an IoT network or general information system, it is expected that the intruder will somehow create/leave some form of footprint or disruption. In order to have a sufficiently balanced dataset for the algorithms’ learning process and analysis, some intrusions, including emerging cyberattacks, are usually integrated into the testbeds. However, due to the limited available IoT datasets, researchers usually turn to the use of publicly available datasets for IoT security analysis. Some notable datasets that have been used in recent studies involving IoT network security, anomaly detection, and malware analysis are discussed in terms of their characteristics, strengths, and limitations.

• IoT-23 Dataset

The IoT-23 dataset is a recently published dataset (captured between 2018 and 2019) using typical smart home devices, including the popular Amazon Echo home device, smart LED lamp, and a door lock. The dataset was generated at the Avast AIC laboratory and the stratosphere lab team at the Czech Technical University [78]. The dataset contains an estimated 325 million labeled network traffic flows. With regard to data structure, the dataset has 20 malware captures executed in IoT devices and 3 captures for benign IoT device traffic. The dataset has been heavily deployed in various IoT network traffic analysis, anomaly detection, and classification studies [79,80,81,82,83,84].

Despite its popularity in recent studies, the IoT-23 dataset’s imbalanced class issue is a major concern that often makes the learning process biased and ineffective [79,82]. Some of the reviewed studies explored oversampling and undersampling techniques to solve the class imbalance issues of the dataset. With the undersampling technique, samples from the dataset’s majority class are removed to balance out the dataset, while oversampling involves taking multiple samples of the dataset and averaging them [85,86]. In order to mitigate the class imbalance concern, the authors in [79] deployed various preprocessing techniques, which include Synthetic Minority Oversampling (SMOTE), Adaptive Synthetic Sampling (ADASYN), cost-sensitive learning, and bagging techniques to mitigate the issue. SMOTE, as defined in (1) [87,88], is a popular algorithm used to generate synthetic samples for the minority class in imbalanced datasets.

$$X_{new}=X_i+\lambda \times (X_j-X_i)$$

(1)

where $X_{new}$ is the new synthetic sample, $X_i$ is the randomly chosen minority class sample, $X_j$ is another randomly chosen minority class sample that is one of the k-nearest neighbors of $X_i$ and $\lambda$ is a random number in the range [0, 1], ensuring the synthetic point lies on the line segment between $X_i$ and $X_j$. On the other hand, ADASYN is an improvement on SMOTE as it generates synthetic data adaptively by focusing on sparsely distributed minority class samples. Thus, ADASYN introduces an adaptive weighting mechanism to (1), which is defined in (2) [87,89].

$$G_i=\stackrel{\wedge }{G}.r$$

(2)

where $G_i$ is the number of synthetic samples for minority sample $X_i$, $\stackrel{\wedge }{G}$ is the total number of synthetic samples to be generated, and $r_i$, defined in (3) is the normalized difficulty level of the sample.

$$r_i={\displaystyle \frac{{\Delta }_i}{{\displaystyle \sum {\Delta }_i}}}$$

(3)

where ${\Delta }_i$, defined in (4), measures how hard-to-learn the sample is.

$${\Delta }_i={\displaystyle \frac{number of majority class neighbour}{k}}$$

(4)

Similarly, El-Hariri et al. [90] explored ADASYN, SMOTE, and undersampling for the same purpose. In the study, the authors also argued that ADASYN is a better technique compared to SMOTE or random undersampling based on the results achieved. The authors explained that ADASYN involves the generation of synthetic data, which often lacks noise, for the minority classes. Furthermore, the authors explained that the ADASYN approach provides better flexibility and control during the synthetic sample generation processes, thus allowing users to customize the sampling procedures based on the specific needs of the dataset. In a similar study, Nicolas–Alin [91] deployed statistical correlation to eliminate data that are not related to the label column. Specifically, the authors experimented with a correlation matrix for each of the 33 data files in the IoT-23 data and averaged the results. In another related study, Abdalgawad et al. [80] deployed various preprocessing steps, including feature selection, encoding, etc., on the popular dataset. Nanthiya et al. [81] deployed principal component analysis (PCA) to select relevant features in the dataset. The study analyzed and compared the use of the dataset with and without the use of PCA as the feature selection tool.

• TON_IoT Dataset

Similar to IoT-23, the TON_IoT data is a recently published dataset that was generated from a large-scale, heterogeneous IoT network setup, which consists of telemetry data from sensors, Linux operating system (OS) records, Windows OS records, and network traffic [92,93,94,95]. The dataset was conceptualized and generated at the Cyber Range and IoT Labs, the School of Engineering and Information Technology (SEIT), University of New South Wales (UNSW) Canberra Cyber Range Laboratory, Australia. In terms of content, the dataset is made up of both normal and different types of modern-day attacks, including ransomware, password attack, scanning, DoS, DDoS, data injection, backdoor, cross-site scripting (XSS), as well as MiTM. It is being deployed in various recent IoT intrusion detection and security analysis studies [93,94,95,96,97,98,99].

Similar to the IoT-23 dataset, the TON_IoT dataset is also known for its class imbalance concerns [100,101]. Furthermore, the dataset has other challenges, including several missing values, and it is generally adjudged to contain a large volume of irrelevant features [98,99,100,101,102]. These issues make the pre-processing steps highly critical in the effective use of the dataset. Zhong et al. [100] addressed the class imbalance issue by combining SMOTE with a redundant-based Tomek link removal technique. The authors in [99] deployed the popular chi-square (Chi²) technique for selecting important features in the dataset, while SMOTE was deployed for the class imbalance issue. In a related study, Gad et al. [101] also used Chi² to reduce the data features during the pre-processing phase. Justifying the choice of the Chi² technique as an efficient feature selection tool, Sarhan et al. [93] explained that the technique is capable of effectively measuring the independence of data features with their respective class labels. Using a comparative approach for feature selection, Guo et al. [98] compared the use of Chi² and Spearman rank correlation coefficient models for selecting relevant features in the TON_IOT dataset. Similarly, the authors in [93] experimented with various models, including Chi² and information gain (IG), to analyze and rank the TON_IOT data features. Guo et al. [96] also compared five key feature selection methods, namely IG, gain ratio (GR), Chi², Pearson correlation coefficient PCC, and symmetric uncertainty, to select dominant features in the popular dataset.

• Bot-IoT Dataset

The Bot-IoT dataset was created in 2018 and was published in 2019 for the analysis of botnet attacks in IoT networks [103,104]. Similar to the TON_IOT dataset, the Bot-IoT dataset is generated by the UNSW Canberra Cyber Range Laboratory. The dataset was conceptualized in a testbed environment that consisted of multiple virtual machines with various OSs, network firewalls, network taps, Node-red tool, and the Argus network security tool. The dataset includes a variety of trending attacks, namely DDoS, DoS, OS and service scan, keylogging, and data exfiltration attacks [105]. The dataset contains approximately 70 million records.

The dataset has been deployed in various intrusion detection, attack analysis, and general cybersecurity studies [86,106,107,108,109,110]. Pokhrel et al. [107] used the dataset to analyze DDoS attacks in IoT networks. Leevy et al. [109] also deployed the dataset in the analysis of information theft. Similarly, Jayalaxmi et al. [111] deployed the dataset for the analysis of bots in a general IIoT network. Similar to several other modern-day benchmark datasets, the Bot-IoT dataset is known for its class imbalance issues [107,112,113]. The authors in [107,112] proposed SMOTE for solving the dataset’s class imbalance issue.

Also, considering that the original data are voluminous (70 million records), most studies typically deploy some form of pre-processing step(s) to ensure the needed effectiveness from the data-driven models. Apart from the basic conventional pre-processing steps, which include normalization, numeralization, etc., various authors deployed other preprocessing methods, including feature selection models such as search algorithms. Shafiq et al. [106] proposed a feature selection metric approach, which is based on a wrapper technique to filter and select relevant features for the learning model. To simplify the data-driven model tasks, Leevy et al. [114] deployed a fraction of the entire dataset for analysis. Specifically, the authors used 3 out of the 29 Bot-IoT features for their IoT intrusion analysis. In a similar study, the authors of [109] used the variant of the original dataset by experimenting with about 5% of the original instances to analyze information theft in IoT systems.

• IoTID20 Dataset

The IoTID20 dataset, created in 2020, was generated by modeling a testbed that fits the description of a typical smart home. The setup includes conventional IoT devices, which include AI speakers, WiFi cameras, laptops, smartphones, access points, and routers [115]. From the setup, the cameras and speakers were deemed the victim devices, while the remaining devices were dubbed the attacking devices. The popular tool ‘Nmap tool’ was deployed to simulate a variety of trending attack scenarios. The IoTID dataset has 86 features with 625,784 instances. Based on its relevancy to the field, the dataset has been deployed in various IoT intrusion analyses and cybersecurity research [1,116,117,118,119,120]. The authors of [121] used the dataset and similar datasets to analyze DoS/ DDoS and Sybil attacks in the fog-IoT model. Similarly, Shin et al. [122] used the dataset to analyze general network intrusions.

Similar to several other modern-day benchmark open-source datasets, the dataset is well known for its class imbalance issues [90,120,122]. To achieve effective results, Al-Akhras et al. [116] proposed a Repeated Edited Nearest Neighbor (RENN), Encoding Length (Explore), and Decremental Reduction Optimization Procedure 5 (DROP5) algorithm to filter out noise in the dataset before deploying the SMOTE technique to deal with the imbalance issue. The authors further experimented with particle swarm optimization, grey wolf optimizer, and multi-verse optimizer to remove redundant data features. Apart from using SMOTE to address the class imbalance issue, the authors of [120] deployed typical pre-processing steps, including data cleaning, encoding, and normalization, as well as feature reduction using correlation analysis. To address the class imbalance issue, El Hariri et al. [90] deployed a comparison approach involving different data balancing techniques, including SMOTE, ADASYN, and random undersampling on the dataset.

Some of the other highly rated datasets that are deployed in recent IoT security studies to analyze and evaluate the performance of data-driven AI models in intrusion analysis and detection models include the UNSW-NB15 dataset [86,109,121], N-BaIoT dataset [116,123,124,125], CICIDS2018 [126,127,128], and CICIDS2017 [129,130,131].

As shown in

Table 2. Comparison of recently generated benchmark datasets used in literature studies [78,93,95,104,115].

Dataset	Year Published	Devices Used	Attack Type	Attack Labelled (Y/N)	Data File Format	Key Limitations
BoT-IoT	2019	IoT home devices, including R-Pi, smart lights, plugs, thermostats, IP cameras, etc.	DDoS, DoS, reconnaissance (scanning and probing), theft (info theft and data exfiltration)	Y	PCAP and CSV	Imbalanced data, simulation-based environment, limited network size and data size
UNSW-NB15	2015	Network infrastructure devices, including routers, switches, etc., servers and workstation machines, servers and firewalls, attack simulation tools including Nmap, Wireshack, etc.	Backdoor, DoS, exploits, fuzzers, port scans, recon, shell code, spam, worms	Y	CSV, PCAP, ARFF	Simulated attack scenarios, imbalanced data
CIC-IDS 2017	2017	Network infrastructure devices (routers, switches), servers and workstations, virtual and physical machines, IoT end devices, and attack simulation tools	Botnet, XSS, DoS, DDoS, heart bleed, infiltration attack, SSH, brute force, SQLi	Y	PCAP, CSV	Imbalanced data, outdated attack variants, and numerous redundant data features
CIC-IDS 2018	2018	Network infrastructure devices, including routers, switches, etc., servers and workstation machines, servers and firewalls, IoT devices (R-Pi, cameras, etc.), attack simulation tools, including Nmap, Wireshack, etc.	Botnet, brute force, port scan, DDoS, DoS, web attack, and infiltration attack	Y	CSV	Imbalanced dataset, limited and controlled ecosystem deployed to generate the dataset, several redundant features
IoTID20	2020	IoT end devices (smart plugs, cameras, lights, speakers, etc.), attack simulation tools including Wireshack, hydra, medusa, etc.	Syn flooding, brute force, HTTP flooding, UDP flooding, ARP spoofing, host port, and OS Scan	Y	CSV	Imbalanced data, limited attack varieties. The ecosystem used for generating the data is limited.
MQTT-IoT-IDS 2020	2020	IoT end devices (lights, thermostats, plugs, speakers, etc.), MQTT comm protocol, attack simulation tools including Wireshack, ettercap, hydra, medusa, etc.	DoS, DDoS, Brute force, MiTM, credential stuffing	Y	CSV	Class imbalance issue, limited attack varieties. Also, the dataset is captured in a static environment.
TON_IoT	2020	IoT end devices (weather stations, smart fridges, doors, lights, etc.), SCADA, PLC, servers (web servers, file transfer servers, database servers)	Ransomware, password attack, scanning, DoS, DDoS, data injection, backdoor, cross-site scripting (XSS), and MiTM	Y	CSV and PCAP	Class imbalance issue, the dataset is made up of static logs. Huge redundant features.
IoT-23	2020	Smart home devices (Amazon Echo Home device, smart LED lamp, and a door lock).	DDoS, Brute Force and credential stuffing, malware infections (Mirai, Gafgyt), C2 communications, scanning and exploitation	Y	PCAP, CSV, and TXT	Imbalanced dataset. The ecosystem network deployed to generate the dataset is limited and lacks diversity.

, the majority of the benchmark datasets incorporated emerging cyberattacks in the data generation phase. Also, as shown in Table 2, the datasets’ generation setups involve predominantly small-scale home automation devices and some form of simulations. Thus, it can be argued that simulations may not depict real-world situations and scenarios. Also, it can be argued that the datasets may not be fully applicable for IIoT intrusion analysis as the generation processes are from small-scale smart home setups. Furthermore, the class imbalance issue is a general problem among the benchmark datasets.

4.2. IoT Network Data Analysis/ Classification Phase

With generated datasets containing millions of instances with numerous features, solutions in the form of automation models, specifically AI algorithms, are being considered viable options to monitor, identify, and respond to intrusions as they do not require the need for constant human supervision [132]. With the FortiGuard AI-powered security services, top cybersecurity firm Fortinet develops and utilizes machine learning and AI technologies to provide timely and consistent protection and actionable threat intelligence [133]. Various traditional machine learning techniques such as SVM [77,91,118], DT [99,116,117,118], KNN [99,107], etc., as well as various deep learning models [80,100,134,135,136] and reinforcement learning models [137,138,139,140,141], have been proposed for IoT network intrusion monitoring, prediction, and detection in recent studies.

While conventional machine learning models, such as DT, SVM, etc., have shown good performance in handling the task, they are considered rather inefficient, particularly in terms of their capacity to generalize in complex models with changing features such as IoT network environments. Ullah et al. [142] proposed a transformer neural network-based model for detecting intrusions in MQTT-enabled IoT networks. The developed model leveraged the parallel processing capability of the transformer neural network for improved and prompt detection of attacks. Similarly, the authors of [143] proposed a transformer model for detecting intrusions based on its well-known adaptability and reliability. The authors evaluated the developed model on the NSL-KDD as well as the UNSW-NB15 datasets.

Traditionally, it would be expected that most IoT IDS models are binary classification as it logically means either the network has intrusive elements or not. However, with the level of extensive research on IoT networks, various forms of emerging attacks and intrusion scenarios are being considered in the data generation processes. Thus, the majority of the classification models are multiclass rather than binary (and, in some cases, both). In a study that involved both binary and multi-label classes, Ahli et al. [84] modeled various classifiers, including neural networks, for detecting malicious traffic flows in the popular Aposemat IoT-23 dataset. In a similar study, the authors of [134] deployed a convolutional neural network for a multiclass classification task using four benchmark IoT datasets, namely Bot-IoT, IoT network intrusion, MQTT-IoT-IDS2020, and IoT-23 intrusion detection datasets.

While some authors deployed single models, several recent studies explored a comparison approach, which involves the comparison of different learners on a specific dataset(s), thereby showing how each of the learners performs on the different dataset’s features and characteristics. Khanday et al. [144] modeled several classifiers, including SVM, Gaussian Naïve Bayes, and AdaBoost, for the binary and multiple classifications of IoT attacks. Using the IoT-23 dataset, the authors achieved the best result from the Gaussian Naive Bayes. Vitorino et al. [145] performed an analysis involving the comparison of supervised, unsupervised, and reinforcement learning models on a modified version of the IoT-23 dataset. The study considered both binary and multi-class classes. Specifically, the authors developed models that include SVM, extreme gradient boosting (XGBoost), light gradient boosting machine (LightGBM), isolation forest (iForest), local outlier factor (LOF), and double deep Q-network (DDQIN) for experimentation. Using popular metrics, which include accuracy, F1 score, AUC, etc., Zhang et al. [146] compared the performance of DT, Naïve Bayes, SVM, RF, XGBoost, convolutional neural networks (CNN), and recurrent neural networks (RNN) on the KDD CUP99 and NSL-KDD datasets.

To reduce uncertainty and improve both robustness and predictive performances, several authors have explored the combination of multiple models for the security analysis of IoT networks. Using the ToN_IoT dataset for evaluation, Mousa’B et al. [102] modeled CNN models and extreme learning machines (ELM) models for IoT network security analysis. De Souza et al. [147] experimented with the combination of RF, extra tree (ET), and deep neural network for the analysis of Bot-IoT, IoTID20, NSL-KDD, and CICIDS2018 datasets. Leevy et al. [109] compared the performance of a group of ensemble classifiers (CatBoost, Light-GBM, XGBoost, and RF) and four non-ensembles (DT, logistic regression, Naive Bayes, and a multilayer perceptron (MLP)) for detecting information theft attacks using the BoT-IoT dataset. Kabir et al. [148] compared the stacking models of XGBoost, KNN, and RF and the stacking of XGBoost, NN, KNN, and RF with an ET classifier with mutual information gain feature selection method for the analysis of the UNSW-NB15 packet-based dataset. In [97], the authors explored various ensembles involving RF, ET, and XGB using logistic regression as the meta-classifier for the analysis of the TON_IoT dataset. Popular metrics include accuracy, F-score, recall, precision, receiver operating characteristic-AUC (ROC-AUC), computational time, etc., that are used for evaluating the performance of the various learning models. Accuracy, precision, recall, and F-score are defined in (5), (6), (7), and (8), respectively [11,122,149]. These metrics have been extensively discussed in various studies in the literature [4,8,11,12].

$$Acc={\displaystyle \frac{total correctly classified samples}{total dataset samples}}$$

(5)

$$\mathrm{Pr}ecision={\displaystyle \frac{True Positive}{True Positive+ False Positive}}$$

(6)

$$\mathrm{Re}call={\displaystyle \frac{True Positive}{True Positive+ False Negative}}$$

(7)

$$F-score={\displaystyle \frac{2\times \mathrm{Pr}ecision\times \mathrm{Re}call}{\mathrm{Pr}ecision+\mathrm{Re}call}}$$

(8)

where True Positive refers to the total number of correctly classified intrusive event instances, False Positive refers to the total number of normal events instances that are wrongly classified and False Negative refers to the rate of false negative observations.

The summary of some recently published articles whereby data-driven models were deployed for analyzing and classifying IoT network security menaces is presented in

Table 3. Comparison of Recently Proposed Data-driven AI-Based Approaches for IoT Network Security Assessment.

Ref.	AI Model(s)	Dataset(s)	Contributions in Summary
[90]	LSTM, CNN, and CNN-LSTM	IoTID20	Implemented SMOTE, ADASYN, and RUS to deal with the class imbalance issue. Metrics including accuracy, precision, recall, AUC, F1-score, and sensitivity were used to evaluate model performances. The results achieved were outstanding.
[150]	Transformer	TON_IoT	Focus on analysis of traffic data as well as IoT sensors’ telemetry data. The experimentation explored both binary classification and multiple classifications. Missing data points and invalid values of categorical features in the dataset are substituted with the string “-” while all invalid values of numerical features were substituted with the value “−1”. Each categorical feature with a value between 0 and U is encoded, whereby U is the number of unique contents for the categorical feature. The values are further used to calculate embedding vectors for categorical features, and numerical features are normalized. The model performed exceptionally well.
[122]	Ensemble AdaBoost, LightGBM, and XGBoost	IoTID20 and Car Hacking: Attack and Defense Challenge 2020 (CHADC2020)	Rigorous pre-processing, including dealing with missing values median imputation, correlation-based feature selection, and min/max normalization. Tomek links and edited nearest neighbors (ENN) for undersampling while SMOTE and BorderlineSMOTE for oversampling. Using metrics including precision, recall, F1-score, accuracy, and ROC-AUC, the hybrid-ensemble approach achieves remarkable results.
[1]	Neural networks	Edge-IIoTset, WUSTL-IIOT-2021, and IoTID20	Optimization based on the Salp swarm algorithm (SSA) for selecting optimal networks for the neural network model. The combination performed well on the three datasets.
[117]	RF	IoTID20	Pre-processing steps include removing duplicate data and irrelevant features such as Flow_ID, Src_IP, Timestamp, and Dst_IP. Also, replacing missing values using median values and using min/max normalization. Focusing on the ARP Spoofing attack detection. Comparison between simple and ensemble models and evaluating the performance using accuracy, precision, sensitivity, F-measure, and speed. The experimental results showed that wrapper feature selection with the RF classifier reduced around 50.6% of the IoTID20 features and achieved good performances.
[116]	Neural networks, RF, DT	IoTID20, N-BaIoT, and MedBIoT	Feature reduction and noise filtering based on RENN, Explore, and DROP5 algorithms. SMOTE for dealing with data imbalances. Standard metrics, including accuracy, precision, recall, specificity, F-score, and G-mean were used. Results showed that the RENN and DROP5 filtering models presented excellent results.
[86]	LSTM	UNSW-NB15 and Bot-IoT	Protocol-Based Deep Intrusion Detection (PB-DID) architecture, whereby a dataset of packets from IoT traffic involving features from the UNSW-NB15 and Bot-IoT datasets based on flow and TCP, was analyzed. Non-anomalous, DoS, and DDoS traffic were classified. Typical issues such as class imbalance and over-fitting issues were catered for. Exceptional performances were achieved based on the results.
[100]	KNN, RF, CART, and deep learning algorithms (CNN, LSTM, DNN)	TON_IoT	For the issue of class imbalance, SMOTE was deployed for oversampling, while a modified version of the redundant-based Tomek link removal technique was used to cater for under-sampling. Deployed the use of sine and cosine component cyclic encoding for temporal attributes. The learners performed well with the binary and multi-class classification based on the evaluation metrics which include accuracy, precision, recall, and F1 score.
[109]	Four ensembles (CatBoost, Light-GBM, XGBoost, and RF and four non-ensembles (DT, Logistic Regression, Naive Bayes, and a Multilayer Perceptron).	BoT-IoT	The subset of original data containing 3,668,522 instances and 43 features was used for experimentation. The focus was on the 477 normal instances and 79 information theft instances. To gauge the classifiers’ performances, AUC and AUPRC metrics were used.
[114]	DT	BoT-IoT	For easy learning, the subset of the original data was used (only 3 out of the 29 Bot-IoT features). For evaluating the classification performance of the algorithm, AUC and AUPRC metrics were used and the model performed well.
[107]	KNN, Naive Bayes and Multi-layer Perception	BoT-ToT	SMOTE was used for data feature engineering. Based on the accuracy, precision, recall, F1-Score, and ROC AUC results, the KNN algorithm performed the best among the learners.
[91]	RF, Naıve Bayes, Neural Networks, SVM and AdaBoost.	IoT-23	A statistical correlation was deployed whereby a correlation matrix for each of the 33 data files in the IoT-23 data was drawn and the results were averaged. Data with no statistical correlation were removed. RF presented the best result.
[80]	Adversarial Autoencoders (AAE) and Bidirectional Generative Adversarial Networks (BiGAN)	IoT-23	Preprocessing involves various tasks like feature selection, encoding, normalization, and balancing. The generative models outperform traditional machine learning models.
[99]	8 classifiers, including logistic regression, naive Bayes, DT, SVM, KNN, RF, Adaboost, and XGBoost.	TON_IoT	Missing values are imputed and one-hot encoding was used to convert categorical features. Min/max normalization also formed part of the pre-processing steps. The Chi2 technique was used for feature selection and SMOTE was deployed for class balancing. XGBoost outperformed the other models.
[146]	DT, Naive Bayes, SVM, RF, CNN, RNN, XGBoost	KDD CUP 99 and NSL-KDD	PCA was used for dimensionality reduction. Metrics, including detection accuracy, F1, and AUC, were used to perform a comparative assessment of the learners. Analysis results showed that the ensemble learning algorithm performed generally better. The Naive Bayes algorithm has low accuracy in recognizing the learned data, but it has obvious advantages when facing new types of attacks, and the training speed is faster.
[145]	SVM), XGBoost, LightGBM, Isolation Forest (iForest), Local Outlier Factor (LOF), and Double Deep Q-Network (DDQN)	IoT-23	A comparative analysis of supervised, unsupervised, and reinforcement learning techniques on nine malware captures of the IoT-23 dataset, whereby both binary and multi-class classification scenarios were considered. The most reliable result was achieved by the LightGBM model. The DDQN also performed well in specific tasks.
[4]	Gated recurrent unit, LSTM, and multilayer perceptron	IoT-23, IoTID-20	An ensemble model was proposed. PCA was used for feature selection. The ensemble model’s performance was evaluated using IoT-23 and IoTID-20 datasets.

. Table 3 presents a summarized description of the contributions of the studies and the dataset/test system employed, as well as the learning model(s) used in the security assessment studies.

As shown in Table 3, the deployment of data-driven AI models for IoT network intrusion analysis studies has been relatively successful. As shown in Table 3, the results achieved from the various models depict that the attacks integrated into the various testbeds are reliably detected or classified. However, as the majority of the studies rely heavily on simulated testbeds and open-source datasets (some of which involve simulated attack integrations), there is no real guarantee that the proposed models can be reliably effective in real-life systems.

5. Research Gaps and Future Directions

Regardless of the exceptional performances achieved from the applications of data-driven AI models for the security analysis of IoT networks in literature studies, there are several identified challenges and research gaps that are still unsolved. Some of these research gaps were identified from the analysis of the methodologies adopted in the reviewed articles. The key research gaps that were identified from the recently published articles are discussed briefly.

• The performance of the learning model(s) heavily depends on the heterogeneity and qualitative and quantitative properties of the dataset and test systems deployed. The heterogeneous, dynamic, and diverse nature of typical real-life IoT networks basically demands that the security analysis in this regard deploy typical IoT network setups that mimic real-life scenarios. However, due to the non-availability and inadequacy of data from real IoT networks, researchers have consistently turned to the use of simulated datasets, often outdated open-source datasets and/or scalable testbed developments, which often lack the characteristics of emerging real-life IoT networks. Thus, they have often shown inconsistency in the data-driven models’ learning processes.
• The majority of these benchmark datasets have class imbalance and noisy and missing data issues, which can negatively impact the performances of the learning models. These issues typically arise from the data generation phase, as IoT end devices can often produce noisy, incomplete, or inconsistent data. For example, a location determination technology such as sensor readings may be inconsistent due to environmental factors or technical issues, leading to erroneous data.
• Apart from the number of input dataset(s), another important factor is the pre-processing steps. Various studies have explored varieties of models and algorithms to pre-process the data with the sole aim of achieving better performance(s) from the learning model. While these methods have been quite effective, most often, the proposed models tend to be rigorous, leading to high computational complexity of the entire process. Thus, there is a need for effective yet scalable solutions. Additionally, the tuning of the parameters involved in achieving desired results often requires expertise and makes the process time-consuming.
• The black-box nature of emerging learning models, particularly deep learning models, whereby their decision-making process is not easily interpretable and transparent for general users. In a security context, it is crucial to understand why a model classifies something as an attack or normal behavior, as this can help security experts diagnose and respond to threats more effectively. Future research can also explore federated learning, whereby the training of a model is distributed across many decentralized devices or servers rather than relying on a centralized server to gather and store all the data. It allows multiple devices or clients to collaboratively train a shared model while keeping the data on local devices (such as smartphones, edge devices, or IoT devices), thereby preserving privacy and reducing the need for data transfer.

6. Conclusions

The goal of improving the quality of life, enhancing productivity, and unlocking new possibilities across homes, cities, applications, and industries has contributed to the geometric growth of IoT globally. As IoT technologies continue to grow, the issue of security and privacy across the different interconnected devices and systems poses significant challenges to its global dominancy and users’ acceptance. This paper presents a comprehensive review of the most recent studies whereby data-driven learning models were developed for IoT security analysis. The study highlights emerging IoT security and privacy issues, current conventional strategies and methodology procedures for mitigating the security challenges, as well as the significant progress, achievements, and, more importantly, the limitations and research gaps identified in the data-driven learning models’ applications to recent IoT security studies in the literature. By doing this, the study provides a detailed research-based resource for researchers working on IoT and general industrial control systems security. Furthermore, research gaps and recommendations for future research works are presented.