Advanced Cybersecurity, Threat Detection, and Digital Forensics for IoT Systems

A special issue of Future Internet (ISSN 1999-5903). This special issue belongs to the section "Internet of Things".

Deadline for manuscript submissions: 28 February 2027 | Viewed by 439

Special Issue Editors


E-Mail Website
Guest Editor
Department of Computer Science and Cybersecurity, University of North Georgia, 82 College Circle, Dahlonega, GA 30597, USA
Interests: cybersecurity; digital forensics; IoT security; artificial intelligence

E-Mail Website
Guest Editor
Department of Computer Science, Sam Houston State University, Huntsville, TX 77340, USA
Interests: digital forensics; cybersecurity; data cleaning; data quality
Special Issues, Collections and Topics in MDPI journals

Special Issue Information

Dear Colleagues,

The rapid proliferation of Internet of Things (IoT) devices has fundamentally transformed how systems collect, process, and transmit data, extending the attack surface far beyond traditional network boundaries. From smart home sensors and industrial control systems to healthcare wearables and critical infrastructure, IoT environments introduce unique security challenges: heterogeneous hardware, constrained resources, limited update mechanisms, and massive deployment scale. Securing these environments requires not only robust network-level defenses but also advanced threat detection capabilities and rigorous digital forensics frameworks that can operate effectively at the edge.

This Special Issue addresses the intersection of cybersecurity, threat detection, and digital forensics, specifically within IoT contexts. We welcome contributions that apply machine learning, deep learning, and AI-driven methods to detect, classify, and respond to threats across IoT systems. We are equally interested in forensic methodologies for evidence acquisition, log analysis, and attack reconstruction in resource-constrained and distributed environments. Topics of interest include anomaly detection, intrusion detection and prevention systems, malware analysis, adversarial attacks on IoT-integrated ML models, privacy-preserving security mechanisms, and the application of reinforcement learning and computer vision to cyber threat intelligence.

We invite researchers and practitioners to submit original research articles, reviews, and short communications that advance our collective understanding of securing the IoT ecosystem against an increasingly sophisticated and AI-accelerated threat landscape.

Dr. Khushi Gupta
Dr. Cihan Varol
Guest Editors

Manuscript Submission Information

Manuscripts should be submitted online at www.mdpi.com by registering and logging in to this website. Once you are registered, click here to go to the submission form. Manuscripts can be submitted until the deadline. All submissions that pass pre-check are peer-reviewed. Accepted papers will be published continuously in the journal (as soon as accepted) and will be listed together on the special issue website. Research articles, review articles as well as short communications are invited. For planned papers, a title and short abstract (about 250 words) can be sent to the Editorial Office for assessment.

Submitted manuscripts should not have been published previously, nor be under consideration for publication elsewhere (except conference proceedings papers). All manuscripts are thoroughly refereed through a single-blind peer-review process. A guide for authors and other relevant information for submission of manuscripts is available on the Instructions for Authors page. Future Internet is an international peer-reviewed open access monthly journal published by MDPI.

Please visit the Instructions for Authors page before submitting a manuscript. The Article Processing Charge (APC) for publication in this open access journal is 1800 CHF (Swiss Francs). Submitted papers should be well formatted and use good English. Authors may use MDPI's English editing service prior to publication or during author revisions.

Keywords

  • IoT security and privacy
  • threat detection and intrusion detection systems
  • digital forensics for IoT
  • machine learning for cybersecurity
  • deep learning-based anomaly detection
  • malware analysis and classification
  • adversarial attacks on AI/ML systems
  • network traffic analysis
  • edge computing security
  • computer vision for threat intelligence
  • reinforcement learning in cybersecurity
  • log analysis and attack reconstruction
  • natural language processing for cyber threat intelligence
  • lightweight security protocols for constrained devices

Benefits of Publishing in a Special Issue

  • Ease of navigation: Grouping papers by topic helps scholars navigate broad scope journals more efficiently.
  • Greater discoverability: Special Issues support the reach and impact of scientific research. Articles in Special Issues are more discoverable and cited more frequently.
  • Expansion of research network: Special Issues facilitate connections among authors, fostering scientific collaborations.
  • External promotion: Articles in Special Issues are often promoted through the journal's social media, increasing their visibility.
  • Reprint: MDPI Books provides the opportunity to republish successful Special Issues in book format, both online and in print.

Further information on MDPI's Special Issue policies can be found here.

Published Papers (1 paper)

Order results
Result details
Select all
Export citation of selected articles as:

Research

24 pages, 2340 KB  
Article
A Stability-Centric Framework for Lightweight and Explainable Intrusion Detection
by Abdalilah Alhalangy, Saleh Abdulrahman Alkhamis and Eman Abouelkheir
Future Internet 2026, 18(6), 305; https://doi.org/10.3390/fi18060305 - 5 Jun 2026
Viewed by 190
Abstract
Effective intrusion detection for Internet of Things (IoT) environments requires balancing predictive performance, resource efficiency, and interpretability—particularly in real-world deployments where traffic distributions and attack scenarios vary. While many studies report near-perfect detection on benchmark datasets, this often overlooks model stability under distribution [...] Read more.
Effective intrusion detection for Internet of Things (IoT) environments requires balancing predictive performance, resource efficiency, and interpretability—particularly in real-world deployments where traffic distributions and attack scenarios vary. While many studies report near-perfect detection on benchmark datasets, this often overlooks model stability under distribution shifts. This paper addresses this gap by introducing a stability-focused evaluation of lightweight, explainable intrusion detection models using compact IoT-23 scenarios and a constrained set of 14 connection-level features for interpretability. Four lightweight models—logistic regression, random forest, XGBoost, and LightGBM—are assessed within a unified pipeline. Beyond standard internal validation, we implement a strict cross-scenario evaluation framework featuring a fully unseen malware capture. Our proposed Internal–External Stability Gap (IESG) framework, enhanced with normalized and multi-metric measures, highlights the degradation in consistency between internal and external metrics. Surprisingly, even models with high internal F1 scores (up to 0.9994) may experience considerable drops in external macro-F1 and specificity, exposing weaknesses in conventional evaluation. Experimentally, LightGBM provides the best trade-off between performance and compactness (606 KB) and shows the smallest stability gap for malicious detection. Nevertheless, all models show reduced balanced performance under scenario shift, underscoring that deployment readiness hinges on stability under changing conditions. Feature ablation reveals that leveraging high-impact features, such as port information, can boost internal accuracy at the expense of generalization. In summary, we demonstrate that while lightweight models deliver strong detection, only those proven stable across scenarios are viable for real-world IoT intrusion detection. Our evaluation framework offers a practical, interpretable tool for assessing model robustness. Full article
Show Figures

Figure 1

Back to TopTop