Enhanced IoT Intrusion Detection: Leveraging Dense Autoencoders with Mahalanobis Distance and Gamma-Based Thresholding

The rapid growth of IoT (Internet of Things) devices has introduced new vulnerabilities in network security, necessitating advanced, scalable intrusion detection systems. Traditional machine learning approaches fail to navigate the complexity of threat identification in vast IoT network data. In this study, we propose a novel unsupervised anomaly detection framework leveraging dense autoencoders with Mahalanobis distance and Gamma-based thresholding for enhanced IoT intrusion detection. The approach begins with a dense autoencoder trained on network data, allowing it to learn an efficient representation of normal network behavior. Multivariate reconstruction errors are calculated for each instance of IoT network data, and Mahalanobis distance is incorporated to capture deviations that signify anomalous patterns. To ensure robust anomaly detection, a dynamic thresholding mechanism is implemented, utilizing z-scores with underlying Gamma distribution model to adaptively classify instances as normal or anomalous. The proposed framework was rigorously evaluated on a labeled IoT attack dataset and compared to state-of-the-art unsupervised techniques, including Isolation Forest, Extended Isolation Forest, Elliptic Envelope, K-Nearest Neighbors, and One-Class SVM, as well as a standard dense autoencoder. Results demonstrate that our method achieves superior detection accuracy, with an F1-score of 97.6% on the training set and 95.12% on the test set, significantly outperforming baseline models. These findings highlight the effectiveness of proposed approach for reliable and scalable IoT intrusion detection.