Beyond Detection: Testing the Assumptions Behind Intrusion Recovery for Resource-Constrained Agricultural IoT

Framed only this way, though, the two contributions above read as system-building: an application target (a working detector, a working recovery layer) rather than a test of anything that could have come out differently. To make that test explicit, four claims run through the empirical sections below, each stated so that a different result would have counted against it, not merely confirmed what the architecture was built to show.

1. RQ1. Does adding a second detection tier dominate the first, or trade off against it? Routing a primary classifier's low-confidence predictions to a fallback anomaly detector could improve every metric, worsen every metric, or improve one at the expense of another; Section V-C tests this with a paired significance test rather than assuming an improvement.
2. RQ2. Does grounding an assumed model parameter in real measurement change the model's behavior? A recovery policy trained against an assumed detector-confidence distribution could depend heavily on that assumption or barely at all; Section V-D replaces the assumption with the hybrid detector's own measured output and reports whether the policy's advantage moves.
3. RQ3. Does a benchmark's absolute performance transfer to the deployment domain it stands in for? A model ranking learned on enterprise-network traffic could hold, invert, or become meaningless on genuine agricultural traffic; Section V-B is a direct test of that transfer rather than an assumed one.
4. RQ4. Does an autonomous policy's advantage degrade gracefully or collapse as the resources it depends on shrink? A learned recovery policy could hold its advantage at every constraint level, lose it uniformly, or fail past some threshold; Section V-D sweeps compute and connectivity independently as constraints to find out which.

None of these four questions can be settled by a single accuracy number, and each was designed so its answer was not fixed in advance by how the experiment was built.

IoT in Smart Agriculture

Smart agriculture typically runs on a multi-layered architecture, usually made up of perception, network, edge, fog, and cloud layers, to manage farm operations [1], [4]. It combines sensing technologies such as soil moisture sensors, weather stations, automated irrigation, and livestock tracking, which together produce large volumes of data for real-time monitoring and predictive analytics [2].

In precision irrigation, soil moisture sensors send real-time data to automated controllers that manage water distribution to raise yield while using less water. Livestock monitoring systems use wearable sensors to track animal health and behavior, which helps catch disease early. Greenhouse automation pairs environmental sensors with actuators to control temperature, humidity, and light. This architecture depends on a mix of communication protocols: long-range, low-power options like LoRaWAN for wide-area field monitoring, ZigBee for mesh networks inside greenhouses, and lightweight protocols like MQTT and CoAP for efficient data transfer. Having this many protocols in play adds real security complexity, since each layer and protocol opens a different attack surface. Edge computing now plays a central role too, handling data locally so the load on cloud servers drops and sensor data gets an immediate response, which matters for time-sensitive tasks like catching a disease outbreak early or shutting off irrigation in an emergency.

Cybersecurity Threats in Agricultural IoT

AgriIoT networks face a wide range of cyber threats, made worse by the lack of standardized security protocols and by devices that are often unpatched and come from many different vendors [3], [5]. Common threats include DoS/DDoS attacks, malware and ransomware, botnet participation, spoofing, man-in-the-middle (MitM) attacks, and side-channel vulnerabilities [4]. This is not a hypothetical risk. Kulkarni et al. [13] catalog 30 real-world cybersecurity incidents against the food and agriculture sector between 2011 and 2023, predominantly ransomware and data breaches against enterprise IT rather than field-level operational technology. At the field level, Vakhnovskyi [14] threat-models a commercial controlled-environment-agriculture platform and finds that every one of its ten operational-technology protocols in active use lacks authentication or encryption by design, yielding 123 distinct documented threats. Freyhof et al. [15] quantify what exploiting that kind of gap actually costs: a CAN-bus attack that manipulates the application rate of a row-crop fertilizer applicator costs an estimated $13,100 to $32,300 on a 100-acre field per scenario, with under-fertilization the stealthiest and costliest failure mode.

These attacks have real consequences on a farm, and not just hypothetically. Nassi et al. [16] build a botnet entirely from compromised commercial smart-irrigation controllers (RainMachine, BlueSpray, GreenIQ); their damage model estimates that 1,355 compromised sprinklers could empty a water tower in an hour, and roughly 23,866 could drain a flood reservoir overnight. A subtler false data injection attack on soil moisture sensors could fake a moisture reading and trigger unneeded irrigation, waterlogging crops, or suppress irrigation until the crop dries out. The convergence of IT and OT networks matters here: standard IT systems, which can fall to ordinary phishing or social engineering, are increasingly wired into the Operational Technology (OT) networks that run farm equipment, giving attackers a path from an office-level breach to real disruption on the ground. This physical-cyber overlap is distinct to agriculture, where a cyberattack can directly damage physical assets and food production.

Machine Learning for Intrusion Detection

Machine learning and deep learning automate the detection of malicious behavior without needing fixed, signature-based rules [6], [8]. Supervised models such as Random Forest and Support Vector Machines are good at classifying known attack types when labeled data is available [8], [18]. Unsupervised models such as Autoencoders instead learn what normal network behavior looks like and flag anomalies, which makes them well suited to catching previously unseen or zero-day attacks, a common problem in fast-changing IoT environments [19], [20]. In practice, a supervised model learns a function that maps traffic features to a label, benign or malicious. An unsupervised Autoencoder instead learns to reconstruct its input, and how well it does that, the reconstruction error, becomes the anomaly signal: a large error means the input does not match what the model learned as normal. Security systems always face a trade-off between false positives and recall, and federated learning is one way around part of this problem: it lets farms train a shared detection model without handing over their own traffic data [4].

Security Standards and Frameworks for IoT

The growth of IoT has led to several cybersecurity frameworks and standards, most notably the NIST IoT Cybersecurity Capabilities Baseline [21], the ETSI EN 303 645 standard for consumer IoT [22], and the IEC 62443 series for industrial automation and control systems [23]. These give guidelines for secure device configuration, authentication, encryption, and vulnerability management. Applying them to AgriIoT is difficult, though, because they were written with enterprise IT or large industrial systems in mind, assuming computing, memory, and energy resources that low-power, wide-area agricultural sensor networks simply do not have. The main gap between these standards and AgriIoT reality is cost: NIST guidelines often assume multi-factor authentication and continuous, resource-heavy monitoring agents, but a low-power sensor running on battery for months or years in a remote field cannot support that communication overhead or those CPU cycles. IEC 62443's standardized update procedures are often impossible to apply too, since intermittent connectivity makes it hard to patch vulnerabilities remotely. Closing this gap means building lightweight, AgriIoT-specific security profiles that keep the core ideas behind these standards (defense-in-depth, secure-by-design) but scale them down to what agricultural sensing hardware can actually support.

Intrusion Detection Systems for IoT

Building efficient network IDS for IoT is a major research focus, with many studies working on dimensionality reduction, feature selection, and lightweight models that fit hardware constraints [8], [24]. Bella et al. [25] combined a CNN with a decision forest to get high detection accuracy and fast inference. Li et al. [24] compared feature selection against feature extraction and drew out practical guidance for tuning NIDS performance. These models work well for general IoT, but they typically rely on centralized processing and lack the context to tell a normal agricultural sensor fluctuation from an actual network anomaly.

A growing body of work targets the hardware gap directly rather than assuming it away. Diab et al. [26] combine constrained grid search with hardware-aware neural architecture search to fit 1D-CNN intrusion detectors within a 75–190 KB flash budget and under 30 ms of latency on a Raspberry Pi 3B+. Acharya et al. [27] apply quantization-aware neural architecture search to shrink IDS models roughly 1000-fold while cutting FPGA lookup-table usage by 2.3 to 8.5-fold. Jaiswal et al. [28] replace deep networks with an interpretable Tsetlin Machine that reaches 97.83% F1 running on-device on a Raspberry Pi 5. None of these targets agricultural traffic specifically, but together they set a concrete bar for what “lightweight” should mean in this space, one our own resource-footprint measurements (Section IV-F) are measured against.

Cybersecurity in Smart Agriculture

Security research on smart agriculture increasingly points to the need for a more complete cybersecurity framework. Ali et al. [4] reviewed AI applications in AgriIoT cybersecurity and documented nearly 30 distinct threat vectors, from simple sensor spoofing to organized agroterrorism. Thilakarathne et al. [29] built a deception-based threat intelligence platform using honeypots to track real-world attack patterns. Pasca et al. [7] built a “vulnerable-by-design” framework for generating labeled datasets that combine cyber threats with sensor faults. Together, these studies point to the same conclusion: threats against smart agriculture are growing quickly, but defenses are not keeping pace, and few studies offer field-validated solutions built for how modern farms actually run.

Closer to the network-traffic focus of this paper, Praharaj et al. [30] build a cooperative smart-farming testbed on commodity ESP8266 hardware paired with an edge CNN-Transformer detector, capturing labeled attack traffic across nine attack types, the closest existing analogue to an agriculture-native counterpart of CICIDS2017. Adkisson et al. [31] apply an unsupervised autoencoder to a real smart-farming greenhouse deployment and reach 98.98% accuracy distinguishing sensor faults from injected anomalies. Rouzbahani et al. [32] survey the wireless technology stack smart farms actually run on, including NFC/RFID, Bluetooth, Zigbee, Z-Wave, LoRaWAN, and cellular, and map each to its dominant attack class, underscoring how much protocol diversity CICIDS2017's enterprise-network traffic does not capture.

Machine Learning Methods for Anomaly Detection

IDS research uses a wide mix of ML architectures for anomaly detection. Maseer et al. [18] benchmarked ten algorithms on CICIDS2017 and found ensemble methods like Random Forest gave the most stable, accurate results for supervised IDS. Meidan et al. [19] introduced N-BaIoT, which uses deep autoencoders to detect botnet traffic by modeling normal behavior per device type, reaching high accuracy with few false alarms. Together they show that the right algorithm depends on the objective, the dataset, and how much labeled data is actually available.

Benchmark Datasets

Good benchmark datasets matter for evaluating IDS performance, and the choice has to reflect current conditions. NSL-KDD has long been a standard for IDS research, but it does a poor job representing modern IoT traffic [8], [9]. Panigrahi [33] analyzed CICIDS2017 in detail and pointed out the preprocessing it needs: heavy class imbalance, data scattered across multiple files, and missing values. The dataset still covers a wide range of attack types—DoS, DDoS, PortScan, Infiltration, Web Attacks, and Botnet infiltration—all relevant to AgriIoT. An AgriIoT-specific alternative has since appeared: Ferreira et al. [34] released Farm-flow, a labeled network-flow dataset captured from a smart-agriculture testbed. The primary experiments reported here were built on CICIDS2017; Section V-B revalidates the four detection models on Farm-flow directly, rather than leaving that as an unfulfilled follow-up item.

Autonomous Recovery and Self-Healing Systems

Work on automated recovery does exist, but it splits into groups that each miss a different part of the problem this paper addresses. Closest on intent is Sheth et al. [10], who pair machine learning anomaly detection with deep reinforcement learning and security orchestration to build a system that responds to attacks on its own. They report a 96.8% detection rate, a 75% improvement in recovery time, and a 60% reduction in downtime—but the setting is cloud infrastructure, where compute is effectively unlimited and the control channel is always available. Neither assumption holds for a battery-powered sensor sitting in a field.

Closer to our own resource envelope, Madsen et al. [35] train a reinforcement-learning agent to respond autonomously to cyberattacks on unmanned vehicles, validating it across simulation and finally a physical vehicle. EdgeRescue [11] runs compact 1D-CNNs on each node for local anomaly detection and then reconfigures routing in an energy-aware way, cutting recovery latency by 57% on a 100-node simulated mesh with no cloud dependency. TinyHeal [12] takes a similar on-device TinyML approach, predicting link degradation before it forces a costly route repair. Sanabria et al. [36] train reinforcement-learning agents to select recovery strategies for self-healing IoT systems, reaching 55–93% fault-recovery effectiveness depending on scenario. All three operate under real resource limits, and all three treat the failure as a fault: battery depletion, interference, hardware degradation, or link variability. An adversary who has taken over a node is a different problem, because that node keeps running and keeps talking.

A third group uses the term self-healing for adapting the detector rather than remediating the device. Fatima et al. [37] propose SH-IDS, in which a device whose resource usage crosses an adaptive threshold raises a danger signal that triggers an update to the detection model. The model heals, but the compromised node is not isolated, rolled back, or replaced. Closest in domain, Sahu and Tripathi [38] present a data healing framework for outlier detection and recovery in Internet of Agriculture Things sensor networks, but that work restores corrupted sensor readings, a data-level problem rather than a compromised-node one. Within AgriIoT security specifically, Benameur and Dahane [40] build SFEDRL-IDS, a federated deep reinforcement learning IDS deployed on an intelligent irrigation system, reaching 98.67% accuracy on multiclass classification—but it stops at detection.

Taken together, these studies cover attack recovery in the cloud, fault recovery on constrained devices, adaptation of the detector, and repair of sensor data. None of them covers recovery from a security intrusion on a constrained agricultural node, measured under explicit compute and connectivity limits. That is the gap this paper addresses.

Research Gap

Several research gaps remain despite this progress. First, much of the field still relies on outdated datasets that do not represent the modern, mixed-protocol nature of AgriIoT traffic [8], [9]. Second, most IDS methods are tested in clean lab conditions, with almost no field-validated results on real AgriIoT hardware [6], [7]. Third, little research looks at how cyberattacks interact with physical sensor failures, which can mask malicious activity [7]. Fourth, resource-efficient IDS models are still badly needed for agricultural sensor networks in developing regions [5], [8]. A fifth gap concerns what happens after detection: most IDS research, including the AgriIoT-specific systems discussed above, stops once an alert is generated. No prior work measures recovery from a security intrusion on a constrained agricultural node under explicit compute and connectivity limits. This study addresses these gaps: it evaluates both supervised and unsupervised detection on the CICIDS2017 benchmark, and it designs and tests a constrained-resource autonomous recovery layer, giving a baseline for more efficient, context-aware, self-healing IDS for AgriIoT.

Dataset

This study uses the CICIDS2017 dataset, a realistic benchmark covering DDoS, DoS, infiltration, and web attacks. It is widely used because it reflects current attack patterns reasonably well, which makes it a reasonable stand-in for the kinds of threats AgriIoT is likely to face. It contains 2,827,876 records with 78 network traffic features, giving a large, high-dimensional space to work with. Flows are labeled by attack type, so both binary (normal vs. malicious) and multi-class classification are possible.

Preprocessing

Preprocessing involved cleaning the raw parquet files, handling missing values, and splitting the data carefully to avoid leakage. The supervised training set combines normal samples with attack samples, giving about 100,000 training samples, a size chosen to keep training fast while still representing the attack patterns well. Min-Max scaling normalized all numeric features into the [0, 1] range so features with larger natural ranges would not dominate gradient updates when training neural models like the Autoencoders. The split was stratified to keep class proportions consistent and avoid bias in evaluation.

Models

Five machine-learning models were evaluated:

1. Random Forest — an ensemble method that builds many decision trees during training and outputs the class most trees agree on. It works well on large, high-dimensional datasets like CICIDS2017 because averaging across trees reduces overfitting and improves generalization.
2. Decision Tree — a non-parametric supervised method that splits the feature space recursively based on the attribute values that maximize information gain. Because the resulting structure is a simple hierarchy, security analysts can inspect the decision logic directly.
3. Logistic Regression — a linear classification model that predicts the probability of a categorical outcome. It is simple, but that is exactly what makes it a useful benchmark: it shows the limits of a linear model when the patterns in modern network intrusions are this non-linear.
4. Autoencoder — an unsupervised network trained as an identity function. The architecture (78 → 128 → 64 → 16 → 64 → 128 → 78) reconstructs its own input at the output layer. Forcing the data through a 16-dimensional bottleneck makes the model learn the underlying distribution. At inference time, the reconstruction error is the anomaly signal.
5. Variational Autoencoder (VAE) — a generative model that learns the probability distribution of the input rather than a fixed encoding. Its latent space is governed by a prior distribution, giving anomaly detection a probabilistic footing. It depends on carefully tuning the KL-divergence term; without it, training becomes unstable.

Evaluation Metrics

Models were evaluated with five metrics that together give a fuller picture of performance:

• Precision — the ratio of true positive predictions to all positive predictions. It reflects how well the model avoids false alarms, which matters for keeping smart farm operations running without disruption.
• Recall — the ratio of true positive predictions to the actual number of positive instances. High recall matters most in security systems, since it means most attacks get caught.
• F1-Score — the harmonic mean of precision and recall, a balanced metric that is especially useful when classes are imbalanced.
• ROC-AUC — the area under the receiver operating characteristic curve, measuring how well the model separates classes across different probability thresholds.
• PR-AUC — the area under the precision-recall curve, a finer-grained view of performance under class imbalance.

Experimental Setup

The experiments were built to balance reproducibility with realistic computing requirements. Everything ran on Python 3.12, using the uv package manager to keep dependencies and the environment stable. The deep learning models, the Autoencoder and Variational Autoencoder, were built in PyTorch. The supervised models, Random Forest, Decision Tree, and Logistic Regression, used scikit-learn. All training and evaluation ran on a standard laptop CPU, with no GPU. That was a deliberate choice: it mirrors the resource limits of the edge hardware actually used in agricultural deployments. The supervised models turned out to be fast even under this constraint: Random Forest trained in 3.01 seconds, Decision Tree in 2.48 seconds, and Logistic Regression in 2.45 seconds. The unsupervised neural models took longer to train, which points to more work being needed on lightweight, edge-native model design.

Resource Footprint

CPU-only training speaks to compute cost during training, but says nothing about the memory and inference cost of running a trained model afterward on constrained hardware. We quantized the Autoencoder and VAE with PyTorch's dynamic INT8 quantization and measured model size and per-sample CPU inference latency before and after, alongside the on-disk size of the three supervised models. The Autoencoder shrank from 155.94 KB to 47.46 KB (a 69.6% reduction), with per-sample latency falling from 0.011 ms to 0.0035 ms; the VAE shrank from 160.56 KB to 49.70 KB (69.0%), with latency falling from 0.0040 ms to 0.0015 ms. The supervised models are already small: 21,200.87 KB for the 100-tree Random Forest, 93.40 KB for the Decision Tree, and 1.32 KB for Logistic Regression, with sub-millisecond per-sample inference for all three.

These figures were measured on a standard laptop CPU, not embedded or ARM hardware, and should be read as evidence that the quantized neural models are small and fast enough to be worth deploying at the edge, not as a substitute for validation on the target hardware class. Chehade et al. [41] report an 88.26K-parameter 1D-CNN quantized to INT8 and deployed on STM32 microcontrollers, reaching 115.4 ms and 28.85 mJ per inference on a Cortex-M4; Jamshidi et al. [42] report an autoencoder-plus-isolation-forest IDS across a ten-node Raspberry Pi 4B testbed with a cluster-wide mean memory footprint of 113.2 MB. Our quantized Autoencoder's kilobyte-scale footprint sits comfortably below either reported figure, largely because CICIDS2017's 78-dimensional input keeps the network narrow compared to raw packet or flow inputs. Training cost also has an energy and carbon footprint: using codecarbon, one Random Forest training run consumed an estimated 0.00125 kWh and emitted roughly 3.1×10^-5 kg of CO₂-equivalent.

Autonomous Recovery Layer

The detection tier above only answers whether a flow is malicious. To address the recovery gap identified in Section III-F, we build a second tier that decides on, and carries out, a remediation action once a node is flagged, evaluated under conditions that represent field-deployed AgriIoT hardware rather than cloud infrastructure. We model a single AgriIoT node as a four-state system: healthy, compromised, isolated, and recovering. At each time step, a recovery policy picks one of four actions: wait, isolate, rollback, or reroute traffic to a backup node. Two constraints separate this environment from the cloud setting in [10]. First, a per-step compute budget accumulates over time, so a costly action like rollback takes longer to run on constrained hardware. Second, a connectivity reliability parameter sets the probability that a command actually reaches the device on a given step.

We compare a tabular Q-learning agent, trained over 4,000 episodes with domain randomization across constraint settings, against a fixed-delay baseline that mimics a manual, ops-driven incident response. Both policies are evaluated over 300 held-out episodes per setting, across a 3 × 3 grid of connectivity reliability ({1.0, 0.7, 0.4}) and compute budget ({3, 2, 1} ticks per step). We report Mean Time to Recovery (MTTR) and total downtime steps per episode. Crucially, the environment's observation includes a detector-confidence signal. Rather than assume a fixed distribution for this signal, we derive it empirically from the two-tier hybrid detector: we measure the mean and standard deviation of the hybrid's own confidence score on its true positives and true negatives on the CICIDS2017 test set, and use those measured parameters in place of an assumed placeholder.

To make the workflow concrete, the panel below replays the end-to-end training pipeline used for this study—data loading from CICIDS2017, preprocessing, the stratified split, CPU-only model training, evaluation, and the autonomous recovery layer—looping continuously. The metric bars report the measured F1 score for each model, contrasting the strong supervised classifiers against the high-recall but lower-precision unsupervised detectors.

The performance of the models evaluated on the CICIDS2017 dataset is summarized in Table 1 and visualized in Fig. 4. The supervised models perform very well: Random Forest (RF) and Decision Tree (DT) reach near-identical F1 scores above 0.996. RF edges out DT slightly, with a ROC-AUC of 0.9998 and PR-AUC of 0.9996 against DT's 0.9976 and 0.9973. Logistic Regression falls well behind both, at an F1 of 0.8921, mainly because a linear model cannot capture the non-linear feature interactions and complex decision boundaries that CICIDS2017's attack types require.

Among the unsupervised models, the full Autoencoder gets a balanced F1 of 0.6914, with precision at 0.6792 and recall at 0.7042. The quick-trained versions of the Autoencoder and VAE behave differently: the quick Autoencoder trades precision (0.5361) for near-perfect recall (0.9979), so it catches almost every attack but also flags a lot of benign traffic as malicious. The VAE shows the same high-recall pattern (0.9946) with the lowest precision of any model (0.4766), meaning roughly half its alerts are false positives. The gap between supervised and unsupervised performance is large, about 0.30 F1 points between the best supervised model (Random Forest, F1=0.9965) and the best unsupervised one (Autoencoder quick, F1=0.6975).

The VAE also ran into training instability: at epoch 11, the KL divergence term grew uncontrollably and overwhelmed the reconstruction loss. This is a known VAE failure mode when the KL weight is too high relative to reconstruction loss. The usual fix, KL annealing, was not applied here, so it remains for future work.

Statistical Robustness

Table 1 reports a single run. To check whether that run is representative rather than a favorable draw, we retrained Random Forest, Decision Tree, and Logistic Regression across 5 random seeds and report the mean and standard deviation of each metric in Table 2. Variance across seeds is small for every model (standard deviations two to three orders of magnitude below the mean), so Table 1's ranking is not an artifact of one favorable data split. Figure 6 shows the raw counts behind Tier 1's numbers: 371 false positives and 600 false negatives out of 732,542 flows.

To place these numbers against the literature rather than only against each other, Table 3 lines up our results with two CICIDS2017 studies. Maseer et al. [18] tuned five configurations per algorithm and report the best of each; their tuned Random Forest posted the single highest F1 (99.55%) in their comparison table. Bella et al. [25] report accuracy rather than F1 for their CNN-plus-decision-forest hybrid, so that row is not a like-for-like F1 comparison and is labeled accordingly.

Cross-Dataset Validation on Farm-flow

CICIDS2017 is enterprise-network traffic, not agricultural traffic, a limitation Section III-F names directly. To check whether that limitation actually costs us anything empirically, we retrained and re-evaluated all four detection models (Random Forest, Decision Tree, Logistic Regression, Autoencoder) on Farm-flow [34], an AG-IoT network-flow dataset covering eight attack types (ARP spoofing, botnet DDoS, HTTP/ICMP/TCP/UDP flood, MQTT flood, port scanning) captured from a working smart-agriculture testbed. We used the dataset authors' own pre-split, pre-normalized binary train/test files, applying our own scaler on top of their normalization for consistency with the CICIDS2017 protocol; this yields 29 usable features and a roughly balanced 286,654 normal / 277,972 attack rows across train and test.

Table 4 shows two things worth naming plainly. First, every model generalizes noticeably worse from Farm-flow's own validation split to the dataset authors' held-out test split than any model did on CICIDS2017: F1 drops from roughly 0.995–0.997 on validation to roughly 0.915–0.922 on test, versus a test F1 above 0.996 for Random Forest and Decision Tree on CICIDS2017. Because this drop is consistent across all four model families, supervised and unsupervised alike, it looks like a property of Farm-flow's validation/test split rather than overfitting specific to one model. Second, the gap between supervised and unsupervised detection that CICIDS2017 shows so clearly (Random Forest F1 0.9965 versus Autoencoder F1 0.6975 there) mostly disappears here: on Farm-flow's test set, the Autoencoder's F1 (0.9152) sits within 0.7 points of Random Forest's (0.9224), and Logistic Regression is statistically indistinguishable from Random Forest and Decision Tree here.

Hybrid Architecture Ablation

Section VI-G proposes a three-tier architecture with a Random Forest classifier as the primary detector and an Autoencoder handling flows the Random Forest is not confident about. We test that architecture directly rather than leaving it as an untested proposal. Tier 1 is the Random Forest alone. Tier 1+2 routes any flow whose Random Forest probability falls within [0.35, 0.65] to the Autoencoder, and takes the Autoencoder's own thresholded decision for those flows only; that band covered 1.02% of test flows.

Table 5 and Fig. 7 show the trade the hybrid actually makes: routing low-confidence flows to the Autoencoder lowers the false-positive rate from 0.082% to 0.069%, a 15.7% relative reduction, at the cost of a small drop in recall (0.9978 to 0.9965) and F1 (0.9983 to 0.9977). Reading the raw counts behind those percentages changes how that trade-off should be described. Tier 1 makes 371 false positives and 600 false negatives; Tier 1+2 makes 313 false positives (58 fewer) and 983 false negatives (383 more). A McNemar exact test on the paired predictions confirms the difference between the two tiers is not noise (p < 10^-45, 111 flows flip from wrong to right, 436 flip from right to wrong), but the direction of that confirmed effect is that Tier 1+2 gets more flows wrong overall than Tier 1 does, not fewer. In plain terms, the hybrid trades roughly seven additional missed attacks for every false alarm it removes. Whether that is a good trade depends entirely on how an operator weighs a missed attack against a chased-down false alarm; we do not think this result should be read as implying the hybrid strictly dominates the single-tier classifier.

We also checked whether this trade-off is sensitive to the ±0.15 confidence band chosen for Table 5, by sweeping the band from ±0.05 to ±0.30 (Table 6). The false-positive rate falls smoothly as the band widens up to about ±0.25 before ticking back up at ±0.30, and recall falls monotonically throughout, so ±0.15 is a reasonable middle setting. The multi-seed check extends to this ablation too: across the same 5 seeds, Tier 1+2's false-positive rate averaged 0.069% ± 0.001% against Tier 1's 0.082% ± 0.002%.

This ablation also gives us something the original, proposed-only version of this architecture did not have: a real, measured detector-confidence distribution to hand to the recovery layer, rather than an assumed one. Among the hybrid's true positives, confidence was tightly clustered (μ = 0.997, σ = 0.020); among true negatives, confidence was low and equally tight (μ = 0.001, σ = 0.011).

Recovery Performance Under Resource Constraints

Table 7 and Fig. 8 report MTTR and downtime for the learned Q-learning recovery policy against the fixed-delay baseline, across all nine connectivity/compute settings, using the empirically-grounded confidence distribution. Averaged across all nine settings, the learned policy cuts MTTR by 68.3% and downtime by 62.2% relative to the baseline. Re-running the identical grid under the original, unmeasured placeholder confidence distribution gives 67.1% and 61.0%, essentially the same result: grounding the assumption in a real detector's measured output did not weaken the recovery layer's advantage, and if anything strengthened it very slightly.

The drop-off is gradual, not sudden: at full connectivity and ample compute the gain peaks at 77.8%, and under the worst combination tested (0.4 connectivity, minimal compute) it falls to 44.1%, which reflects the real cost of running a rollback when both the command channel and the device's own compute are limited. Both figures are close to, though a bit below, the 75% MTTR improvement and 60% downtime reduction that [10] reports in an unconstrained cloud environment, even though our setting imposes real compute and connectivity limits that the cloud study does not face. As far as we know, this is the first reported measurement of how connectivity and compute constraints degrade recovery from a security intrusion, and the first such evaluation on a constrained agricultural node.

Revisiting the Falsifiable Questions

Section I posed four questions precisely so that a different empirical result would have counted against each. Not all of them resolved the way a purely applied, system-building framing would have predicted, which is worth stating directly rather than folding quietly into the results above.

RQ1 (second tier: dominate or trade off) resolved as a genuine trade-off, not an improvement. The McNemar test confirms the Autoencoder fallback statistically significantly lowers the false-positive rate (p < 10^-45), but it does so by trading roughly seven additional missed attacks for every false alarm removed. The three-tier architecture stands, but as a configurable trade-off an operator has to weigh, not a strict win—a different and more useful claim than “the hybrid improves detection.”

RQ2 (grounded confidence: does it move the policy) resolved as largely no. Replacing the placeholder confidence distribution with the hybrid detector's own measured output moved the MTTR gain from 67.1% to 68.3% and the downtime gain from 61.0% to 62.2%, a difference small enough to say the placeholder was not doing unacknowledged work. That is itself an informative result, not a null one: it means the recovery layer's advantage comes from the constraint-aware policy structure rather than from an optimistic assumption about detector behavior.

RQ3 (benchmark transfer) resolved as partial. The four-model ranking transfers from CICIDS2017 to Farm-flow, but the performance ceiling does not: F1 falls from above 0.996 to around 0.92 for every model, and the sharp supervised/unsupervised gap CICIDS2017 shows mostly closes. Asking the falsifiable version is what forced the cross-dataset check that surfaced this gap.

RQ4 (graceful degradation or collapse) resolved as graceful. MTTR gain falls from 77.8% at the easiest constraint setting to 44.1% at the hardest, a substantial but gradual decline rather than a cliff, which is the more useful property for a deployment where compute and connectivity are rarely at their best.

Two of the four questions (RQ1, RQ3) turned up a real cost or a real gap that a success-oriented system description would have been tempted to omit; the other two (RQ2, RQ4) confirmed the architecture's advantage is not an artifact of a convenient assumption. Both kinds of answer matter more here than a single headline number would, because each was falsifiable before the experiment ran.

Supervised vs. Unsupervised ML

This evaluation confirms that supervised learning is still the strongest option for high-accuracy attack detection when labeled traffic data is available. Supervised algorithms map input features to known attack signatures fairly precisely. But class imbalance, where attacks are vastly outnumbered by normal traffic, and the cost of continuous labeling in AgriIoT limit how far a fully supervised model can go in practice. Unsupervised learning trades some accuracy for adaptability: it needs no labels and can keep modeling normal traffic on its own, which matters in AgriIoT because new, zero-day threats can show up in protocols researchers have not gotten around to labeling yet. For an AgriIoT operator, the choice comes down to labeling budget and risk tolerance. The best setup is a hybrid: a supervised model handles known attacks with high confidence, and an unsupervised model acts as a safety net for new threats that have no signature yet.

Why Random Forest Excels

Random Forest performs best here largely because of its ensemble structure, which reduces overfitting and picks up non-linear relationships in network traffic, consistent with what other work in this space has found [18], [46]. On CICIDS2017 specifically, Random Forest can work with all 78 traffic features at once, pick out the most useful ones for classification, and rank feature importance along the way. Figure 9 shows this directly for our own trained model, rather than asserting it in the abstract: packet-length statistics (Max Packet Length, Packet Length Variance, Packet Length Std, Average Packet Size) dominate the top of the ranking, followed by segment-size and destination-port features. Flow duration and inter-arrival times, sometimes cited as the most discriminative CICIDS2017 features in other work, rank lower here than packet-size statistics do; this is worth naming explicitly since it means feature importance is somewhat method- and configuration-specific rather than a fixed property of the dataset.

Threshold Selection for Autoencoders

For unsupervised anomaly detection with autoencoders, the reconstruction error threshold is the single parameter that matters most. It marks the line between what counts as “normal” and what counts as an anomaly. Setting it higher is more conservative: it needs stronger evidence of an anomaly, which raises precision but costs recall. Setting it lower flags smaller deviations from normal traffic, which raises recall but also increases false positives. Operators need to set this threshold based on their own threat environment and risk tolerance. In high-stakes operations where even a small attack could ruin a crop, a lower threshold that maximizes recall may be worth the extra false alerts to investigate. Where false alarms are especially disruptive, or where there is not enough staff to chase them down, a higher threshold that favors precision makes more sense.

Limitations

This study has several limitations. CICIDS2017, while current, does not represent the traffic profiles of industrial AgriIoT protocols like LoRaWAN or Modbus. Section V-B revalidates the four base detection models on Farm-flow [34], which narrows this limitation but does not close it: Farm-flow itself does not cover LoRaWAN or Modbus traffic either, and we have not revalidated the hybrid ablation or the recovery layer's grounded confidence distribution on it. The quantized model-size and CPU-latency measurements were measured on a standard laptop CPU, not on the ARM or microcontroller-class hardware AgriIoT nodes actually use, so they should be read as a plausibility check rather than a field measurement. The work is also limited to binary classification, normal versus malicious, which limits how useful the IDS is in practice: operators need to know the kind of threat, and binary classification cannot tell them that. The autonomous recovery layer is evaluated in a simulated environment where device state transitions, compute accumulation, and connectivity are parameterized abstractions, not measurements taken on physical AgriIoT hardware. One further gap this study does not address at all: adversarial robustness. We evaluate detection accuracy against the CICIDS2017 attack distribution as given, not against an adversary deliberately crafting inputs to evade the classifier or the Autoencoder's reconstruction-error threshold.

Developing-Country Context

In a context like Nepal, where both technical resources and reliable connectivity are limited, the simplicity of Decision Tree or the low-latency inference of a lightweight Autoencoder matters more than it would elsewhere. Nepali agriculture is mostly small, fragmented landholdings, and adopting a high-end, centralized cloud security solution is not practical there: network access is intermittent, budgets are tight, and there is little local cybersecurity expertise to draw on. These environments need edge-based, offline-capable IDS that runs on cheap hardware without depending on a steady internet connection. Some AgriIoT deployments push this further still, relying on ambient energy harvesting rather than a replaceable battery at all; Mottola et al. [49] show that battery-less, intermittently-powered IoT devices face a distinct attack surface, where manipulating ambient energy availability itself can induce denial-of-service or priority-inversion faults. Future work should aim for detection that performs well without assuming expensive hardware, so these tools stay practical rather than theoretical, and deployments need interfaces that farmers can actually use to understand and monitor security risks without needing much technical training.

A Three-Tier Detect-Decide-Recover Architecture

To combine the strengths of supervised and unsupervised machine learning, and to carry the process through from detection to remediation, we build and test a three-tier Intrusion Detection and Recovery architecture for resource-constrained AgriIoT deployments. The first tier is a lightweight supervised classifier, Random Forest given how well it performed here, that acts as the main defense by classifying traffic against known attack signatures. The second tier runs as a fallback: an unsupervised Autoencoder tuned for anomaly detection, catching deviations the primary classifier is not confident about. The third tier is the autonomous recovery layer evaluated in Section V-D. Once either detection tier flags a node with enough confidence, the recovery agent picks and carries out an isolate, rollback, or reroute action under the node's real compute and connectivity limits, instead of waiting on a human operator. That third tier is what separates this from a purely detective architecture: detection alone, no matter how accurate, leaves a compromised node in place until someone acts on the alert.

The decision flow works like this: a network flow first goes to the Random Forest classifier. If its predicted probability falls outside a low-confidence band around 0.5, that result stands and the traffic is allowed or blocked right away. If the Random Forest probability falls inside that band, the flow gets passed to the Autoencoder, which computes a reconstruction error against its own calibrated threshold. Section V-C reports what this combination actually does to detection performance, rather than leaving that as an untested claim: it lowers the false-positive rate at a small cost in recall, exactly the sort of trade-off this design was meant to make. Since the Random Forest already filters known malicious and benign traffic precisely, the Autoencoder only has to make a call on the small fraction of traffic the ablation measured at 1.02% of test flows, which limits how many false alerts operators have to chase. Whichever tier raises the flag, the confidence score goes to the recovery agent, which carries out remediation on its own.

This work makes two contributions to Agricultural IoT security. First, benchmarking on CICIDS2017 shows a clear performance gap between supervised and unsupervised learning for AgriIoT intrusion detection. Supervised ensemble models, especially Random Forest, come close to optimal classification (F1=0.9965, ROC-AUC=0.9998), making it the most reliable option where labeled training data exists. Decision Tree followed closely (F1=0.9967), and Logistic Regression set the low bar at 0.8921. The unsupervised Autoencoder and VAE models kept high recall (often above 0.99) but low precision (0.4766 to 0.5361), which fits their role as sensitive, error-prone anomaly detectors best suited to zero-day threats. Revalidating all four base detectors on Farm-flow confirmed a sensible model ranking transfers to genuine AgriIoT traffic, but also that CICIDS2017's very high test-set numbers do not generalize as an upper bound: F1 settled around 0.92 for every model on Farm-flow's held-out test set, and the sharp supervised-versus-unsupervised gap CICIDS2017 shows largely disappeared.

Second, and this is the main new contribution, we found and addressed a gap that survives even once detection is solved. We built and evaluated an autonomous recovery layer, a Q-learning agent choosing between isolate, rollback, or reroute actions, across nine realistic constraint settings, and we tested, rather than merely proposed, the two-tier detection hybrid feeding it: routing low-confidence Random Forest predictions to the Autoencoder lowers the false-positive rate from 0.082% to 0.069%, a statistically confirmed difference (McNemar p < 10^-45) that in raw counts amounts to trading roughly seven additional missed attacks for every false alarm removed, a genuine trade-off rather than a strict improvement. Grounding the recovery agent's detector-confidence assumption in that hybrid's own measured output, the learned policy cuts mean time to recovery by 68.3% and downtime by 62.2% relative to a fixed-delay manual-response baseline, consistent with the 67.1%/61.0% obtained under the original unmeasured assumption. We also showed that this advantage shrinks gradually rather than collapsing as connectivity and compute get worse, which is, as far as we know, the first time this has been characterized for intrusion recovery on constrained agricultural hardware. Separately, we showed that int8 dynamic quantization shrinks the Autoencoder and VAE by roughly 70% with no retraining, a small but concrete step toward genuine edge deployment.

Future work needs to go well beyond this study's scope to meet the demands of real agricultural deployment. The immediate priorities are: revalidating the hybrid ablation and the recovery layer's grounded confidence distribution on Farm-flow [34], since Section V-B revalidates only the four base detection models on it so far; extending AgriIoT flow datasets to cover industrial protocols like LoRaWAN and Modbus, which both CICIDS2017 and Farm-flow underrepresent; validating the quantized models and the recovery layer on physical ARM or microcontroller-class edge devices instead of the CPU measurements and simulated environment used here; and exploring federated learning so farms can share threat intelligence without exposing sensitive farm-level data, building on the federated AgriIoT detection work of Benameur and Dahane [40] and on Chaudhary et al.'s [50] federated autoencoder IDS, which they validate on a real Raspberry Pi testbed. Algorithmic work remains too: applying KL annealing to fix VAE training instability, moving from binary to multi-class attack categorization, and adopting continual detection approaches such as Fuhrman et al.'s ACORN-IDS [51]. Together, these steps would turn these systems from research models into practical, context-aware tools that can actually protect food systems against a growing range of digital threats.

1. B. Ahmed, H. Shabbir, S. R. Naqvi, and L. Peng, “Smart Agriculture: Current State, Opportunities, and Challenges,” IEEE Access, vol. 12, pp. 144456–144478, 2024.
2. T. Miller, G. Mikiciuk, I. Durlik, M. Mikiciuk, A. Łobodzińska, and M. Śnieg, “The IoT and AI in Agriculture: The Time Is Now—A Systematic Review of Smart Sensing Technologies,” Sensors, vol. 25, no. 12, p. 3583, Jan. 2025.
3. A. O. Adewusi, N. R. Chiekezie, and N. L. Eyo-Udo, “Securing Smart Agriculture: Cybersecurity Challenges and Solutions in IoT-driven Farms,” World Journal of Advanced Research and Reviews, vol. 15, no. 3, pp. 480–489, Sep. 2022.
4. G. Ali, M. M. Mijwil, B. A. Buruga, M. Abotaleb, and I. Adamopoulos, “A Survey on Artificial Intelligence in Cybersecurity for Smart Agriculture: State-of-the-Art, Cyber Threats, AI Applications, and Ethical Concerns,” Mesopotamian Journal of Computer Science, vol. 2024, pp. 53–103, Jul. 2024.
5. W. Fei, H. Ohno, and S. Sampalli, “A Systematic Review of IoT Security: Research Potential, Challenges, and Future Directions,” ACM Computing Surveys, vol. 56, no. 5, pp. 1–40, May 2024.
6. A. Alfahaid, E. Alalwany, A. M. Almars, F. Alharbi, E. Atlam, and I. Mahgoub, “Machine Learning-Based Security Solutions for IoT Networks: A Comprehensive Survey,” Sensors, vol. 25, no. 11, p. 3341, Jan. 2025.
7. E. M. Pasca, D. Delinschi, R. Erdei, I. Baraian, and O. D. Matei, “A Vulnerable-by-Design IoT Sensor Framework for Cybersecurity in Smart Agriculture,” Agriculture, vol. 15, no. 12, p. 1253, Jun. 2025.
8. Z. Ahmad, A. Shahid Khan, C. Wai Shiang, J. Abdullah, and F. Ahmad, “Network Intrusion Detection System: A Systematic Study of Machine Learning and Deep Learning Approaches,” Trans. Emerging Telecommunications Technologies, vol. 32, no. 1, p. e4150, Jan. 2021.
9. A. Verma and V. Ranga, “Machine Learning Based Intrusion Detection Systems for IoT Applications,” Wireless Personal Communications, vol. 111, no. 4, pp. 2287–2310, Apr. 2020.
10. A. Sheth, A. Achanta, P. Matam, A. Patel, P. Sharma, N. V. P. Janapareddy, B. Patil, and V. Gudur, “AI-driven self-healing cybersecurity systems with agentic AI for adaptive threat response and resilience,” in 2025 IEEE Cloud Summit, IEEE, 2025, pp. 147–153.
11. H. A. Alanazi, A. G. Alanazi, and N. S. Albalawi, “EdgeRescue: Lightweight AI-based self-healing for energy-constrained IoT meshes,” Computation, vol. 14, no. 4, p. 84, 2026.
12. J. Miller, “TinyHeal: TinyML-assisted predictive link degradation recovery for self-healing IoT mesh networks,” Artificial Intelligence and Emerging Technologies, vol. 3, no. 1, 2026.
13. A. Kulkarni, Y. Wang, M. Gopinath, D. Sobien, A. Rahman, and F. A. Batarseh, “A review of cybersecurity incidents in the food and agriculture sector,” 2024.
14. A. Vakhnovskyi, “Threat modeling and attack surface analysis of IoT-enabled controlled environment agriculture systems,” 2026.
15. M. Freyhof, G. Grispos, S. K. Pitla, and W. Mahoney, “Investigating the implications of cyberattacks against precision agricultural equipment,” 2025.
16. B. Nassi, M. Sror, I. Lavi, Y. Meidan, A. Shabtai, and Y. Elovici, “Piping botnet – turning green technology into a water disaster,” 2018.
17. C. Y. Chiu, “From backup restoration to minimum viable factory recovery: A systematization of ransomware recovery in manufacturing systems,” 2026.
18. Z. K. Maseer, R. Yusof, N. Bahaman, S. A. Mostafa, and C. F. M. Foozy, “Benchmarking of Machine Learning for Anomaly Based Intrusion Detection Systems in the CICIDS2017 Dataset,” IEEE Access, vol. 9, pp. 22351–22370, 2021.
19. Y. Meidan, M. Bohadana, Y. Mathov, Y. Mirsky, D. Breitenbacher, A. Shabtai, and Y. Elovici, “N-BaIoT: Network-based Detection of IoT Botnet Attacks Using Deep Autoencoders,” IEEE Pervasive Computing, vol. 17, no. 3, pp. 12–22, Jul. 2018.
20. N. Abdalgawad, A. Sajun, Y. Kaddoura, I. A. Zualkernan, and F. Aloul, “Generative Deep Learning to Detect Cyberattacks for the IoT-23 Dataset,” IEEE Access, vol. 10, pp. 6430–6441, 2022.
21. NIST, “Foundational Cybersecurity Activities for IoT Device Manufacturers,” NISTIR 8259, 2020.
22. ETSI, “Cyber Security for Consumer Internet of Things: Baseline Requirements,” ETSI EN 303 645, 2020.
23. IEC, “Industrial Communication Networks — Network and System Security,” IEC 62443 series, 2013.
24. J. Li, M. S. Othman, H. Chen, and L. M. Yusuf, “Optimizing IoT Intrusion Detection System: Feature Selection versus Feature Extraction in Machine Learning,” Journal of Big Data, vol. 11, no. 1, p. 36, Feb. 2024.
25. K. Bella, A. Guezzaz, S. Benkirane, M. Azrour, Y. Fouad, M. S. Benyeogor, and N. Innab, “An Efficient Intrusion Detection System for IoT Security Using CNN Decision Forest,” PeerJ Computer Science, vol. 10, p. e2290, Sep. 2024.
26. A. Diab, A. Chehade, E. Ragusa, P. Gastaldo, R. Zunino, A. Baghdadi, and M. Rizk, “Intrusion detection on resource-constrained IoT devices with hardware-aware ML and DL,” 2025.
27. R. Y. Acharya, L. Le Jeune, N. Mentens, F. Ganji, and D. Forte, “Quantization-aware neural architectural search for intrusion detection,” 2023.
28. R. Jaiswal, P.-A. Andersen, L. R. Cenkeramaddi, L. Jiao, and O.-C. Granmo, “On-device interpretable Tsetlin machine-based intrusion detection for secure IoMT,” 2026.
29. N. N. Thilakarathne, M. S. A. Bakar, P. E. Abas, and H. Yassin, “A Novel Cyber Threat Intelligence Platform for Evaluating the Risk Associated with Smart Agriculture,” Scientific Reports, vol. 15, no. 1, p. 3904, Jan. 2025.
30. L. Praharaj, D. Gupta, and M. Gupta, “A lightweight edge-CNN-transformer model for detecting coordinated cyber and digital twin attacks in cooperative smart farming,” 2024.
31. M. Adkisson, J. C. Kimmel, M. Gupta, and M. Abdelsalam, “Autoencoder-based anomaly detection in smart farming ecosystem,” 2021.
32. H. M. Rouzbahani, H. Karimipour, E. Fraser, A. Dehghantanha, E. Duncan, A. Green, and C. Russell, “Communication layer security in smart farming: A survey on wireless technologies,” 2022.
33. R. Panigrahi and S. Borah, “A Detailed Analysis of CICIDS2017 Dataset for Designing Intrusion Detection Systems,” Indonesian Journal of Data and Science, vol. 4, 2024.
34. R. Ferreira, I. Bispo, C. Rabadão, L. Santos, and R. L. d. C. Costa, “Farm-Flow Dataset: Intrusion Detection in Smart Agriculture Based on Network Flows,” Computers and Electrical Engineering, vol. 121, p. 109892, 2025.
35. H. Madsen, G. Grov, F. Mancini, M. Baksaas, and Å. Å. Sommervoll, “Exploring reinforcement learning for incident response in autonomous military vehicles,” 2024.
36. M. Sanabria, I. Dusparic, and N. Cardozo, “Learning recovery strategies for dynamic self-healing in reactive systems,” 2024.
37. M. Fatima, O. Rehman, N. Z. Jhanjhi, and S. Ali, “SH-IDS: A Resilient Self-Healing Intrusion Detection Framework Against DoS and DDoS Attacks in IoT Systems,” Scientific Reports, vol. 16, no. 1, 2026.
38. R. Sahu and P. Tripathi, “A Novel Data Healing Framework for Outlier Detection and Recovery Approach in the Internet of Agriculture Things Sensor Network,” Quality & Quantity, vol. 60, no. 2, pp. 3443–3471, 2025.
39. M. Datar and Y. Dujardin, “Adaptive learning for moving target defence: Enhancing cybersecurity strategies,” 2025.
40. R. Benameur and A. Dahane, “SFEDRL-IDS: Secure Federated Deep Reinforcement Learning-Based Intrusion Detection System for Agricultural Internet of Things,” Cluster Computing, vol. 28, no. 6, 2025.
41. A. Chehade, E. Ragusa, P. Gastaldo, and R. Zunino, “Hardware-aware neural architecture search for encrypted traffic classification on resource-constrained devices,” 2025.
42. S. Jamshidi, M. Bellaïche, and O. Abdul Wahab, “EcoDefender: Energy-efficient hybrid anomaly detection for IoT edge gateways,” 2025.
43. I. Panopoulos, M. L. A. Bartsioka, S. Nikolaidis, S. I. Venieris, D. I. Kaklamani, and I. S. Venieris, “A-THENA: Early intrusion detection for IoT with time-aware hybrid encoding and network-specific augmentation,” 2026.
44. A. Albaiz and F. Amsaad, “Fully autonomous z-score-based TinyML anomaly detection on resource-constrained MCUs using power side-channel data,” 2026.
45. Y. Huang, L. Huang, and Q. Zhu, “Reinforcement learning for feedback-enabled cyber resilience,” 2021.
46. P. A. A. Resende and A. C. Drummond, “A Survey of Random Forest Based Methods for Intrusion Detection Systems,” ACM Computing Surveys, vol. 51, no. 3, pp. 1–36, May 2019.
47. M. Duarte, J. P. Dias, H. S. Ferreira, and A. Restivo, “Evaluation of IoT self-healing mechanisms using fault-injection in message brokers,” 2022.
48. A. Venturi, D. Stabili, and M. Marchetti, “Problem space structural adversarial attacks for network intrusion detection systems based on graph neural networks,” 2024.
49. L. Mottola, A. Hameed, and T. Voigt, “Uncharted territory: Energy attacks in the battery-less internet of things,” 2023.
50. D. Chaudhary, S. Rajasegarar, S. R. Pokhrel, L. Pan, and R. D., “In-network attack detection with federated deep learning in IoT networks: Real implementation and analysis,” 2026.
51. S. Fuhrman, O. Gungor, and T. Rosing, “ACORN-IDS: Adaptive continual novelty detection for intrusion detection systems,” 2026.
52. J. Tan, H. Lin, S. Guo, Y. Fang, X. Luo, T. Shen, and Z. Qiao, “Safe and adaptive cloud healing: Verifying LLM-generated recovery plans with a neural-symbolic world model,” 2026.
53. E. Caville, W. W. Lo, S. Layeghy, and M. Portmann, “Anomal-E: A self-supervised network intrusion detection system based on graph neural networks,” 2022.
54. A. Bellante, T. Fioravanti, and M. Carminati, “Evaluating the potential of quantum machine learning in cybersecurity: A case-study on PCA-based intrusion detection systems,” 2025.