A Methodical Review of Risk Detection and

Mitigation

A Project Report

Submitted by

Om Tiwari(24BAI70372)
Kamal Sharma(24BAI70380)
Gagandeep Kaur(24BAI70374)

in the partial fulfillment for the award of the degree of

BACHELOR OF ENGINEERING
IN
COMPUTER SCIENCE WITH SPECIALIZATION IN
ARTIFICIAL INTELLIGENCE AND MACHINE
LEARNING

CHANDIGARH UNIVERSITY, GHARUAN, MOHALI -

140413, PUNJAB
April, 2026
 BONAFIDE CERTIFICATE

This is to certify that the project report entitled “A Methodical Review of

Risk Detection and Mitigation” submitted by

 Om Tiwari

 Kamal Sharma

 Gagandeep Kaur

students of B.E./[Link] (CSE-AIML), Chandigarh University, Mohali,

Punjab, is a bonafide record of the project work carried out by them during

the academic year 2026 under the supervision of the Department of

Computer Science and Engineering.

Supervisor Signature Ms. Kirti

Head of Department [Link] Kaswan

Department of CSE (AI & ML)

Chandigarh University

Mohali, Punjab
 ABSTRACT

The rapid proliferation of the Internet of Things (IoT) has fundamentally transformed
the digital landscape by enabling continuous, smart communication among a vast
number of interconnected devices. However, this expansion has significantly
broadened the attack surface, exposing networks to diverse security threats such as
illegal access, data breaches, malicious software, and Denial of Service (DoS)
incidents.

Traditional security mechanisms, including firewalls and encryption, are often static
and rigid, making them incapable of addressing the evolving and dynamic nature of
modern cyber threats in scattered IoT environments. Furthermore, the inherent
constraints of IoT devices—such as limited computational power and diverse
architectural designs—pose significant challenges for standard security tools.

To bridge this gap, this study explores Artificial Intelligence (AI) and Machine Learning
(ML) as adaptive solutions for advanced intrusion detection and risk mitigation. This
paper provides a systematic literature review of AI-driven security frameworks,
critically analyzing recent deep learning and hybrid models while highlighting
persistent challenges like computational complexity and the "black box" nature of AI
models.

Complementing the review, an experimental evaluation was conducted using the

UNSW-NB15 dataset, which contains real-world network traffic to simulate complex
malicious conditions. Three supervised learning models—Random Forest (RF),
Support Vector Machine (SVM), and K-Nearest Neighbors (KNN)—were
compared. The results demonstrate that Random Forest achieved the most robust
performance with an accuracy of 86.99% and an F1-score of 89.28%, effectively
balancing precision and recall for reliable intrusion detection. The findings confirm that
AI-based methods can significantly enhance IoT security, providing a scalable and self-
governing path for future risk management.
Abstract Graphical:

Abbreviations:

 AI - Artificial Intelligence
 IoT - Internet of Things
 IDS - Intrusion Detection System
 ML - Machine Learning
 DL - Deep Learning
 RF - Random Forest
 SVM - Support Vector Machine
 KNN - K-Nearest Neighbors
 DoS - Denial of Service
 DDoS - Distributed Denial of Service
 DRL - Deep Reinforcement Learning
 CNN - Convolutional Neural Network
 LSTM - Long Short-Term Memory
 RNN - Recurrent Neural Network
 DNN - Deep Neural Network
 AE - Autoencoder
 UNSW-NB15 - University of New South Wales Network Benchmark 2015
 Keywords:
 Artificial Intelligence The primary technology enabling adaptive security frameworks through
pattern recognition and predictive modeling.
 Internet of Things The network of interconnected smart devices across domains like healthcare
and industrial automation.
 IoT Security The specialized field of protecting diverse, resource-constrained devices from
unauthorized access and data breaches.
 Intrusion Detection System A framework used to monitor network logs and identify malicious
behaviors or unusual traffic patterns.
 Machine Learning The subset of AI used to train models like Random Forest and SVM for
classifying harmless and malicious traffic.
 Edge AI The deployment of intelligent mechanisms closer to the device to handle computational
complexity and real-time detection.
 Behavior Analysis The process of spotting unusual patterns and predicting threats based on real-
time device communication.
 Risk Mitigation The systematic strategy of identifying vulnerabilities and applying AI models to
reduce potential cyber threats.
 CHAPTER 1

INTRODUCTION

1.1 Overview of the Internet of Things (IoT)

The Internet of Things (IoT) has significantly accelerated the evolution of the
digital landscape by fostering smart communication and enabling seamless,
simultaneous connections among an immense variety of devices. Its
applications extend across numerous vital domains, such as smart homes that
automate daily living, wearable health monitors that track well-being in real
time, industrial automation systems that optimize production efficiency, and
connected vehicles that enhance safety and mobility.

As these interconnected devices become deeply embedded into everyday

routines, they continuously generate and transmit vast streams of data across
networks. This uninterrupted flow of information fuels intelligent services,
supports predictive decision-making, and drives innovation, ultimately
transforming how individuals, businesses, and societies interact with
technology on a daily basis.

1.2 The Growing Threat Landscape

The rapid proliferation of interconnected devices has significantly increased the

"attack surface," making IoT networks highly exposed to various security
threats. Common incidents include:

 Illegal Access: Unauthorized entities gaining control over private device

functions.
 Data Breaches: Theft or exposure of sensitive information transmitted
between devices.

 Malicious Software: The spread of viruses and malware specifically

designed to infect resource-constrained devices.

 Denial of Service (DoS): Flooding the network with traffic to disrupt

essential smart services.

1.3 Limitations of Traditional Security

For decades, cybersecurity has relied on firewalls, access control, and

encryption. However, these traditional mechanisms are insufficient for the IoT
ecosystem due to several factors:

 Static Nature: Conventional tools are rigid and non-adaptive, leaving

them ineffective against complex, dynamic cyber threats.

 Resource Constraints: IoT devices often have limited computational

power and memory, making it difficult to run heavy traditional security
software.

 Diverse Architecture: The broad range of device types and

communication protocols creates inconsistencies that standard tools
cannot easily manage.

 Scalability: Static models fail to respond in real-time within scattered,

large-scale IoT environments.
 

1.4 Task Identification

To address the security gaps in IoT environments, the project is

structured around several critical research and experimental tasks. The
primary objective is to evaluate how Artificial Intelligence can create a
self-governing system to detect threats. The defined tasks include:

 Literature Analysis: Performing a structured review of recent AI-

based intrusion detection methods, focusing on academic papers
published between 2020 and 2024.

 Methodology Selection: Identifying appropriate databases (IEEE

Xplore, ScienceDirect, etc.) and search parameters to extract high-
quality research.

 Experimental Evaluation: Conducting a comparative study using

the UNSW-NB15 dataset to test various supervised learning
models.
 Performance Benchmarking: Analyzing model trade-offs in
terms of precision, recall, and suitability for resource-constrained
IoT devices.

 Future Roadmap Identification: Defining directions for future

research, such as edge device deployment and AI explainability.

1.5 Project Timeline

The project was executed over a period of eight weeks to ensure a

comprehensive balance between theoretical review and practical
experimentation.

Phase Activity Duration

Problem Identification: Identifying

Phase
security loopholes in IoT and selecting Week 1
1
the UNSW-NB15 dataset.

Phase Literature Survey: Extracting and Week 2-

Phase Activity Duration

2 reviewing papers from 2020–2024. 3

Data Pre-processing: Cleaning,

Phase Week 4-
encoding, and normalizing the 2.5
3 5
million dataset instances.

Model Training & Testing:

Phase
Implementing Random Forest, SVM, Week 6
4
and KNN with an 80/20 data split.

Phase Analysis & Discussion: Evaluating

Week 7
5 metrics like accuracy and F1-score.

Final Documentation: Compiling the

Phase
research findings and future Week 8
6
recommendations.
1.6 Organization of the Report

The report is systematically organized to provide a clear understanding of

the study:

 Chapter 1: Introduction, problem identification, and project logistics.

 Chapter 2: Literature survey and summary of existing AI-driven IDS

approaches.

 Chapter 3: Detailed methodology, dataset description, and experimental

setup.

 Chapter 4: Results, performance comparison, and feature importance

analysis.

 Chapter 5: Conclusion, limitations, and future research scope.

 CHAPTER 2

LITERATURE SURVEY

2.1 Overview of AI Integration in IoT

The integration of Artificial Intelligence (AI) into the Internet of Things (IoT) has
emerged as a promising and adaptive approach to combat the loopholes found in
conventional security methods. Unlike firewalls and encryption, which are static and non-
adaptive, AI technologies allow systems to self-identify new attack patterns and initiate
real-time responses. This chapter surveys the evolution of these technologies, specifically
focusing on academic publications between 2020 and 2024 to provide a modern
perspective.

2.2 Hybrid Deep Learning Approaches

Recent research indicates that hybrid models—combining different neural network

architectures—are becoming a dominant force in IoT security.
 CNN-LSTM Hybrids: Researchers such as Yaras and Dener (2024) proposed
 combined architectures using ID-CNN and LSTM specifically for DDoS attack
detection.
 Traffic Classification: Gueriani et al. (2024) demonstrated that combining CNN and
LSTM can significantly improve binary traffic classification accuracy.
 Strengths and Weaknesses: While these hybrid models capture both spatial and
temporal features of network traffic, they often face high computational costs, making
them difficult to deploy on resource-constrained edge devices.
2.3 Anomaly-Based and Reinforcement Learning

Beyond hybrid models, the literature explores specialized algorithms for

behavior-based detection:

 Deep Neural Networks (DNN): Elnakib et al. (2023) evaluated multi-

class DNN models for anomaly-based detection, though they noted a
persistent risk of dataset overfitting.

 Deep Reinforcement Learning (DRL): Zhang and Maple (2023)

surveyed adaptive intrusion detection systems based on DRL, which
allow a system to learn and adapt to changing network environments.

 Time-Series Modeling: Yin et al. (2020) utilized Recurrent

Autoencoders and LSTM for sequence modeling to detect anomalies
in IoT time-series data.

2.4 Supervised Learning and Comparative Surveys

Traditional Machine Learning (ML) algorithms remain relevant for their lower
computational overhead:

 Standard Classifiers: Studies by Hussain et al. (2020) have utilized Decision Trees
(DT), Support Vector Machines (SVM), and K-Nearest Neighbors (KNN) for
comprehensive intrusion detection surveys.
  Traffic Analysis: Al-Garadi et al. (2020) provided a wide-scale survey of DL
techniques including RNNs and LSTMs for real-time traffic analysis, though their
focus was more general across all of cybersecurity.

2.5 Identified Research Gaps

Despite the advancements, several limitations persist across the surveyed literature:

 Generalization: Many models struggle to identify "unseen" or zero-day attack types

that were not present in the training data.

 Transparency: Many advanced models operate as "black boxes," lacking the

interpretability required for critical infrastructure.

 Experimental Validation: A significant number of studies are conceptual or

literature-based reviews that lack rigorous experimental validation on real-world
datasets.

2.8 Summary of Existing Literature

This table provides a structured comparison of the core research works reviewed in
Chapter 2, focusing on the AI models used, their specific contributions to IoT
security, and the limitations that remain unaddressed in the current state of the art.

Model /
Paper Authors Key Contribution Limitation
Method

Proposed a hybrid CNN-LSTM Poor generalization on

Yaras and ID-CNN,
[1] model for robust DDoS attack unseen or zero-day
Dener LSTM
detection. attack types.

Enhanced binary traffic Prohibitively high

Gueriani et
[2] CNN, LSTM classification using deep computational costs for
al.
learning hybrid architectures. edge devices.

[3] Ejeofobiri ML Systematic overview of AI- Purely literature-based;

 Model /
Paper Authors Key Contribution Limitation
Method

et al. Algorithms based IDS strategies for lacks experimental

network security. validation.

Conceptual framework
Kakolu et Limited implementation
[4] ML, DL focusing on lightweight IDS for
al. in real-world scenarios.
resource-constrained devices.

Multi-class deep learning High risk of dataset

Elnakib et
[5] DNN model evaluation for anomaly overfitting during
al.
detection. training.

Comprehensive survey of Deep Very few documented

Zhang and
[6] DRL Reinforcement Learning for examples of actual
Maple
adaptive security. deployment.

Sequence modeling for

High complexity for
[7] Yin et al. LSTM, AE anomaly detection in IoT time-
real-time deployment.
series data.

Extensive survey on supervised

Hussain et DT, SVM, Reliance on older
[8] learning solutions for IoT
al. KNN datasets for evaluation.
security.

Deep learning techniques Focus is too general;

Al-Garadi CNN, RNN,
[9] applied to real-time traffic lacks specific IoT
et al. LSTM
analysis. nuance.
 CHAPTER 3

DESIGN FLOW AND METHODOLOGY

3.1 Overview of the Proposed Framework

The methodology adopted for this study follows a dual-path approach: a

systematic literature analysis and a rigorous experimental evaluation. The
framework is designed to transition from theoretical understanding to practical
validation, ensuring that the AI models selected are not only high performing in
a laboratory setting but also relevant to the unique constraints of the IoT
ecosystem

3.2 Phase 1: Literature Review Methodology

To establish a robust theoretical foundation, a structured review process was implemented

to identify the current state of AI in IoT security.

 Database Selection: Research was conducted across primary academic databases,

including IEEE Xplore, SpringerLink, ScienceDirect, ACM Digital Library, MDPI,
and Google Scholar.

 Search Parameters: Systematic search queries utilized keywords such as "Artificial

Intelligence in IoT Security," "AI-based intrusion detection in IoT," and "Machine
Learning for IoT threat detection".

 Selection Criteria: The observation was limited to peer-reviewed academic papers

published between 2020 and 2024 to ensure contemporary relevance.

 Focus Areas: Selected papers were categorized into those proposing new techniques
and those evaluating existing ones for risk detection or reduction.

3.3 Phase 2: Experimental Methodology & Dataset Selection

The core of the practical evaluation relies on the UNSW-NB15 dataset, created by
the IXIA PerfectStorm tool.

 Dataset Scale: The dataset comprises over 2.5 million instances, providing a
comprehensive volume of data for training and testing.

 Feature Set: It includes 45 distinct features and various attack classes,

simulating a complex mix of regular traffic and malicious incidents like DoS and
illegal access.

 Real-World Simulation: This dataset is specifically chosen because it reflects

modern real-world network traffic conditions rather than outdated synthetic
patterns.

3.4 Data Pre-processing Pipeline

Before feeding data into the machine learning models, a multi-step

cleaning and normalization process was executed to ensure data
integrity:
 Null Value Handling: Systematic identification and resolution of
missing data points to prevent model bias.
 Duplicate Removal: Deletion of duplicate records to ensure the
models do not overfit to repeated traffic patterns.
 Categorical Encoding: Converting non-numerical attributes, such as
protocol types and services, into numerical formats suitable for
mathematical computation.
 Feature Normalization: Scaling numerical features to a common
level to prevent attributes with larger ranges from dominating the
learning process.
3.5 Model Implementation and Selection

Three supervised learning models were selected to evaluate the difference between
malicious and harmless traffic:

1. Random Forest (RF): Selected as the primary ensemble-driven model due to its
reputation for high accuracy and stability in dynamic environments.

2. Support Vector Machine (SVM): Included for comparative purposes to test

boundary-based classification performance.

3. K-Nearest Neighbors (KNN): Utilized as a baseline distance-based classifier to

evaluate simplicity versus performance.
3.6 Experimental Setup and Evaluation Metrics

The experiment utilized a standard data split and a variety of performance parameters to
ensure a balanced assessment:
 Training/Testing Split: 80% of the pre-processed data was used for training the
models, with the remaining 20% reserved for testing and validation.
 Core Metrics: Performance was measured via Accuracy, Precision, Recall, and F1-
score.
 Reliability Analysis: The use of a Confusion Matrix and False Positive/Negative
analysis was prioritized to assess the suitability of these models for real-world
deployment where false alarms must be minimized.
 CHAPTER 4
Results and Analysis

4.1 Overview of Experimental Results

The performance of the selected AI models was rigorously evaluated using

the UNSW-NB15 dataset to determine their effectiveness in securing IoT
environments. The dataset's complexity, which includes real-world network
logs and various malicious attack simulations, provided a robust platform for
testing. The analysis focuses on comparative performance across standard
metrics, the impact of feature selection, and the reliability of the models in
minimizing false alarms.

4.2 Comparative Performance of IDS Models

The experimental findings indicate that Random Forest (RF) is the superior model for
IoT intrusion detection among those tested. It demonstrated dominating performance
across all evaluation metrics, including accuracy, precision, and F1-score.
Model Accuracy Precision Recall F1-Score

Random Forest 86.99% 81.67% 98.46% 89.28%

SVM 81.48% 75.03% 99.49% 85.54%

KNN 80.16% 77.77% 89.58% 83.26%

 Random Forest: Achieved the best balance between precision and recall, ensuring
high stability in dynamic IoT environments.
 SVM: While it showed the highest recall (99.49%), it suffered from lower precision
due to a higher rate of false positives.
 KNN: Performed good but showed inaccuracies when identifying specific, complex
attack types.
4.3 Feature Correlation and Selection

To optimize the models for resource-constrained IoT devices, Pearson correlation

coefficients were analyzed to identify and remove redundant data.

 Multi-collinearity: Analysis of highly correlated features helped reduce multi-

collinearity, which directly improved model stability and predictive accuracy.

 Optimized Training: The top 30 most important features were selected for training,
which reduces computational complexity—a vital requirement for IoT hardware.

4.4 Feature Importance Analysis

The Random Forest classifier was utilized to identify which specific network
attributes most significantly impact intrusion detection.

 Key Indicators: The most critical features included flow duration, packet size,
 and source/destination bytes.

 Dominant Features: Specifically, features like sttl (Source-to-destination time to

live) and ct_state_ttl were identified as high-ranking importance scores.

4.5 Error Analysis: False Positives vs. False Negatives

Reliability in real-world deployment depends heavily on maintaining low error rates to

prevent legitimate traffic from being blocked.

 Random Forest Reliability: This model achieved the lowest false positive and false
negative rates among all candidates.
  Detection Challenges: Both SVM and KNN exhibited higher false negative rates,
indicating they struggle more with identifying certain subtle attack types.

 Confusion Matrix: Analysis of the confusion matrix confirms that ensemble learning
(RF) is more dependable for multi-class detection, showing minimal
misclassifications.

4.6 Summary of Findings

The analysis of the experimental results confirms that ensemble-based machine learning,
specifically the Random Forest model, provides a highly effective and reliable solution for
securing dynamic IoT environments. Random Forest demonstrated superior performance
across all primary metrics, achieving an accuracy of 86.99% and an F1-score of 89.28%,
which represents a more efficient balance between precision and recall than distance-based or
boundary-based classifiers like KNN and SVM. Furthermore, the study identified that
selecting the top 30 most important features, such as flow duration and packet size,
significantly reduces computational complexity, making high-accuracy detection feasible
even for resource-constrained IoT devices. The low false positive and false negative rates
achieved by the ensemble approach highlight its reliability in distinguishing malicious
behavior from legitimate traffic, proving that AI-driven frameworks can create scalable, self-
governing systems for real-world risk mitigation. Together, these findings validate the
proposed methodology as a comprehensive solution for enhancing IoT security while
overcoming traditional limitations in transparency and processing overhead.
 CHAPTER 5

CONCLUSION AND FUTURE WORK

5.1 Research Conclusion

The rapid growth of IoT devices has significantly expanded the digital attack surface,
making traditional, static security mechanisms incapable of handling advanced and
dynamic cyber threats. This study has proven the effectiveness of Artificial Intelligence,
particularly ensemble-based machine learning methods, in mitigating risks on IoT
platforms.

Through a systematic literature review, this research tracked the evolution of IoT
security from rule-based systems to modern deep learning and adaptive AI frameworks.
The survey highlighted that while hybrid deep learning models offer high accuracy, they
often present challenges regarding computational complexity and real-time deployment
on resource-constrained devices.

The experimental validation using the UNSW-NB15 dataset confirmed that machine
learning models are highly precise and reliable in detecting malicious behavior. Among
the models tested—Random Forest, SVM, and KNN—Random Forest demonstrated
dominating performance across all evaluation metrics, achieving an accuracy of
86.99% and an F1-score of 89.28%. This balance between precision and recall makes
ensemble learning a feasible and dependable solution for multi-class intrusion detection
in IoT systems.
5.2 Limitations and Deviations from Expected Outcomes

While the results are promising, certain limitations were identified during the study:

 Dataset Generalization: The experimental validation was conducted using a single

dataset (UNSW-NB15). While comprehensive, the models' generalization capability
 across different network environments remains to be fully verified.

 Feature Precision: Although Random Forest had the highest overall accuracy, its
precision of 81.67% indicates that some instances of normal traffic were still wrongly
classified as attacks.

 Computational Trade-offs: The trade-off between SVM's high recall (99.49%) and
its lower precision due to false positives highlights the complexity of model selection
based on specific deployment requirements.

5.3 Future Work

The following directions are identified for future research to enhance the security and
practical usability of AI-driven IoT systems:
 Deep Learning & Edge Deployment: Future work should focus on deploying more
complex deep learning models while simultaneously reducing computational
complexity to suit edge devices.
 Explainable AI (XAI): There is a critical need to ensure that AI decision-making is
transparent and explainable, which is essential for trust in real-world IoT systems.
 Real-time Performance Metrics: Beyond accuracy, future evaluations should
include memory consumption and latency to assess suitability for edge-based
environments.
 Cross-Dataset Validation: To ensure model robustness, multiple datasets should be
considered in future experiments to validate generalization across diverse attack
types.
 REFERENCES

The following list comprises the academic research works cited throughout this report,
formatted according to the IEEE standard. These sources represent the foundation for the
literature survey and the experimental benchmarks used for the UNSW-NB15 dataset
evaluation.

 [1] S. Yaras and M. Dener, "IoT-Based Intrusion Detection System Using New
Hybrid Deep Learning Algorithm," Electronics, vol. 13, no. 6, p. 1053, Mar. 2024 .

 [2] A. Gueriani, H. Kheddar, and A. C. Mazari, "Enhancing IoT Security with CNN
and LSTM-Based Intrusion Detection Systems," arXiv (Cornell University), pp. 1-7,
Apr. 2024.

 [3] C. K. Ejeofobiri, O. O. Victor-Igun, and C. Okoye, "AI-Driven Secure Intrusion

Detection for IoT Networks," Asian Journal of Mathematics and Computer Research,
vol. 31, no. 4, pp. 40-55, Nov. 2024 .

 [4] S. Kakolu, M. A. Faheem, and M. Aslam, "AI-enabled intrusion detection systems

in IoT networks: Advancing defense mechanisms for resource-constrained devices,"
International Journal of Science and Research Archive, vol. 9, no. 1, pp. 248-256,
2023 .

 [5] O. Elnakib, E. Shaaban, M. Mahmoud, and K. Emara, "EIDM: deep learning

model for IoT intrusion detection systems," The Journal of Supercomputing, vol. 79,
no. 12, pp. 12821-12844, Mar. 2023 .

 [6] H. Zhang and C. Maple, "Deep reinforcement learning-based intrusion detection

in IoT system: a review," IET Conference Proceedings, vol. 2023, no. 14, pp. 88-97,
Oct. 2023 .

 [7] C. Yin, S. Zhang, J. Wang, and N. N. Xiong, "Anomaly Detection Based on

Convolutional Recurrent Autoencoder for IoT Time Series," IEEE Transactions on
Systems, Man, and Cybernetics: Systems, pp. 1-11, 2020.

 [8] F. Hussain, R. Hussain, S. A. Hassan, and E. Hossain, "Machine Learning in IoT

Security: Current Solutions and Future Challenges," IEEE Communications Surveys
 & Tutorials, vol. 22, no. 3, pp. 1686-1721, 2020 .

 [9] M. A. Al-Garadi, A. Mohamed, A. K. Al-Ali, X. Du, L. Ali, and M. Guizani, "A

Survey of Machine and Deep Learning Methods for IoT Security," IEEE
Communications Surveys & Tutorials, vol. 22, no. 3, pp. 1646-1685, Apr. 2020 .

 [10] N. Moustafa and J. Slay, "UNSW-NB15: a comprehensive data set for network
intrusion detection systems (UNSW-NB15 network data set)," 2015 Military
Communications and Information Systems Conference (MilCIS), pp. 1-6, 2015 .