Sistema de detección de anomalías basado en isolation forest e inspección de flujo para la mitigación de ataques en redes IoT usando una arquitectura híbrida
Palabras clave:
Seguridad IoT, Aprendizaje Automático, Detección de Anomalías, Inspección de Flujo, Arquitectura Híbrida, Mitigación Autónomas, Edge ComputingResumen
El crecimiento de dispositivos del Internet de las Cosas (IoT) en infraestructuras críticas ha ampliado la superficie de ataque frente a amenazas volumétricas. Las limitaciones de hardware en los nodos IoT impiden la ejecución de Sistemas de Detección de Intrusos (IDS) complejos, mientras que los métodos tradicionales fallan ante ataques novedosos. Este artículo presenta la evaluación experimental de un sistema de detección y mitigación de ciclo cerrado sustentado en una arquitectura híbrida desacoplada. Un agente en el Edge Gateway captura pasivamente el tráfico, agrega paquetes en flujos de 5 segundos y transmite metadatos por sockets TCP hacia un servidor analítico externo. Utilizando el algoritmo no supervisado Isolation Forest, validado sobre un dataset sintético de 1000 muestras que replica el comportamiento exacto de las variables de la red, el sistema alcanzó una precisión del 100% (F1-Score: 1.00). El tiempo de mitigación experimental promedio fue de 700.78 ms, manteniendo el consumo de CPU en el borde en un promedio de recuperación post-ataque del 40.45%. La propuesta demuestra como prototipo preliminar que la descarga analítica garantiza la autodefensa sin comprometer la operatividad IoT.
Referencias
Akinbowale, O. E., Adesina, A. T., Zerihun, M. F., & Mashigo, P. (2026). Machine learning based approach to intrusion detection in internet of things environments. Frontiers in Artificial Intelligence, 9. https://doi.org/10.3389/frai.2026.1760137
Algarni, M., Dahab, M. Y., Alsulami, A. A., Alturki, B., & Alsini, R. (2026). Toward a hybrid intrusion detection framework for IIoT using a large language model. Sensors, 26(4), 1231. https://doi.org/10.3390/s26041231
Alharby, M. (2025). Evaluating machine learning approaches for multiple attack classification with improved computational efficiency in IoT networks. Scientific Reports, 15(1). https://doi.org/10.1038/s41598-025-23711-7
Aljumaily, M., Abdullah, S., & Abd Alhasan, A. (2025). A hybrid intrusion detection framework for cyber-physical security in smart home/smart city IoT systems. International Journal of Mechatronics, Robotics, and Artificial Intelligence, 1(2), 9. https://doi.org/10.33971/ijmrai.1.2.9
Altulaihan, E., Almaiah, M. A., & Aljughaiman, A. (2024). Anomaly detection IDS for detecting DoS attacks in IoT networks based on machine learning algorithms. Sensors, 24(2), 713. https://doi.org/10.3390/s24020713
Aung, A., Tantayakul, K., & Intana, A. (2026). Location-aware SDN-IDPS framework for real-time DoS mitigation in vehicular networks. Future Internet, 18(2), 87. https://doi.org/10.3390/fi18020087
Ávalos, S. A., & Mendoza de los Santos, A. C. (2025). Implementación de arquitecturas zero trust: Revisión sistemática de beneficios y desventajas. Ingeniería Investiga, 8, e1331. https://doi.org/10.47796/ing.v8i00.1331
Baz, M. (2025). Lightweight IDS for IoT based on counter-propagation networks. IEEE Access, 13, 147086-147111. https://doi.org/10.1109/access.2025.3600620
Čenys, A., Hora, S. K., & Goranin, N. (2025). Emulation-based dataset EmuIoT-VT for NIDS in IoT systems. Sensors, 25(16), 5077. https://doi.org/10.3390/s25165077
Craciun, R.-A., Caramihai, S. I., & Mocanu, S. (2025). Hybrid machine learning for IoT-enabled smart buildings. Informatics, 12(1), 17. https://doi.org/10.3390/informatics12010017
Dharini, N., Janani, V. S., & Katiravan, J. (2026). Efficient detection of intrusions in TON-IoT dataset using hybrid feature selection approach. Scientific Reports, 16(1). https://doi.org/10.1038/s41598-026-37834-y
Diana, L., Dini, P., & Paolini, D. (2025). Overview on intrusion detection systems for computers networking security. Computers, 14(3), 87. https://doi.org/10.3390/computers14030087
Douha, N. Y.-R., Bhuyan, M., Kashihara, S., Fall, D., Taenaka, Y., & Kadobayashi, Y. (2022). A survey on blockchain, SDN and NFV for the smart-home security. Internet of Things, 20, 100588. https://doi.org/10.1016/j.iot.2022.100588
Hamad, D., Yalda, K., Tapus, N., & Okumus, I. T. (2024). Enhancing IoT scalability and security through SDN. Revista Română de Informatică, 34(2), 113-126. https://doi.org/10.33436/v34i2y202409
Khan, N. W., Alshehri, M. S., Khan, M. A., Almakdi, S., Moradpoor, N., Alazeb, A., Ullah, S., Naz, N., & Ahmad, J. (2023). A hybrid deep learning-based intrusion detection system for IoT networks. Mathematical Biosciences and Engineering, 20(8), 13491-13520. https://doi.org/10.3934/mbe.2023602
Khedr, W. I., Gouda, A. E., & Mohamed, E. R. (2023). FMDADM: A multi-layer DDoS attack detection and mitigation framework using machine learning for stateful SDN-based IoT networks. IEEE Access, 11, 28934-28954. https://doi.org/10.1109/access.2023.3260256
Li, T., Zheng, B., Feng, Y., Quan, X., Xu, J., Liu, Y., & Ma, J. (2025). Log2Evt: Constructing high-level events for IoT systems through log-code execution path correlation. Journal of Systems Architecture, 168, 103578. https://doi.org/10.1016/j.sysarc.2025.103578
Maddu, M. (2025). Integrated intrusion detection and mitigation framework for SDN-based IIoT networks using lightweight and adaptive AI techniques. Journal of Information Systems Engineering and Management, 10(9s), 456-472. https://doi.org/10.52783/jisem.v10i9s.1244
Mahmoud, R., Yousuf, T., Aloul, F., & Zualkernan, I. (2015). Internet of things (IoT) security: Current status, challenges and prospective measures. 2015 10th International Conference for Internet Technology and Secured Transactions (ICITST), 336-341. https://doi.org/10.1109/icitst.2015.7412116
Monteiro, B., & Granjal, J. (2025). Trust-aware distributed and hybrid intrusion detection for rank attacks in RPL IoT environments. IoT, 7(1), 4. https://doi.org/10.3390/iot7010004
Mutambik, I. (2024). An efficient flow-based anomaly detection system for enhanced security in IoT networks. Sensors, 24(22), 7408. https://doi.org/10.3390/s24227408
Pincay Bohórquez, F. S., Orozco Vaca, N. M., Sañudo Alvarado, C., & Yánez Escobar, A. H. (2025). Arquitectura híbrida para redes distribuidas seguras: Integración de SDN, aprendizaje federado y blockchain en entornos dinámicos. Revista Social Fronteriza, 5(3). https://doi.org/10.59814/resofro.2025.5(3)730
Salau, A. O., & Beyene, M. M. (2024). Software defined networking based network traffic classification using machine learning techniques. Scientific Reports, 14(1). https://doi.org/10.1038/s41598-024-70983-6
Sarwar, N., Bajwa, I. S., Hussain, M. Z., Ibrahim, M., & Saleem, K. (2023). IoT network anomaly detection in smart homes using machine learning. IEEE Access, 11, 119462-119480. https://doi.org/10.1109/access.2023.3325929
Sayed, M. S. E., Le-Khac, N.-A., Azer, M. A., & Jurcut, A. D. (2022). A flow-based anomaly detection approach with feature selection method against DDoS attacks in SDNs. IEEE Transactions on Cognitive Communications and Networking, 8(4), 1862-1880. https://doi.org/10.1109/tccn.2022.3186331
Siregar, V. M. M., & Hanafi, M. (2026). Design and evaluation of an adaptive intrusion detection framework for IoT edge networks using hybrid machine learning and deep reinforcement learning techniques. Cyber Security and Network Management, 1(1), 01-11. https://doi.org/10.66472/cybernet.v1i1.8
Suma. (2025). Network traffic tracer: Analyzing and monitoring network traffic using Python and Wireshark. International Journal of Scientific Research in Engineering and Management, 09(05), 1-9. https://doi.org/10.55041/ijsrem47878
Ullah, I., & Mahmoud, Q. H. (2020). A two-level flow-based anomalous activity detection system for IoT networks. Electronics, 9(3), 530. https://doi.org/10.3390/electronics9030530
Vashisht, S., Rani, S., & Shabaz, M. (2025). Towards a secure metaverse: Leveraging hybrid model for IoT anomaly detection. PLoS ONE, 20(4), e0321224. https://doi.org/10.1371/journal.pone.0321224
Vladov, S., Ścisło, Ł., Sachenko, A., Foros, H., Zhuravlov, D., Vysotska, V., Varlakhov, V., Sachenko, S., Krupiński, J., & Brusakova, O. (2025). Neural network DDoS mitigation system with forensic audit support for cyber police. IEEE Access, 13, 204628-204655. https://doi.org/10.1109/access.2025.3634478
Zhao, D., Lv, Y., Zhou, J., Wen, G., & Huang, T. (2022). Attack-isolation-based resilient control of large-scale systems against collusive attacks. IEEE Transactions on Network Science and Engineering, 9(4), 2857-2869. https://doi.org/10.1109/tnse.2022.3171219
Zhen, L., Hafizah Kamarudin, N., Jyn Kok, V., & Qamar, F. (2025). Anomaly detection model in network security situational awareness based on machine learning: Limitation, techniques, and future trends. IEEE Access, 13, 126084-126129. https://doi.org/10.1109/access.2025.3589620
