# A Novel Hybrid Unsupervised Learning Approach for Enhanced Cybersecurity in the IoT
## 6 Conclusions  
This study presented a novel comprehensive approach to address the escalating cybersecurity concerns associated with the proliferation of Internet services and the corresponding surge in network attacks. By leveraging unsupervised learning techniques, the proposed method offers a robust framework for training detection models to effectively counter a wide range of threats, including denial of service (DoS), distributed denial of service (DDoS), botnet, brute force, infiltration, and Heartbleed. The significance of this work lies in its multi-stage detection model, which combines basic autoencoders (bAEs), a one-class support vector machine (OCSVM), and deep autoencoder (dAE) attack detection, supplemented by density-based spatial clustering of applications with noise (DBSCAN) for attack clustering. This integrated approach enables the accurate delineation of attack clusters, aiding in the mapping of attack tactics and facilitating timely response strategies. Furthermore, by leveraging preprocessed and unlabeled normal network traffic data, this methodology allows for the identification of novel attacks while mitigating the impact of imbalanced training data on model performance. The use of reconstruction error in the autoencoder method, kernel functions in OCSVM, and density-based clustering in DBSCAN ensures robust anomaly detection, noise management, and scalability, resulting in highly accurate intrusion detection. The evaluation of the proposed model on standard datasets such as CIC-IDS2017 and CSECIC-IDS2018 demonstrates its efficacy, with accuracies exceeding 98% in both cases. These results underscore the potential of this approach to significantly enhance network security and protect against evolving cyber threats. This research contributes to the advancement of intrusion detection systems and underscores the importance of leveraging innovative techniques to safeguard critical networks against cyber threats. By combining machine learning algorithms with robust clustering methods, this approach offers a promising solution for efficient and effective intrusion detection in the ever-changing cybersecurity landscape.  
Looking ahead, the findings of this study suggest various avenues for application and extension. The developed framework can be further refined and customized to address specific network environments and threat landscapes. Additionally, the integration of frameworks like the MITRE ATT&CK provides a structured approach to cataloging attacks and tactics, enabling proactive defense strategies based on threat prioritization.  
Conceptualization, P.K., S.P., M.T., B.B. and F.B.; methodology, P.K., S.P. and M.T.; software, P.K., S.P. and M.T.; validation, P.K., S.P., M.T., B.B. and F.B.; formal analysis, P.K., S.P. and M.T.; investigation, P.K., S.P., M.T., B.B. and F.B.; resources, P.K., S.P. and M.T.; data curation, P.K., S.P. and M.T.; writing--original draft preparation, P.K., S.P. and M.T.; writing--review and editing, P.K., S.P., M.T., B.B. and F.B.; visualization, B.B. and F.B.; supervision, B.B. and F.B.; project administration, B.B. and F.B. All authors have read and agreed to the published version of the manuscript.  
This research received no external funding.  
The dataset used for this article is available online at [[https://www.umb.ca/cic/datasets/ids-2018.html](https://www.umb.ca/cic/datasets/ids-2018.html)]([https://www.umb.ca/cic/datasets/ids-2018.html](https://www.umb.ca/cic/datasets/ids-2018.html)) and [[https://www.umb.ca/cic/datasets/ids-2017.html](https://www.umb.ca/cic/datasets/ids-2017.html)]([https://www.umb.ca/cic/datasets/ids-2017.html](https://www.umb.ca/cic/datasets/ids-2017.html)) for CSECIC-IDS2018 and CIC-IDS2017 respectively, date accessed 11 July 2024.  
The authors declare no conflicts of interest.