## 1 Introduction  
While deep learning-based systems can automate feature extraction and increase accuracy, they frequently require large data sets and significant processing power. Moreover, traditional IDSs have drawbacks, such as their inability to identify zero-day threats and the requirement for manual signature updates. In this context, the proposed cluster-based classification technique provides a distinct benefit, especially for IoT contexts where devices exhibit various dynamic behaviors. Clustering techniques such as k-means used in this approach are well-suited for identifying threats that have not yet been identified or have complex behavior, and can detect novel attacks without the need for labeled data. Clustering is a highly successful option for anomaly detection in IoT networks because it is computationally more efficient, flexible, and able to find patterns in data without prior knowledge of particular threat signatures, in contrast to deep learning approaches and older methods. The increasing number of devices in IoT networks has raised security concerns about the evidence of zero-day attacks. Unfortunately, previous methods could not address this problem and could not perform attack classification with high accuracy. Therefore, it is crucial to develop a technique capable of detecting diverse types of attacks within various IoT networks, thereby enhancing the security of IoT systems against novel and emerging threats. Recent advancements in activity recognition and intrusion detection have introduced several innovative approaches. Therefore, one such method involves clustering-based classification to enhance the recognition of overlapping activities in smart homes, which helps reduce interclass variations and improves accuracy. Thus, this paper utilized a Cluster-Based Classification (CBC) approach to detect emerging and novel attacks. Clustering is a popular technique for finding similarity and consistency among different activities and patterns. In network security, a multiple-kernel clustering approach has been designed for intrusion detection in 5G and IoT networks, improving detection performance by addressing the diverse nature of network traffic [1]. Consequently, it helps identify the correspondence between different anomalies in the IoT network. One such approach, Dragonfly Optimizer, has been integrated with deep clustering and CNN-PSO classifiers to improve intrusion detection systems, providing more efficient and accurate results in complex network environments [2]. However, as discussed, this approach is computationally expensive. Therefore, to overcome these issues, the technique used in this article, named the cluster-based classification (CBC), is to recognize novel attacks that are previously unknown. The CBC approach can classify novel viruses by calculating their similarity to known attacks, then classifying packets as benign or attack packets. The evaluation uses hybrid machine learning algorithms, including XGBoost, AdaBoost, KNN, and Random Forest. The aim is to detect attacks with improved performance. This study delves into the design and execution of the proposed method, detailing the feature extraction technique, the assessment of the approach, the organization of the dataset, the analysis of the results, and a comprehensive summary.