REAL-TIME ANOMALY RECOGNITION IN IOT AT THE EDGE USING BOOSTED TREE CLASSIFIERS

Abstract

With the rapid proliferation of IoT networks, the number of internet-connected devices worldwide is expected to surpass 29 billion by 2030, generating massive volumes of real-time traffic. Alarmingly, nearly 70% of these devices are susceptible to at least one security vulnerability, while more than 60% of network anomalies remain undetected due to insufficient early-warning systems. The financial implications are substantial, with businesses incurring annual losses of approximately $120 billion due to cyber threats, operational downtime, and performance issues. Traditional anomaly detection approaches such as signature-based detection, threshold monitoring, and manual log analysis are increasingly inadequate in dynamic IoT ecosystems. These methods are labor-intensive, error-prone, and lack the adaptability to detect zero-day attacks or evolving traffic patterns. To address these limitations, this study introduces a machine learning-based anomaly detection framework specifically designed for IoT edge devices. The framework features a comprehensive preprocessing pipeline that includes structured data exploration, visualization of class distribution, and feature standardization to enhance learning accuracy. Two machine learning models are utilized: Logistic Regression and an AdaBoost-powered Decision Tree Classifier, both trained to identify four key types of network anomalies Frequency Drift, Capacity Breach, Dual Signal Interference, and Request Overload. A dedicated performance evaluation module calculates essential metrics including accuracy, precision, recall, and F1-score, and leverages confusion matrices for result interpretation