DeepShield-IoT: A Hybrid AI and Lotka–Volterra Model for Efficient IoT Intrusion Detection Systems

1. Introduction

The Internet of Things (IoT) has become a a fundamental technology in many critical domains, including smart cities, healthcare, industrial automation, transportation, and home automation. By connecting large numbers of heterogeneous and resource-constrained devices, IoT systems enable continuous data capture, continuous tracking, and AI-driven decision-making. However, this rapid growth has considerably expanded the attack surface of of advanced network architectures, making IoT security a critical and urgent concern.[1]

In traditional computing systems, IoT devices are often characterized by limited processing power, memory, and energy resources. Because of these limitations, it is not always easy to rely on traditional security mechanisms such as complex encryption, continuous monitoring, or frequent updates in IoT environments. These systems are, by nature, highly dynamic and diverse, involving different types of devices, communication protocols, and real-world usage conditions.[2] As a result, IoT networks tend to be more exposed to multiple forms of cyberattacks, such as distributed denial-of-service (DDoS), botnets, malware spread, brute-force attempts, and even more discreet reconnaissance activities. In recent years, we have seen several attacks targeting IoT devices, and their security is insufficient to protect them.[3]

Traditional security methods are no longer enough because cyberattacks keep changing. Researchers are therefore developing smarter security systems that can learn from network data and automatically adapt to new threats. [4] Many AI-based intrusion detection systems achieve high detection accuracy, but they still face several limitations. Most existing models rely on historical data and require frequent retraining to remain effective against emerging threats. In addition, they may struggle to adapt to rapidly evolving attack patterns and often provide limited insight into how decisions are made. These challenges can reduce their reliability when encountering previously unseen attacks.[5]

In this context, hybrid models are among the best solutions for securing IoT devices. The Lotka–Volterra (LV) predator–prey model, originally developed to describe population dynamics in biological systems, offers a natural way to represent the interaction between normal network behavior and malicious activities. In this work, we treat cyber-attacks as ‘predators’ and legitimate traffic as ‘prey,’ which allows us to capture how attack intensity evolves and how the system responds over time. This perspective moves beyond static detection rules and supports a more adaptive, real-time defense strategy.[6]

In this research, we introduce H-LVIA, a hybrid adaptive defense system for IoT networks that combines Lotka–Volterra dynamics with AI-based detection. We bring together two complementary strengths: the interpretability and adaptability of the Lotka-Volterra model and the strong detection capabilities of AI techniques. First, we use the AI-driven intrusion detection module to analyze traffic features, detect anomalies, and classify different types of attacks. Then, we use the LV model to track how normal and malicious traffic evolve within the network. By connecting these two components, we enable the system to adjust detection thresholds and defense responses dynamically, which improves both accuracy and robustness.

In this paper, we make the main contributions. First, we integrate the Lotka–Volterra dynamic model into IoT intrusion detection to capture how attacks and defenses evolve over time. Second, we design a hybrid AI-based detection mechanism that works alongside the LV model to improve anomaly detection and accurately classify different types of attacks. Finally, we evaluate our approach using the CIC-IIoT 2025 dataset, which offers realistic IoT traffic along with a wide range of attack scenarios.

The rest of this paper is organized as follows. Section II presents an overview of intrusion detection in IoT. Section III presents related work on IoT security and AI-based intrusion detection systems. Section IV describes the proposed H-LVIA framework, starting with the AI-based detection of LSTM and the Lotka–Volterra model. Section IV introduces the methodology of the proposed hybrid architecture, encompassing the dataset CICIIOT 2025 and the experimental setup. Section VI provides the experimental results and performance analysis. Finally, Section VII concludes the study by summarizing the work and discussing future research directions.

2. Intrusion Detection Systems in IoT

2.1. Definition of IDS

An Intrusion Detection System (IDS) is one of the security mechanisms used to inspect network and system interactions to detect malicious behavior or policy violations. In Internet of Things (IoT) environments, IDS plays an important role due to the limited computational capabilities and security features of connected devices.[7] The distributed and heterogeneous nature of IoT networks increases their vulnerability to various cyber-attacks, making intrusion detection an essential component of IoT security.[8]

2.2. Types of IDS

IDS can be classified based on detection methodology into three main categories:[9]

2.2.1. Signature-Based IDS

Signature-based IDS locates intrusions by comparing observed traffic patterns with a dataset of known attack signatures.[10] This approach ensures high accuracy for detecting known attacks; however, it is ineffective against emerging threats and zero-day attacks.

2.2.2. Anomaly-Based IDS

Anomaly-based intrusion detection systems find intrusions by making deviations from normal system behavior. This approach typically relies on statistical methods or artificial intelligence techniques to learn normal patterns and identify anomalies.It is particularly well-suited for IoT environments, as it may detect previously unseen attacks. However, it may also lead to higher false positive rates.[11,12]

2.2.3. Hybrid IDS

Hybrid IDS integrates both signature-based and anomaly-based approaches to improve detection performance. By leveraging the advantages of both methods, Hybrid frameworks combine signature-based precision with anomaly detection capabilities to identify unknown threats.[13] Hybrid IDS is considered a promising solution for securing complex IoT environments.

2.3. IDS Deployment in IoT

IDS can also be categorized based on their deployment location within the network:[14]

• Network-Based IDS (NIDS): Monitors network traffic to get malicious activity across the IoT network.[15]
• Host-Based IDS (HIDS): Monitors individual devices to identify suspicious behavior at the host level.[16]
• Distributed IDS: Deploys multiple IDS nodes across the network to provide scalable and collaborative intrusion detection.[17]

2.4. Challenges of IDS in IoT

Despite their importance, IDS in IoT environments face several challenges:

• Limited computational and energy resources of IoT devices.
• High volume and velocity of generated data.
• Heterogeneity of devices, protocols, and communication standards.
• Difficulty in detecting evolving and unknown attack patterns.

2.5. Motivation for Hybrid AI-Based IDS

Recent advances in artificial intelligence have significantly improved anomaly detection in IoT systems. However, purely AI-based approaches often absence of interpretability and are unable to capture the dynamic interaction between normal and malicious traffic.

That is why this paper proposes a hybrid IDS architecture that integrates artificial intelligence techniques with dynamic modeling based on the Lotka–Volterra equations. This approach enables both accurate detection and interpretable modeling of system behavior, making it suitable for dynamic IoT environments.

3. Related Work

Intrusion Detection Systems method in IoT environments have been widely studied using artificial intelligence, hybrid approaches, and dynamic system modeling. This section reviews the most relevant works in these areas.

3.1. AI-Based Intrusion Detection Systems

Artificial intelligence techniques have been extensively used for anomaly-based IDS in IoT systems. Techniques including SVM, KNN, and Random Forest have been adopted to classify network traffic. In recent years, deep learning models such as Long Short-Term Memory (LSTM), Convolutional Neural Networks (CNN), and Autoencoders have demonstrated high performance in detecting complex attack patterns.

For instance, Park et al. [18] proposed an autoencoder-based approach for detecting IoT botnet attacks using the N-BaIoT dataset. While these approaches achieve high accuracy, they are typically data-driven and lack interpretability.

3.2. Hybrid AI-Based Approaches

To improve detection performance, several studies have proposed Hybrid systems that utilize a combination of machine learning and deep learning algorithms. Alahmadi et al. [19] provides taxonomy of IoT attacks and IDS methods. Oduwale et al. [20] and Sinha et al. [21] include CNN–LSTM architectures, LSTM–Autoencoder models, and combinations of deep learning with traditional classifiers.

In addition, Xue et al. [22] employ a hybrid LSTM–Autoencoder architecture to effectively detect zero-day attacks, while Senthil et al. [23] enhance model interpretability by integrating LSTM and Decision Tree networks with rule-based decision mechanisms.

These hybrid approaches enhance detection accuracy by leveraging complementary strengths such as temporal modeling and feature extraction. However, they often increase computational complexity and remain black-box systems, providing limited insight into system behavior.

3.3. Dynamical System-Based Models

In addition to AI-based methods, dynamical models have been explored in IoT and cybersecurity contexts. The Lotka–Volterra equations have been used to model the interaction between competing entities, such as normal system behavior and malicious activities.

Casado-Vara et al. [24] applied Lotka–Volterra models to IoT systems to analyze device interactions and system reliability. Similarly, Chaikovskyi et al. [25] used Lotka–Volterra dynamics to model malware propagation and defense mechanisms. Although these models provide valuable insights into system evolution, they do not include classification mechanisms or data-driven learning.

3.4. Discussion and Research Gap

From the literature, it is evident that AI-based IDS approaches offer strong detection performance but lack interpretability and dynamic modeling capabilities. On the other hand, Lotka–Volterra-based models provide a mathematical framework for describing system evolution but do not support classification or learning from data.

Furthermore, existing hybrid approaches mainly combine multiple AI techniques without integrating dynamic system modeling. Therefore, the interaction between normal and malicious traffic remains insufficiently explored. The Table 1 summarizes the contributions and limitations of each method reviewed in this study.`[26]

To resolve these issues, this work introduces a hybrid IDS architecture that integrates artificial intelligence with Lotka–Volterra dynamics. The AI component is used to estimate system states from IoT data, while the dynamic model captures their interaction over time. In addition, a mathematically justified decision mechanism is introduced for effective classification.

4. Methodology

This section introduces the proposed hybrid Intrusion Detection System (IDS) for IoT networks. The model integrates an LSTM network for temporal learning with a Lotka–Volterra (LV) dynamic model to capture the interaction between normal and malicious traffic. The complete workflow of the system is provided in Figure 1, while the detailed architecture is shown in Figure 2.

4.1. System Overview

The proposed system is organized into multiple phases, beginning with data preprocessing, temporal learning, dynamic modeling, and decision-making. The system processes IoT traffic data and produces a final classification indicating whether the traffic is normal or malicious.

4.2. Proposed Model Architecture

The proposed HLV-AI model integrates LSTM for temporal learning and the Lotka–Volterra model for dynamic interaction analysis. The architecture is illustrated in Figure 2.

4.3. Workflow of the Study

The overall process of the proposed system is depicted in Figure 1. It describes the main stages of the study from data collection to evaluation.

4.4. Data Preprocessing

The IoT traffic data is first preprocessed to enhance data quality and model performance. This step comprises:

• Data cleaning to remove noise and missing values
• Normalization of features
• Feature selection

The processed input is represented as a feature vector:

$$X_t=[p_t,b_t,d_t,l_t,e_t]$$

(1)

where $p_t$, $b_t$, $d_t$, $l_t$, and $e_t$ represent packet rate, bandwidth, number of devices, latency, and error rate, respectively.

4.5. LSTM-Based Temporal Learning

A Long Short-Term Memory (LSTM) network is applied to capture temporal dependencies in IoT traffic data. The LSTM processes sequential data and extracts temporal features:

$$h_t=\mathrm{LSTM}(X_t,h_{t-1})$$

(2)

where $h_t$ represents the hidden state at time t.

4.6. State Estimation

The output of the LSTM is used to estimate two key states:

$$[\widehat{x}\left(t\right),\widehat{y}\left(t\right)]=f\left(h_t\right)$$

(3)

where:

• $\widehat{x}\left(t\right)$ represents normal traffic behavior
• $\widehat{y}\left(t\right)$ represents anomalous traffic intensity

These states serve as inputs to the dynamic model.

4.7. Lotka–Volterra Dynamic Modeling

We use the Lotka–Volterra equations to describe how normal and malicious traffic interact over time:

$${\displaystyle \frac{dx\left(t\right)}{dt}}=\alpha x\left(t\right)-\beta x\left(t\right)y\left(t\right)$$

(4)

$${\displaystyle \frac{dy\left(t\right)}{dt}}=\delta x\left(t\right)y\left(t\right)-\gamma y\left(t\right)$$

(5)

where:

• $\alpha$ represents the growth rate of normal traffic
• $\beta$ represents the impact of attacks on normal traffic
• $\delta$ represents the propagation rate of attacks
• $\gamma$ represents the mitigation rate of attacks

The system evolves dynamically as:

$$x(t+1)=x\left(t\right)+\left(\alpha x\right(t)-\beta x(t\left)y\right(t\left)\right)$$

(6)

$$y(t+1)=y\left(t\right)+\left(\delta x\right(t\left)y\right(t)-\gamma y(t\left)\right)$$

(7)

4.8. Anomaly Score Computation

An anomaly score is computed based on the updated states:

$$S\left(t\right)={\displaystyle \frac{y\left(t\right)}{x\left(t\right)+y\left(t\right)}}$$

(8)

This score reflects the relative dominance of anomalous behavior.

4.9. Decision Mechanism

The final classification is obtained using a threshold $\theta$:

$$D\left(t\right)=\left\{\begin{array}{cc}1,\hfill & \mathrm{if}S\left(t\right)\ge \theta \hfill \\ 0,\hfill & \mathrm{otherwise}\hfill \end{array}\right.$$

(9)

where:

• $D\left(t\right)=1$ indicates an attack
• $D\left(t\right)=0$ indicates normal traffic

4.10. Dataset Description: CICIIoT 2025

To assess the performance of our hybrid IDS, we run experiments using the CICIIoT 2025 dataset. the Canadian cybersecurity research institute (CIC) developed this dataset specifically for IoT intrusion detection research. flows The CICIoT 2025 dataset provides realistic network flows generated by different IoT devices operating in a simulated smart environment. It includes both normal and malicious flow and covers multiple categories of attack scenarios commonly observed in IoT systems.[27]

4.10.1. Dataset Characteristics

The dataset includes the following key characteristics:

• Realistic IoT Traffic: We collect data from a variety of IoT devices, including cameras, sensors, and smart home systems.
• Attack Diversity: We include multiple types of attacks, like Distributed Denial of Service (DDoS), Denial of Service (DoS), reconnaissance, spoofing, and injection attacks
• Multi-Class Labels: We label each traffic flow as either normal or as a specific type of attack.
• Feature-Rich Representation: We extract more than 80 flow-based and statistical features from the raw network traffic in the dataset.
• Time-Series Nature: Because traffic data evolves over time, we use temporal models such as LSTM to capture these patterns.

4.10.2. Data Format

The dataset is distributed in both PCAP and CSV formats. The PCAP files hold raw packet-level data, while the CSV files include extracted flow-based features used for machine learning and deep learning models.

4.10.3. Preprocessing for the Proposed Model

For this study, the CSV version of the dataset is used. The following preprocessing steps are applied:

• Removal of missing and redundant values
• Feature normalization using Min-Max scaling
• Selection of relevant features for model training
• Conversion of data into time-series sequences for LSTM input

4.10.4. Dataset Suitability

The CICIIoT 2025 dataset is particularly suitable for evaluating the proposed model due to its large-scale, diverse attack scenarios, and temporal structure. These characteristics allow effective training of the LSTM component and realistic modeling of attack dynamics using the Lotka–Volterra equations.

5. Experimental Setup

This section reports the experimental configuration used to validate the proposed hybrid intrusion detection system. It includes details about the dataset, data splitting, evaluation metrics, and training settings.

5.1. Dataset and Data Splitting

The experiments are carried out using the CICIIoT 2025 dataset. The dataset is divided into three subsets to ensure robust evaluation:

• Training set: 60%
• Validation set: 20%
• Testing set: 20%

The data is preprocessed and transformed into time-series sequences suitable for LSTM training.

5.2. Evaluation Metrics

To validate the performance of the proposed IDS, several standard classification metrics are used:

• Accuracy (Ac):

  $$Ac={\displaystyle \frac{TP+TN}{TP+TN+FP+FN}}$$

  (10)
• Precision (Pr):

  $$Pr={\displaystyle \frac{TP}{TP+FP}}$$

  (11)
• Recall (Re):

  $$Re={\displaystyle \frac{TP}{TP+FN}}$$

  (12)
• F1-score (F1):

  $$F1=2\times {\displaystyle \frac{Pr\times Re}{Pr+Re}}$$

  (13)

where $TP$, $TN$, $FP$, and $FN$ represent the numbers of true positives, true negatives, false positives, and false negatives, respectively.

5.3. LSTM Training Configuration

The LSTM network is configured to extract temporal dependencies in IoT traffic data. The main training parameters are defined as follows:

• Number of LSTM layers: 2
• Hidden units: 64
• Activation function: ReLU
• Optimizer: Adam
• Learning rate: ${10}^{-3}$
• Batch size: 64
• Number of epochs: 50

The model is trained using the training set and validated using the validation set to prevent overfitting.

5.4. Lotka–Volterra Parameters

Table 2 presents different configurations of the Lotka–Volterra parameters and their corresponding system behaviors.

The balanced configuration provides stable interaction between normal and malicious traffic, but may not be sufficiently sensitive to attacks. The conservative configuration results in smoother dynamics with slower response to anomalies.

In contrast, the security-oriented configuration increases the sensitivity of the system by using higher values of $\beta$ and $\delta$, allowing faster detection of malicious activity. Additionally, a higher value of $\gamma$ ensures stronger suppression of attacks.

The defense-dominant configuration further enhances the mitigation capability by increasing $\gamma$, resulting in rapid reduction of anomalous behavior.

Based on these observations, the security-oriented configuration is selected in this study, as it provides an effective trade-off between early attack detection and system stability. The parameters of the Lotka–Volterra model are empirically selected to ensure stable system behavior:

$$\alpha =0.5,\beta =0.05,\delta =0.04,\gamma =0.6$$

(14)

These parameters control the interaction between normal and malicious traffic.

5.5. Threshold Selection

The decision threshold $\theta$ is used to distinguish between normal and anomalous behavior based on the anomaly score $S\left(t\right)$. We define the classification rule as follows:

$$\mathrm{Attack}\mathrm{if}S\left(t\right)\ge \theta ,\mathrm{Normal}\mathrm{otherwise}$$

(15)

We don’t fix the value of $\theta$ arbitrarily. Instead, we determine it through a validation-based optimization process. We test several candidate threshold values and compute the corresponding performance metrics for each one.

We then select the threshold that maximizes the F1-score, since it provides a good balance between precision and recall. This choice helps the model achieve reliable intrusion detection while keeping both false positives and false negatives low.

5.6. Implementation Details

We implement the proposed model in Python using deep learning libraries such as TensorFlow and Keras. To speed up training, we run our experiments on a system equipped with a GPU.

5.7. Discussion

We design the experimental setup to ensure a fair and thorough evaluation of our hybrid IDS. By combining temporal learning with dynamic modeling, we expect the model to improve detection performance while remaining interpretable.

6. Results and Discussion

In this part, we present the experimental findings of our hybrid IDS model. We evaluate its performance using standard metrics and compare it with several baseline models.

6.1. Performance Evaluation

Table 3 shows how our model performs in terms of accuracy, precision, recall, and F1-score.

Table 3 presents a comprehensive comparison of different intrusion detection models using standard evaluation metrics, such as accuracy, precision, recall, and F1-score.

The results show that the proposed HLV-AI model outperforms all baseline methods across all metrics. Specifically, it achieves the highest accuracy of 99.85%, indicating superior overall classification performance. The precision of 99.44% demonstrates that the model produces very few false positives, which is critical in intrusion detection systems to avoid unnecessary alerts.

Furthermore, the recall of 99.68% indicates that the model successfully detects the majority of malicious traffic, minimizing false negatives. This is particularly important in IoT environments, where undetected attacks can cause significant damage. The F1-score of 99.56% confirms the balance between precision and recall, highlighting the robustness of the proposed approach.

Compared to traditional models such as LSTM, CNN–LSTM, and Autoencoder, the proposed method achieves consistent improvements. These gains can be attributed to the integration of temporal learning through LSTM and dynamic interaction modeling using the Lotka–Volterra equations.

Overall, the results demonstrate that the proposed hybrid model provides more accurate, reliable, and interpretable intrusion detection compared to existing approaches.

6.2. Confusion Matrix Analysis

The confusion matrix shown in Figure 3 illustrates the classification performance of the proposed model.

The confusion matrix indicates a high number of correctly classified samples, with very low false positives and false negatives.

6.3. ROC Curve Analysis

The Receiver Operating Characteristic curve is shown in Figure 4, showing the relationship between true positive rate and false positive rate.

The model achieves an Area Under the Curve (AUC) close to 1, indicating excellent classification capability.

6.4. Detection Time Analysis

Detection time is a critical metric in IoT intrusion detection systems, as it reflects the ability of the model to identify attacks in real time. It is defined as the time difference between the occurrence of an attack and its detection:

$$T_{detection}=t_{detected}-t_{attack}$$

(16)

To evaluate the efficiency of the proposed model, the average detection time per sample is measured. Table 4 presents the detection time comparison of different models.

The results indicate that the proposed HLV-AI model achieves a detection time comparable to the LSTM model. Although the Lotka–Volterra component is added, its computational overhead is minimal. Therefore, the proposed model remains suitable for real-time IoT applications.

6.5. Computational Complexity Analysis

The computational complexity of the proposed model is analyzed based on its main components.

The LSTM network processes sequential data and performs matrix multiplications at each time step. Its complexity is given by:

$$O(T·n^2)$$

(17)

where T represents the sequence length and n is the number of hidden units.

The Lotka–Volterra model involves simple arithmetic operations, leading to a linear complexity:

$$O\left(n\right)$$

(18)

Since the LV component introduces only negligible computational cost compared to the LSTM, the overall complexity of the proposed model is dominated by the LSTM:

$$O(T·n^2)$$

(19)

Table 5 presents the comparison of computational complexity for different models.

6.6. Discussion

The proposed hybrid model achieves a favorable balance between performance and efficiency. While maintaining the same computational complexity as the LSTM model, it significantly improves detection accuracy through the integration of dynamic modeling.

The Lotka–Volterra component enhances the model’s ability to capture interactions between normal and malicious traffic without introducing significant computational overhead. With this approach, we improve detection performance without sacrificing real-time capability, which makes it well suited for real-world IoT deployments.

6.7. Ablation Study

To better understand how each part of the model contributes, we run an ablation study. We look at how both the LSTM module and the Lotka–Volterra (LV) model affect the overall performance of the intrusion detection system.

6.7.1. Experimental Setup

Three configurations are considered:

• LSTM only: Temporal learning without dynamic modeling
• LV only: Dynamic modeling without AI-based feature learning
• LSTM + LV (Proposed HLV-AI): Full hybrid model

All models are evaluated using the same dataset, preprocessing steps, and evaluation metrics to ensure fair comparison.

6.8. Results

6.9. Discussion

The results demonstrate as shown in Table 6 that the proposed hybrid model significantly improves intrusion detection performance. The integration of LSTM enables effective temporal learning, while the Lotka–Volterra model captures the dynamic interaction between normal and malicious traffic.

Compared to traditional AI-based methods, the proposed approach provides:

• Higher detection accuracy
• Better generalization to unseen attacks
• Improved interpretability through dynamic modeling

These results confirm the effectiveness of the proposed hybrid IDS for IoT environments.

7. Conclusion

This research proposed a new hybrid intrusion detection system (IDS) for IoT environments by integrating Long Short-Term Memory (LSTM) networks with Lotka–Volterra (LV) dynamic modeling. The proposed approach combines the strengths of temporal learning and dynamic system analysis to improve the detection of anomalous behavior in IoT traffic.

The LSTM component effectively captures temporal dependencies and estimates system states, while the Lotka–Volterra model describes the interaction between normal and malicious traffic over time. In addition, a mathematically justified decision mechanism based on an anomaly score was introduced to classify network traffic.

Experimental results on the CICIIoT 2025 dataset demonstrated that the proposed model outperforms traditional and hybrid deep learning methods in terms of accuracy, precision, recall, and F1-score. The results also showed a significant reduction in false positives and false negatives, confirming the effectiveness and robustness of the proposed system.

Overall, the integration of artificial intelligence and dynamic modeling provides a promising direction for improving intrusion detection in complex IoT environments. Future work will focus on optimizing model parameters, extending the approach to real-time deployment, and evaluating its performance on larger and more diverse datasets.