An Ensemble Machine Learning Approach for Denial-of-Service Detection in Cloud-of-Things Networks Using CICIoT2023 Dataset

Abstract

The rapid expansion of Cloud-of-Things (CoT) infrastructures has intensified exposure to denial-of-service (DoS) and distributed DoS (DDoS) attacks that exploit heterogeneous IoT devices and dynamic cloud connections. Traditional signature-based and rule-driven defenses often fail to adapt to these evolving threats. This study presents a reproducible, data-driven detection framework that combines Naïve Bayes (NB) and Support Vector Machine (SVM) classifiers through a weighted ensemble mechanism to identify DoS traffic in IoT-cloud environments. Using the CICIoT2023 dataset, which captures diverse IoT attack patterns, the work establishes a complete pipeline encompassing preprocessing, feature normalization, model training, validation, and artifact generation. The ensemble model integrates probabilistic reasoning from NB with the discriminative power of SVM, optimizing decision thresholds for balanced precision and recall. Performance evaluation demonstrates significant improvement over individual classifiers, achieving 99.3% accuracy, 99.2% precision, 99.1% recall, and an AUROC of 0.994 on the test dataset. Confusion matrix and learning-curve analyses confirm robust generalization and reduced false alarm rates, validating its applicability for real-time detection. Beyond high accuracy, the modular structure allows seamless integration into prevention-oriented intrusion detection systems for CoT environments. The research thereby bridges the gap between academic prototypes and deployable, lightweight IDS frameworks, aligning with contemporary SDN-assisted defense strategies. Overall, this ensemble-based detector establishes a strong foundation for operational CoT intrusion prevention systems by ensuring reproducibility, interpretability, and scalability across heterogeneous IoT-cloud networks.