ISAAF: an IoT security and attack prevention framework using AI-driven predictive analytics.

The Internet of Things (IoT) is reshaping domains, such as healthcare, agriculture, and industry by enabling real-time connectivity among constrained devices. However, the lightweight Message Queuing Telemetry Transport (MQTT) protocol exposes these systems to severe cyber threats, including DoS, Bruteforce, Malformed, Flood, and Slowite attacks. While machine learning (ML) and deep learning (DL) models trained on simulated benchmarks, such as MQTTset, have shown promise, evaluation results indicate that these models achieved high accuracy in controlled environments but failed to generalize to real-world traffic. To address this limitation, MQTTEEB-D was introduced as a novel real-world intrusion dataset collected from an operational IoT testbed. Building on MQTTEEB-D, a layered and AI-driven security framework is introduced for real-time intrusion detection and automated mitigation. For instance, Decision Tree (DT) and Gated Recurrent Unit (GRU) accuracies, using MQTTset, dropped to 8% and 21% when tested on real data. However, after retraining both models on MQTTEEB-D, the results showed a noticeable improvement; DT reached 87% and GRU 86.5% accuracy. The framework was deployed and tested in real-sitting scenarios and experimental results demonstrated efficient attacks' detection and mitigation with near-real-time responsiveness. Overall, the findings confirm that the proposed framework and its related services provide a scalable, deployable, and cross-domain security solution for real-world IoT applications.