As time progresses with vast development of information technology, a large number of industries are more dependent on network connections for sensitive business trading and security matters. Communications and networks are highly vulnerable to threats because of increase in hacking. Personnel, governments, and armed classified networks are more exposed to difficulties, so the need of the hour is to install safety measures for network to prevent illegal modification, damage, or leakage of serious information. Intrusion detection, an important entity towards network security, has the ability to observe network activity as well as detect intrusions/attacks. This study highlights the developing research about the application of machine learning and data mining in Internet security. We provide background, enthusiasm, discussion of challenges, and recommendations for the application of ML/DM in the field of intrusion detection.

The sinkhole attacks for Internet of Things (IoT) situations can overcome the network and interrupt communication. Sinkhole attacker nodes can advertise the best possible shortest path towards the destination, and once the normal node starts transferring the packets by the given path, the attacker node starts troublemaking the flow of the network. In this environment, the destination is unable to receive proper information or may not receive complete information. Sinkhole attacked network keeps the problems like the enhanced end‐to‐end delay, less throughput, and reduced packet delivery. Furthermore, it can affect other network constraints. So, it has become important to design an effective model to prevent the IoT environment from sinkhole attacks. In this article, an intrusion detection model is proposed to protect the IoT environment from sinkhole attacks. A model proposed by using rich resourced edge nodes to detect various kinds of sinkhole attacker nodes by exchanging messages. A well‐known NS2 simulator is used for the practical implementation of the model. The proposed model attains more than 95% detection rate with a near about 1.4% false‐positive rate, which seems better than previously given schemes. Finally, the proposed scheme is the appropriate match for a sensitive platform like a monitoring and security system.

The increasing cybersecurity vulnerabilities in smart cities are driven by complex and interconnected infrastructure. Traditional security measures often fail to address emerging and sophisticated cyber threats that target critical city systems. Therefore, a proactive and adaptive framework is required to detect, mitigate, and respond to cyber threats in real-time, ensuring the safety and continuity of urban services. The Cybersecurity Threat Detection and Mitigation Framework (CTDMF-SC) is the ultimate solution to all of these issues. The proposed framework operates in two phases. In the first phase, cyber threats are detected using the Smart City Honeypot Integration Framework (SCHIF), which deploys a multi-tiered array of location-based and protocol-aware honeypots across various smart city domains. The honeypots send attack data and logs to the Management Layer. This layer pushes updates to honeypots, configuration changes, and response instructions. The tiered honeypot architecture establishes a multi-stage deception environment, forcing attackers to navigate through successive defensive rings, and ultimately, threats are detected and responded to before they reach the critical infrastructure. In the second phase, the chances of threat occurrence are mitigated through a predictive threat mitigation process, which leverages a hybrid CNN-LSTM model for predictive threat analysis, demonstrating 96.3% detection accuracy in comparative evaluation and outperforming several baseline algorithms. The framework orchestrates automated mitigation responses including firewall rule updates. Automated decoy systems mislead attackers to false targets. Real-time global threat intelligence enables coordinated municipal response across all city departments during cyberattacks and instant security updates deployed across the city infrastructure. The performance of the CTDMF-SC is evaluated across five distinct dimensions: Threat Detection and Mitigation, which exhibit metrics of 96% and 91%, respectively. The system demonstrated a Threat Response time of 15 min and a false-positive rate of 10%. In terms of Threat Categories, there was a 60% reduction in threats associated with Social Engineering and other types. Infrastructure Protection achieves security levels that range from 85% to 100%. The Cost–Benefit Analysis indicated a significant reduction in security losses, coupled with a high Return on Investment (ROI), thereby preventing cyberattacks and ensuring the uninterrupted functioning of critical services.

Since 1980, the arrival of the internet has made fabulous changes, and presently, the Internet of Things (IoT) is having the same track. IoT becomes more attractive due to its potential, but on the other hand, the IoT network is targeted to be demolished. IoT networks are always under the risk of denial of services (DoSs) attacks, which have shocking significance. Under this situation, the need for cybersecurity actions like intrusion detection systems (IDSs) are very much essential. The scope of this article is to propose an IDS for big data architecture. The IoT dataset (BoT‐IoT) was used with libraries of Apache Spark, and experimental work was evaluated on the F1 measure. The dataset was divided into few parts; the partial part of dataset was examined by random forest for binary classification resulted in 98.6% F1 measure. Main categorical phase was resulted in 98.4% and subcategory classification resulted in 84.1% F1 measure. For overall classification of dataset decision tree resulted in 96.4 for binary classification, 78.6 for major category and 74% for categorical classification.