Wireless sensor networks have become a vital technology that is extensively applied across multiple industries, including agriculture, industrial operations, and smart cities, as well as residential smart homes and environmental monitoring systems. Security threats emerge in these systems through hidden routing-level attacks such as Wormhole and Sinkhole attacks. The aim of this research was to develop a methodology for detecting security incidents in WSNs by conducting real-time analysis of Wormhole and Sinkhole attacks. Furthermore, the paper proposes a novel detection methodology combined with architectural enhancements to improve network robustness, measured by hop counts, delays, false data ratios, and route integrity. A real-time WSN infrastructure was developed using ZigBee and Global System for Mobile Communications/General Packet Radio Service (GSM/GPRS) technologies. To realistically simulate Wormhole and Sinkhole attack scenarios and conduct evaluations, we developed a modular cyber–physical architecture that supports real-time monitoring, repeatability, and integration of ZigBee- and GSM/GPRS-based attacker nodes. During the experimentation, Wormhole attacks caused the hop count to decrease from 4 to 3, while the average delay increased by 40%, and false sensor readings were introduced in over 30% of cases. Additionally, Sinkhole attacks led to a 27% increase in traffic concentration at the malicious node, disrupting load balancing and route integrity. The proposed multi-stage methodology includes data collection, preprocessing, anomaly detection using the 3-sigma rule, and risk-based decision making. Simulation results demonstrated that the methodology successfully detected route shortening, packet loss, and data manipulation in real time. Thus, the integration of anomaly-based detection with ZigBee and GSM/GPRS enables a timely response to security threats in critical WSN deployments.

The rapid expansion of Internet of Things (IoT) environments has introduced significant security challenges, particularly due to limited labeled data and increasing vulnerability to adversarial attacks. Traditional intrusion detection systems (IDS) struggle to generalize under such constraints, while existing few-shot learning (FSL) approaches remain sensitive to adversarial perturbations. This work proposes a hybrid intrusion detection framework that integrates prototypical few-shot learning with adversarial training to address both data scarcity and robustness. The proposed model employs a Prototypical Network to learn discriminative embeddings from limited samples and incorporates adversarial optimization into the episodic training process to enhance resilience against gradient-based attacks, including FGSM, C&W, DeepFool, and PGD. Experimental evaluation on the IDSIoT2024 dataset demonstrates that the proposed framework achieves high classification performance with only three samples per class, attaining over $$93\%$$ accuracy under benign conditions. In adversarial settings, performance initially degrades significantly but is restored to $$80-90\%$$ accuracy after adversarial training under white-box gradient-based attacks. The results confirm that integrating adversarial training within the few-shot learning paradigm improves both generalization and robustness, making the proposed approach suitable for secure and resource-constrained IoT environments.