With the rapid advancements in deep learning, IoT intrusion detection systems have increasingly adopted deep learning models as the state-of-the-art solution due to their ability to handle complex data patterns. However, these solutions introduce the risk of overengineering, in which the complexity of the model outweighs its practical benefits. In contrast, classical machine learning techniques offer a more efficient alternative but are often overlooked due to a lack of focus on data pre-processing, which is critical for achieving optimal performance. Here we propose a classical machine learning system, built around a Random Forest classifier paired with a novel feature extraction algorithm adapted from Explainable Boosted Linear Regression (EBLR). Our workflow emphasizes the importance of well-structured preprocessing pipelines missing data handling, categorical feature encoding, and multicollinearity reduction, paired with classical machine learning models. We evaluated our method on the ToN-IoT dataset, which contains various network traffic data sets and various types of attacks. Experimental results show that our model achieves an area under the curve (AUC) score of 0.99 on both training and test sets with high performance in a variety of attack categories. Finally, we show that our method outperforms existing deep learning models, thus providing a novel and effective solution for intrusion detection in IoT environments. Experimental results show that our model achieves an area under the curve (AUC) score of 0.99 in both the training and test sets. Furthermore, the classifier achieves precision, recall and F1 score values of 0.999, 0.988, and 0.994, respectively, for normal traffic detection, while maintaining strong performance for other attack categories, such as denial of service (precision: 0.985, recall: 0.977, F1 score: 0.981) and scanning (precision: 0.984, recall: 0.992, F1 score: 0.988). Injection and ransomware attack types also demonstrate precision and recall scores above 0.90. These results highlight that, when paired with appropriate preprocessing and feature engineering, classical machine learning models still can provide an effective solution for intrusion detection in IoT environments.

Motivation: Technical errors in sequencing or bioinformatics steps and difficulties in alignment at some genomic sites result in false positive (FP) variants. Filtering based on quality metrics is a common method for detecting FP variants, but setting thresholds to reduce FP rates may reduce the number of true positive variants by overlooking the more complex relationships between features. The goal of this study is to develop a machine learning-based model for identifying FPs that integrates quality metrics with genomic features and with the feature interpretability property to provide insights into model results. Results: We propose a random forest-based model that utilizes genomic features to improve identification of FPs. Further examination of the features shows that the newly introduced features have an important impact on the prediction of variants misclassified by VEF, GATK-CNN, and GARFIELD, recently introduced FP detection systems. We applied cost-sensitive training to avoid errors in misclassification of true variants and developed a model that provides a robust mechanism against misclassification of true variants while increasing the prediction rate of FP variants. This model can be easily re-trained when factors such as experimental protocols might alter the FP distribution. In addition, it has an interpretability mechanism that allows users to understand the impact of features on the model’s predictions. Availability and implementation: The software implementation can be found at https://github.com/ideateknoloji/FPDetect.

The rapid expansion of Internet of Things (IoT) technologies has highlighted the need for reliable intrusion detection systems (IDSs), yet the majority of existing studies rely on single-dataset evaluations, raising concerns about their real-world generalisation capability. This study addresses this limitation by systematically investigating distributional shift across heterogeneous IoT intrusion detection datasets and their impact on model behaviour. To achieve this, a unified feature space is constructed using BoT-IoT, ToN-IoT, and UNSW-NB15 datasets, followed by a comprehensive preprocessing pipeline including attack class alignment, distribution-preserving sampling for class imbalance, and feature selection based on cross-dataset feature value propagation analysis. Furthermore, feature-specific transformations and correlation-based dimensionality reduction are applied to enhance statistical consistency and model stability. To simulate realistic deployment scenarios, models are trained on combinations of datasets and evaluated on unseen datasets. The results reveal that distributional inconsistencies and dataset-specific feature biases significantly degrade cross-dataset performance, despite strong within-dataset results. The proposed framework provides a systematic understanding of feature-level behaviour across datasets, identifying both stable and bias-prone features. These findings highlight the necessity of distribution-aware preprocessing and feature analysis for developing robust and generalisable IoT intrusion detection systems.

Imbalanced class distributions in Internet of Things (IoT) attack datasets limit the ability of machine learning (ML) models to detect minority intrusions and lead to high false-negative rates. This study investigates the effectiveness of the Synthetic Minority Oversampling Technique (SMOTE) in improving multi-class attack detection across seven IoT devices from the TON_IoT dataset. Four ML algorithms —K-Nearest Neighbor, Support Vector Machine, Logistic Regression, and Multi-Layer Perceptron— are evaluated both with and without SMOTE using accuracy, precision, recall, and F1-score. Results show that SMOTE substantially improves minority-class detection, particularly in devices with severe imbalance. On the Garage Door dataset, KNN accuracy increases from 0.952 to 0.982, and MLP from 0.555 to 0.978, while SVM exhibites modest gains. The largest recall improvement is observed for Modbus with KNN, rising from 0.52 to 0.84. Overall, SMOTE enhances IoT intrusion detection without degrading majority-class performance, although its impact varies across algorithms and device characteristics. Future research is planned to explore hybrid resampling and deep learning-based approaches to further improved detection under extreme imbalance.