With the proliferation of IoT-based applications, security requirements are becoming increasingly stringent. Given the diversity of such systems, selecting the most appropriate solutions and technologies to address the challenges is a complex activity. This paper provides an exhaustive evaluation of existing security challenges related to the IoT domain, analysing studies published between 2021 and 2025. This review explores the evolving landscape of IoT security, identifying key focus areas, challenges, and proposed solutions as presented in recent research. Through this analysis, the review categorizes IoT security efforts into six main areas: emerging technologies (35.2% of studies), securing identity management (19.3%), attack detection (17.9%), data management and protection (8.3%), communication and networking (13.8%), and risk management (5.5%). These percentages highlight the research community’s focus and indicate areas requiring further investigation. From leveraging machine learning and blockchain for anomaly detection and real-time threat response to optimising lightweight algorithms for resource-limited devices, researchers propose innovative and adaptive solutions to address emerging threats. The review underscores the integration of advanced technologies to enhance IoT system security, while also highlighting ongoing challenges. The paper concludes with a synthesis of security challenges and threats of each identified category, along with their solutions, aiming to support decision-making during the design approach of IoT-based applications and to guide future research toward comprehensive and efficient IoT frameworks.

With the proliferation of IoT-based applications, security requirements are becoming increasingly stringent. Given the diversity of such systems, choosing the most appropriate solutions and technologies according to the challenges is a complex activity. This paper provides an exhaustive evaluation of existing security challenges related to the IoT domain. This review explores the evolving landscape of IoT security, identifying key focus areas, challenges, and proposed solutions as presented in recent research. The study categorizes IoT security efforts into six main areas: attack detection, data management and protection, securing identity management, communication and networking, emergent technologies, and risk management. Each category reflects the critical vulnerabilities and growing complexities of IoT systems. From leveraging machine learning and blockchain for anomaly detection and real-time threat response to optimizing lightweight algorithms for resource-limited devices, researchers propose innovative and adaptive solutions to meet emerging threats. The review underscores the integration of advanced technologies to enhance IoT system security, while also highlighting ongoing challenges. The paper concludes with a synthesis of security challenges and threats of each identified category together with their solutions, aiming to support decision-making during the designing approach of IoT-based applications and to guide future research toward comprehensive and efficient IoT frameworks.

Classical machine learning (ML) models, including Logistic Regression (LR), Support Vector Machines (SVM), and Random Forests (RF), remain widely used in practical applications due to their efficiency, interpretability, and low computational costs. However, their security properties against different adversarial threats are often evaluated independently rather than within a unified comparative framework. This paper presents a unified empirical evaluation of LR, Linear SVM, and RF models across image (MNIST and CIFAR-10) and text (AG News) classification domains. The models are analyzed under three adversarial scenarios: training-time poisoning, inference-time evasion, and black-box model extraction attacks. The empirical results reveal architecture-dependent security trade-offs: while RF showed higher resistance against random label noise but remained vulnerable to targeted poisoning strategies. In contrast, linear models (LR and Linear SVM) exhibit higher susceptibility to black-box extraction, achieving replication fidelities up to 96.22% under active querying strategies, while showing more predictable performance degradation under the evaluated evasion settings. Furthermore, the study identifies an optimization-related effect in which gradient limitations may contribute to Linear SVM exhibiting higher apparent resistance against iterative attacks compared with single-step perturbations. The evaluation shows that model robustness depends on both the attack type and the underlying architecture. Random Forest achieved lower degradation in some poisoning scenarios, while linear models showed different sensitivity patterns under targeted attacks.

Classical machine learning (ML) models, including Logistic Regression (LR), Support Vector Machines (SVM), Random Forests (RF), and XGBoost, remain widely used in practical applications because of their efficiency, interpretability, and relatively low computational costs. However, their security properties against different adversarial threats are often evaluated independently rather than within a unified comparative framework. This paper presents a unified empirical evaluation of Logistic Regression, Linear SVM, Random Forest, and XGBoost models across image (MNIST and CIFAR-10), text (AG News), and tabular (Adult, Spambase) classification domains. The models are evaluated under three adversarial scenarios: training-time poisoning, inference-time evasion, and black-box model extraction attacks. The empirical results reveal architecture- and attack-dependent security trade-offs. Random Forest demonstrated relatively greater resilience to random label noise in several configurations but remained vulnerable to targeted poisoning, particularly on AG News. In contrast, Logistic Regression and Linear SVM achieved high black-box extraction fidelity under some active-query configurations, reaching 96.08% and 94.02%, respectively, on MNIST with Q = 10,000. Their evasion results were comparatively interpretable under the evaluated attack procedures, although the observed performance depended on the perturbation budget and optimization configuration. In particular, the higher apparent accuracy of Linear SVM under PGD than under FGSM should be interpreted as a configuration-dependent observation rather than evidence of intrinsic robustness or confirmed gradient masking. Overall, the findings indicate that model robustness depends on the interaction between the attack strategy, data representation, and model architecture.