Replication Study Confirms LSTM Networks for IoT Intrusion Detection

Internet of Things devices have multiplied across homes and industries, and with that expansion has come a widening surface for attack. A new study in Cluster Computing revisits one of the most studied defenses against this threat: the use of Long Short-Term Memory networks, a form of recurrent neural network, to spot abnormal behavior in network traffic before it becomes a breach.

The paper, authored by Paula Denisa Maris and Andreea Vescan, is unusual in that it sets out to do two things at once. First, it replicates an earlier study on an intrusion detection system designed to recognize abnormal behavior occurring in a network. Second, it extends that work with new experiments that the original research did not include.

In this case, the replication succeeded. The authors report that their results corroborated the main findings of the original study, demonstrating that the proposed LSTM architecture maintains high intrusion detection performance in an independent implementation. That consistency matters, because it suggests the approach is not an artifact of one research group’s code or configuration.

The extension half of the study tackled a question that often goes unexamined: how much do the settings of a deep learning model actually matter? The researchers applied hyperparameter optimization using Taguchi designs, a statistical method borrowed from industrial engineering that allows many factors to be tested efficiently in a small number of experimental runs. They used two variants, labeled L4 and L9, to examine parameters including the number of layers, the number of hidden neurons, the number of training epochs, and the batch size.

The outcome differed sharply between the two datasets the team worked with. For the Bot-IoT dataset, the Taguchi experiments showed that none of the investigated parameters had a major influence on performance. For the UNSW-NB15 dataset, by contrast, the best results were obtained with the L4 and L9 configurations, and the authors found that the number of layers and the number of hidden neurons significantly impact the model’s efficiency.

That asymmetry is itself informative. It suggests that the sensitivity of an LSTM-based intrusion detector to its own architecture cannot be assumed in advance; it depends on the character of the traffic data being analyzed.

The study also compared models statistically rather than relying on single-point accuracy figures alone. Using the Wilcoxon Signed Rank Test, a non-parametric statistical test, the authors examined sixteen combinations of models. These combinations varied along three axes: whether all features or a reduced set of fourteen features were used, whether the Bot-IoT or UNSW-NB15 dataset was involved, and whether the Adam or SGD optimizer was used for training.

The statistical tests showed that there is a statistical difference between the models across these combinations. In other words, the choices of feature set, dataset, and optimizer were not interchangeable; they produced measurably different detection performance.

The broader significance of the work lies in its method as much as its results. The authors note that IoT devices proliferate across homes and industries, and that the evolving landscape introduces unique security vulnerabilities that must be addressed to protect sensitive data and infrastructure. A replicated, statistically tested foundation for LSTM-based detection is a modest but concrete contribution to that effort.

Subject of Research: Replication and extension of LSTM-based intrusion detection for Internet of Things networks using Taguchi hyperparameter optimization and statistical comparison.

Article Title: Intrusion detection in the internet of things. A replication and extension study

Article References: Maris, P. D., & Vescan, A. (2026). Intrusion detection in the internet of things. A replication and extension study. Cluster Computing, 29(16), Article 901. https://doi.org/10.1007/s10586-026-06719-0

Image Credits: AI Generated

DOI: 10.1007/s10586-026-06719-0

Keywords: intrusion detection, Internet of Things, LSTM, replication study, hyperparameter optimization, Taguchi design, Wilcoxon Signed Rank Test, Bot-IoT dataset, UNSW-NB15 dataset, network security, machine learning, Cluster Computing