Development of a Hybrid DL-ML IDS for Blackhole Attack Detection in Heterogeneous IoT-EHT Networks

Abstract

The heterogeneous nature of data transmission within the Internet of Things (IoT) demands efficient communication. The IEEE 802.11be standard, known as extremely high throughput (EHT), introduces advanced capabilities that can meet these demands. However, extending IoT into the EHT domain inevitably transfers existing vulnerabilities, exposing IoT–EHT networks to threats that can compromise functionality. A major threat is the blackhole attack, in which a malicious node advertises the best routing path, attracts legitimate traffic, and discards it. To detect this threat within IoT–EHT networks, we propose DML‑IDS, a hybrid intrusion detection system framework that leverages different machine learning and deep learning models. We further introduce a dataset generation method that reflects diverse IoT conditions, capturing both normal and under‑attack performance across three key features: proximity, sensor density, and payload size. These datasets are used to train the framework and to assess the attack severity. The framework is implemented to determine both network‑level and detection‑level results. Simulation outcomes reveal that sensor density and payload size are more reliable indicators of blackhole attack behavior than proximity, underscoring the importance of aligning detection architectures with feature dynamics. Moreover, the findings demonstrate consistently high reliability of ML and DL models, with ML outperforming DL across the features.