A Severity-Aware Machine Learning Framework for Intrusion Detection and Risk Assessment in IoT Networks

The widespread use of Internet of Things (IoT) devices across critical infrastructure sectors has created extensive and heterogeneous attack surfaces that conventional rule-based security frameworks are structurally unable to address. This paper proposes and evaluates a machine learning-based cybersecurity risk assessment framework for IoT networks using Convolutional Neural Networks (CNNs), Random Forest, Support Vector Machines (SVM), and Autoencoders. Models were trained and validated on a harmonized pool of two publicly available IoT network datasets, TON_IoT and IoTID20, using stratified 5-fold cross-validation within the training partition and an independent held-out test set reserved for the final risk assessment. Empirical results demonstrate that the CNN model achieved the highest vulnerability detection performance across all evaluated metrics: 96.7% accuracy, 95.8% precision, 96.1% recall, and a 95.9% F1-score, outperforming Random Forest (95.1%), SVM (92.3%), and Autoencoder (89.5%). The proposed four-stage risk assessment pipeline, which comprises Data input module, Anomaly detection module, Risk scoring module, and Alert generation module, identified a total of 177 network anomalies within the held-out test set. Notably, 80.2% of these detections (n = 142) fell into the medium- or high-severity categories under a heuristic prioritization scheme, indicating that most CNN-flagged events in the evaluated data warrant analyst attention. This framework provides a proactive defense mechanism, which offers critical implications for deploying adaptive security protocols in heterogeneous IoT ecosystems.