  The growing interest in the Internet of Things (IoT) applications is
associated with an augmented volume of security threats. In this vein, the
Intrusion detection systems (IDS) have emerged as a viable solution for the
detection and prevention of malicious activities. Unlike the signature-based
detection approaches, machine learning-based solutions are a promising means
for detecting unknown attacks. However, the machine learning models need to be
accurate enough to reduce the number of false alarms. More importantly, they
need to be trained and evaluated on realistic datasets such that their efficacy
can be validated on real-time deployments. Many solutions proposed in the
literature are reported to have high accuracy but are ineffective in real
applications due to the non-representativity of the dataset used for training
and evaluation of the underlying models. On the other hand, some of the
existing solutions overcome these challenges but yield low accuracy which
hampers their implementation for commercial tools. These solutions are majorly
based on single learners and are therefore directly affected by the intrinsic
limitations of each learning algorithm. The novelty of this paper is to use the
most realistic dataset available for intrusion detection called NSL-KDD, and
combine multiple learners to build ensemble learners that increase the accuracy
of the detection. Furthermore, a deployment architecture in a fog-to-things
environment that employs two levels of classifications is proposed. In such
architecture, the first level performs an anomaly detection which reduces the
latency of the classification substantially, while the second level, executes
attack classifications, enabling precise prevention measures. Finally, the
experimental results demonstrate the effectiveness of the proposed IDS in
comparison with the other state-of-the-arts on the NSL-KDD dataset.
