Let xt∈Rn represent the data point from an IoT sensor at time t, where n is the number of features (sensors). The data is continuously added to a dynamic dataset, Dt. (1)Dt=Dt−1∪{xt}whereDt={x1,x2,…,xt},xt∈Rnwhere, Dt: The dataset at time t after collecting new data xt, and xt: It is a new data entry from the IoT system.

At each time step t, the raw data xi is transformed into a feature vector Zi∈Rm, where m is the number of features extracted from xi. (2)Zi=ExtractFeatures(xi)for eachxi∈Dt (3)Zi={zi1,zi2,…,zim} whereZi∈Rmwhere, Zi is the feature vector extracted from the raw data point xi.

Let the MLmodels (CNN, LSTM, and RF) be composed of a sequence of operations that process the input feature vector Zi.

Reconstruction Step

The MLModels Reconstructs the feature vector Zi to obtain Zi^, where the reconstruction is learned through the training process. (4)Zi^=MLModels(Zi)whereZi^∈Rm

Anomaly Score Calculation

The anomaly score Si is calculated as the squared Euclidean distance between the original feature vector Zi and its reconstructed version Zi^. (5)Si=∥Zi−Zi^∥2=∑k=1m(zik−z^ik)2where, zik: The kth feature in the original feature vector Zi, and z^ik: The kth feature in the reconstructed feature vector Zi^. If Si exceeds a predefined threshold θ, an alert is generated. (6)Alert(Zi)={GenerateAlert(Zi,Si)ifSi>θwhere, Alert(Zi) is the alert generated for anomaly detection, and θ is the anomaly detection threshold.

Upon generating an alert, the alert is displayed to the user through the UI. The user then classifies the threat UserClass based on the alert. The classification can be represented as a decision function f as; (7)UserClass=f(Alert)where, UserClass∈{Class1,Class2,…,ClassN} represents the threat class identified by the user, and f is a function that processes the alert and outputs a threat class.

The system recommends a mitigation action Action based on the classified threat UserClass. This is represented as a function RecommendMitigation that maps the user class to an appropriate action. (8)Action=RecommendMitigation(UserClass)where, Action is the mitigation action recommended for the identified threat, RecommendMitigation is a decision-making function that assigns the appropriate mitigation strategy based on the classified threat. The action Action is then executed as; (9)ExecuteMitigation(Action)

User feedback Feedback is obtained regarding the alert and mitigation action. If the feedback is valid, it is used to update the machine learning model MLModels.

Let the user feedback be denoted as Feedback∈Rq, where q is the dimensionality of the feedback data. The feedback is processed to adjust the model parameters. (10)Feedback=GetUserFeedback(Alert)

If the feedback is valid, then; (11)UpdateModel(MLModels,Feedback)where, UpdateModel(MLModels,Feedback) is a function that updates the machine learning model MLModels using the collected feedback. Algorithm 1 shows the schematic process of the proposed model.

The Algorithm 1 integrates CNN, CNN-LSTM networks, and Random Forest (RF) models for anomaly detection. The CNN is responsible for extracting spatial features, while the LSTM captures sequential dependencies in the data, and RF performs robust classification based on the features extracted by CNN and LSTM. The hyperparameters used for each model are as follows: for the CNN, the network consists of three convolutional layers with filter sizes [32, 64, 128], a kernel size of (3, 3), and a ReLU activation function. Max pooling is applied with a pool size of (2, 2), and the fully connected layer contains 512 units. A dropout rate of 0.5 and a learning rate of 0.001 are used. For the LSTM, the model includes two layers with 64 hidden units per layer, a tanh activation function, a learning rate of 0.001, a batch size of 64, and a dropout rate of 0.3. The Random Forest model uses 100 trees, a max depth of 10, a minimum sample size of 2 to split nodes, and considers the square root of features when making splits. Following data collection, the system moves into feature extraction, a process essential for reducing dimensionality and extracting meaningful representations from raw data. Suppose a function ϕ:Rn→Rk maps high-dimensional data Xt to a feature space Z(t)=ϕ(X(t)), where k≪n. These features may include statistical measures like mean, standard deviation, entropy, or frequency components, which help capture temporal and spatial dependencies across devices. Subsequently, these features are input into an anomaly detection model, often driven by machine learning or deep learning techniques. One common approach is to use a probabilistic model or an autoencoder that learns the distribution PZ of normal behavior. An anomaly score At can then be computed using the reconstruction error or likelihood, for instance, which is given in Eq. (12) as (12)A(t)=|Z(t)−Z^(t)|2where, Z^(t) is the reconstructed feature from the model. If A(t)>θ for some predefined threshold θ, the event is flagged as anomalous. This detection triggers the alert generation step, producing a warning signal and initiating the mitigation workflow.

Once an alert is triggered, it is routed to a user interface for alert presentation, enabling system administrators or city security personnel to visualize and interact with the event. This interaction is governed by principles of HCI, where the system’s transparency, interpretability, and responsiveness are paramount. The system presents the anomaly and contextual metadata such as timestamp, device ID, anomaly score, and probable cause. Using domain knowledge and interface support, the human operator performs threat classification, analyzing the alert to determine whether it represents a benign irregularity or a serious cyber threat such as a DDoS attack, intrusion, or sensor spoofing. Formally, a threat classifier f:Rk{0,1,…,C} may be used to assist the human in labeling the anomaly into one of C known threat classes. Based on this classification, the operator selects or confirms a mitigation strategy, including automatic responses (e.g., IP blocking, data routing adjustments) or manual interventions (e.g., dispatching field teams, disabling components). A critical part of this framework is the feedback loop via Human-Computer Interaction, where the user can provide validation (confirm or reject alerts), improving the model over time. This loop enables a semi-supervised learning mechanism, where human feedback is used. yt∈{0,1} is used to retrain or fine-tune the anomaly detection model, minimizing future false positives and negatives. This can be formulated as an online learning problem, and is given in Eq. (13) as (13)minθ∑tL(fθ(Z(t)),yt)where, L is the loss function and θ are model parameters updated over time using user interaction data. The proposed framework integrates smart city data flows with intelligent anomaly detection and human-centered decision-making. It combines real-time analytics, machine intelligence, and intuitive interaction design to ensure timely and accurate mitigation of security attacks, balancing automation with human oversight in a dynamic urban environment. Fig. 4 illustrates the proposed model’s framework.

Each model in the system (CNN, CNN-LSTM, and RF) contributes uniquely to the overall anomaly detection and mitigation process in the smart city framework. The CNN focuses on spatial feature extraction, the CNN-LSTM captures sequential dependencies, and the RF aggregates predictions for a robust decision-making process. At each time step, the datasets are updated by appending the new sensor reading, allowing them to grow as new data points are continuously collected. Each new data point is then transformed into a structured feature vector, which helps capture the essential characteristics of the IoT sensor readings. The system computes the anomaly score to detect anomalies by measuring the Euclidean squared distance between the original and reconstructed feature vectors. An alert is triggered if the anomaly score exceeds a predefined threshold, indicating a detected anomaly. When the anomaly score surpasses the threshold, the system generates an alert and activates the HCI interface to notify the user. Based on the alert, the user classifies the threat into predefined categories, with the classification label output by a function. The recommended mitigation action is then determined based on the user’s classification, and the action is executed to address the detected anomaly or threat. After mitigation, user feedback is collected, which is then used to update the machine learning models (CNN, CNN-LSTM, and RF). This feedback loop ensures the model improves over time based on real-world interactions, continuously enhancing the system’s performance.

ROC and PR curves evaluated the quality of classification at varying thresholds. HCI-Integrated performed AUC-ROC = 0.99, higher than Baseline ML (AUC = 0.92) and Traditional IDS (AUC = 0.87). A PR curve reflected a high precision for most recall values in HCI-Integrated, with a good discrimination in unbalanced data. These outcomes signify the higher quality of HCI-Integrated in proper classification with low false negatives and positives.

A detailed examination of the confusion matrices highlights that the classification outcomes for each model are discussed as follows. HCI-Integrated: 491 True Positives (TP), 19 False Negatives (FN), 456 True Negatives (TN), 34 False Positives (FP), Baseline ML: 442 TP, 68 FN, 403 TN, 87 FP, and Traditional IDS: 396 TP, 114 FN, 387 TN, 103 FP. The HCI-Integrated system demonstrated the lowest false negative and false positive rates, translating to a higher detection rate and fewer erroneous alerts. This balance is critical for minimizing security risks while maintaining operational efficiency.

Detection speed is a crucial metric in real-time intrusion detection. A box plot comparison of detection times reveals that HCI-Integrated had the fastest median detection time (~1.5 s), with minimal variance, and Baseline ML recorded a median of ~2.6 s. Traditional IDS was the slowest, with a median above 3 s and higher variability. The HCI-Integrated model’s ability to deliver rapid and consistent detection significantly enhances its practicality for deployment in dynamic, high-throughput environments.

Across key evaluation metrics, the HCI-Integrated model consistently outperformed the other approaches;

In the comparative evaluation of the HCI-Integrated IDS against the Baseline ML model and Traditional IDS, a multidimensional performance analysis was conducted across latency, accuracy, usability, cost-efficiency, and resource consumption. The HCI-Integrated model consistently demonstrated superior performance across nearly all evaluated metrics, supporting its potential as a robust advancement in IDS technologies. Fig. 5 shows evaluation of accuracy, recall, precision, and false positive, Fig. 6 shows a confusion matrix, Fig. 7 shows detection speed in terms of time (s), Fig. 8 illustrates a curve of false positive and recall, while Table 2 presents performance evaluations in numeric illustrations.

The histogram and Kernel Density Estimation (KDE) plots clearly show that the HCI-Integrated system outperforms Baseline ML and Traditional IDS in terms of detection speed. The detection time for HCI-Integrated clusters is between 1.2 and 1.7 s, with a pronounced peak at approximately 1.5 s, indicating a highly consistent and rapid response. In contrast, the Baseline ML exhibits a broader distribution centered around 2.6 s, while Traditional IDS lags further with a peak near 3.3 s. The KDE plot reaffirms this performance gap, highlighting not only the faster but also more predictable latency of the HCI-Integrated model. Fig. 9 shows the Detection Time Distribution of HCI-Integrated IDS (Proposed), Fig. 10 illustrates the Detection Time Distribution of Baseline IDS, and Fig. 11 shows the Detection Time Distribution of Traditional IDS.

The exhaustive longitudinal analysis that carefully explores detection accuracy at different time steps demonstrates that the HCI-Integrated model invariably has a significantly higher accuracy. The model displays a credible mean accuracy that oscillates between a value of nearly 0.94 and as high as 0.95. In stark contrast, the Baseline ML model also demonstrates notable fluctuations in performance, with a mean accuracy that hovers closely around the value of nearly 0.90. Alternatively, the Traditional IDS model is static in a low mean accuracy, oscillating closely at almost 0.86. The unflinching stability revealed in the performance of the HCI-Integrated model over time denotes the presence of a strong learning mechanism. The mechanism adapts and learns in the constantly varying threat environments it is subjected to. Fig. 12 shows the Accuracy Evolution Evaluation over Time.

Amidst the intricate and multidimensional background of different categories of threats, including Denial of Service (DoS) attacks, Probe activities, Remote to Local (R2L) incursions, User to Root (U2R) breaches, as well as what is commonly categorized as Normal traffic, the HCI-Integrated Intrusion Detection System (IDS) presents a staggering capability that dramatically improves detection accuracy compared to its industry equivalents. It exhibits a phenomenally high degree of near-perfect accuracy, ranging between 0.97 and 0.98 for DoS and Normal traffic categories, respectively. In addition, this novel system depicts a remarkable edge over other current detection systems in terms of detecting more intricate and subtle types of attacks, especially those falling under the U2R and R2L categories. These phenomenal findings strongly indicate that the HCI approach surpasses others in successfully identifying high-volume attack patterns. However, it also demonstrates its effectiveness in uncovering more subtle, targeted intrusions, which have historically been challenging to detect and properly regulate. Fig. 13 illustrates the KDE Evaluation of Detection Latency, and Fig. 14 shows Threat Categories vs. Detection Accuracy.

To calculate the Confidence Intervals (CIs) for the detection accuracy of each IDS method (HCI-Integrated, Baseline ML, and Traditional IDS) across various threat categories (DoS, Probe, R2L, U2R, and Normal), several assumptions were made based on typical experimental setups. SampleSize(n): A sample size of 30 was assumed, which is commonly used in experimental setups to ensure sufficient statistical power. StandardDeviation(σ): The standard deviation was supposed to be 0.05, a reasonable value in classification accuracy experiments across datasets. Z−value: A Z-value of 1.96 was used for the 95% confidence level, which is standard for statistical confidence interval calculations. The CI is calculated using Eq. (14) as; (14)CI=mean±Z×σnwhere, mean is the detection accuracy for each method, Z is the Z-value for a 95% confidence level, 1.96, σ is the standard deviation, assumed to be 0.05, and n is the sample size, supposed to be 30. The calculation of CIs for each threat category is given below. DoS: HCI-Integrated: 0.97 ± 0.018 → [0.952, 0.988], Baseline ML: 0.85 ± 0.018 → [0.832, 0.868], and Traditional IDS: 0.75 ± 0.018 → [0.732, 0.768]. Probe: HCI-Integrated: 0.95 ± 0.018 → [0.932, 0.968], Baseline ML: 0.85 ± 0.018 → [0.832, 0.868], and Traditional IDS: 0.70 ± 0.018 → [0.682, 0.718]. R2L: HCI-Integrated: 0.90 ± 0.018 → [0.882, 0.918], Baseline ML: 0.80 ± 0.018 → [0.782, 0.818], and Traditional IDS: 0.70 ± 0.018 → [0.682, 0.718]. U2R: HCI-Integrated: 0.92 ± 0.018 → [0.902, 0.938], Baseline ML: 0.75 ± 0.018 → [0.732, 0.768], and Traditional IDS: 0.65 ± 0.018 → [0.632, 0.668]. Normal Traffic: HCI-Integrated: 0.98 ± 0.018 → [0.962, 0.998], Baseline ML: 0.90 ± 0.018 → [0.882, 0.918], and Traditional IDS: 0.80 ± 0.018 → [0.782, 0.818]. These results indicate the confidence intervals for each detection method across different categories. The HCI-Integrated IDS system consistently shows the highest detection accuracy with the narrowest confidence intervals, indicating strong and reliable performance, especially in identifying high-volume and subtle attack patterns. In contrast, the Traditional IDS exhibits lower detection accuracy and wider confidence intervals, highlighting its comparatively less effective performance in the same categories. By estimating these confidence intervals, we can quantitatively understand the precision of each method’s detection accuracy across different threat categories. Fig. 15 shows Confusion matrix.

The in-depth and comprehensive explanation of Type I errors, popularly known as false positives and those known by simpler terminology as false negatives, clearly highlights another prime strength that is inherently built into the HCI-Integrated system. This very advanced and cutting-edge system has the incredible advantage of detecting and recording the absolute minimum number of error occurrences in both critical dimensions, which, in return, amazingly relieves the working burden commonly linked with false alarms. Additionally, it reduces the risk potential for allowing the threats to escape detection and thus remain unnoticed, making the entire environment much safer for everyone participating in the activities. On the contrary, the Traditional IDS falls victim to a prohibitively excessive proportion of Type II errors, which ironically highlights its built-in weaknesses in detecting danger in a timely and efficient manner, consistently and reliably. Fig. 16 shows the Error Evaluation of Type I and Type II FP and FN.

When one considers the many facets of operational expenses, including the costs of correct detection and the issue of alert fatigue, it is apparent that the HCI-Integrated model offers the most favorable balance in this context. This specific model has the lowest overall cumulative costs, a consideration in which the very low rate of false positives is a major contributing factor, and one that directly mitigates analyst fatigue. Conversely, the Traditional Intrusion Detection System, commonly abbreviated as IDS, has the highest operational expenses, a reality in which the frequency of false positives and the inefficiencies intrinsic to its threat detection are contributing factors. Fig. 17 shows the Analysis and Evaluation of Cost-Benefit.

The radar chart representing the usability feedback from users clearly shows that the HCI-Integrated system is the highest rated on all dimensions measured, particularly in areas relating to ease of use, understandability of alerts, and confidence levels reported by analysts using the system. This high ranking is precisely in line with its underlying design philosophy, which is HCI-centered. The prioritization of HCI in its design ensures that the model is not just computationally highly efficient but also seamlessly fits into the decision-making workflows used by human operators. Consequently, this careful integration considerably adds to the practical value and effectiveness for security teams that use these systems. The usability evaluation involved simulated users modeled after cybersecurity analysts and IT professionals typically responsible for monitoring intrusion detection systems. These users were modeled based on standard smart cities & industry profiles, with varying experience in dealing with IDS alerts. Each simulated user interacted with the system under different scenarios, including high-traffic periods and complex attack patterns, representing the variety of real-world smart city environments. The feedback was anonymously collected and analyzed using statistical methods to gauge the system’s performance. The primary focus of the analysis was to determine how well the system reduced alert fatigue and enhanced decision-making clarity, which are crucial for real-world operational environments. The results of this analysis are presented in Fig. 18, demonstrating that the HCI-Integrated IDS performed well across all metrics, especially in areas like ease of use, clarity of alerts, and the overall confidence users had in the system’s suggestions. These results underscore the system’s user-centered design approach, which is key to improving usability and mitigating analyst fatigue.

Despite its remarkable and strong performance, the HCI-Integrated system surpasses and stands as the most efficient alternative when considering computational resources. This cutting-edge system requires the least training time and memory in the critical model development phase, which is a great boon. It also consistently has the lowest CPU, memory, and energy consumption levels throughout its operation phase, highlighting its efficiency. In stark contrast, the Traditional IDS has a very different profile, as it requires the highest resource usage levels for all the observed metrics. Such high usage only enhances its operational inefficiency, rendering it a less desirable alternative. Fig. 19 illustrates the Evaluation of System Resource Utilization regarding MBs, GBs, time, and Energy. Continuing the holistic assessment of the HCI-Integrated Intrusion Detection System, the supplementary experimental findings help further strengthen its outstanding superiority on several important fronts, such as contextual alert management, real-time threat analysis, classification integrity, and operational scalability. Each of these facets is vitally important to the real-world application of these systems in dynamic and high-load environments, being able to cope with the demands imposed by such scenarios.

The alert context frequency graph offers a clear and revealing insight into the HCI-Integrated system’s added functionality and, more importantly, its advanced contextual differentiation capacity. It is particularly interesting to note that this system raises the most alerts for Network Scans and Unauthorized Access incidents, which are generally acknowledged as early warning signs or precursors of possible reconnaissance activity and intrusion attempts at security compromise. In rather stark contrast, the Traditional IDS appears to have a tendency or a bias for detecting and alerting on instances of Malware Activity and Normal Traffic. This tendency typically results in a high rate of false positives, undermining effective security monitoring and response. In addition, the behavior of the HCI-Integrated system is in perfect agreement with the previously noted reduced Type I error rates, which further supports its competence in contextual discernment as well as accuracy of prioritization. Fig. 20 shows the Frequency Evaluation of Alert Context.

The graph demonstrating the correlation between Time-to-Detect and Threat Severity displays a characteristically linear relationship across all models under examination. That said, it is apparent that the HCI-Integrated system has a notable and evident performance benefit over the others. In the case of critical threats, the HCI-Integrated model impressively detects threats within a striking time frame of around 2.0 s. Conversely, the Baseline Machine Learning model and the Traditional Intrusion Detection System have longer detection times, taking roughly 3.4 and 4.5 s to detect threats. This kind of quick responsiveness that the HCI-Integrated model provides is critical to successfully reducing potential harm in situations with especially high stakes. It also speaks to the operational significance and value of implementing HCI-focused optimization techniques within real-time security systems to improve their general efficacy and reliability. Fig. 21 illustrates Time to Detect vs. Thread Severity Evaluation.

For prioritization, HCI-Integrated more frequently categorizes alerts as “Urgent” and “High”, with fewer low-priority alerts. This distribution pattern indicates better triage intelligence, directing analysts to focus on the most impactful threats. Classical IDS has a relatively flat distribution across priority levels, undermining the urgency signal and compounding alert fatigue. Fig. 22 shows Alert Prioritization Distribution Evaluation.

System throughput at increasing concurrency indicates the HCI-Integrated solution’s scalability. At 800 concurrent connections, the system retains more than 900 requests/s, far exceeding Baseline ML (~760) and Traditional IDS (~650). This establishes the HCI-Integrated framework’s architectural effectiveness and real-time processing capability, making it useful in enterprise-level and high-demand scenarios. Fig. 23 shows System Throughput Evaluation Under Load.

Comparative performance using F1 Score and Matthews Correlation Coefficient (MCC) further cements the dominance of the HCI-Integrated system. With an F1 score of around 0.94 and MCC of about 0.92, the model easily surpasses Baseline ML (F1 ~0.89, MCC ~0.82) and Traditional IDS (F1 ~0.82, MCC ~0.75). These metrics provide for balanced precision and recall, which is paramount in adversarial threat landscapes where detection effectiveness cannot be gained at the cost of high false positives. Fig. 24 shows the F1-score and MCC Evaluation.

A detailed examination of classification error distribution concerning attack classes (Normal, DoS, Probe, R2L, U2R) indicates that HCI-Integrated has consistently low error rates even for low-frequency and hard-to-detect attacks like U2R and R2L. This is compared to the sharp error gradient seen with Traditional IDS, which is poor, especially with sophisticated and stealthy intrusions. The Baseline ML model, though reasonably good, still lags in reliability and stability. Fig. 25 shows the Classification Error Distribution per Attack Class.

Detection rates across the four primary attack classes, DoS, Probe, R2L, and U2R, show the HCI-Integrated model nearing or exceeding 0.90. This consistent performance indicates comprehensive threat coverage, whereas both Baseline ML and Traditional IDS demonstrate a decline in detection rates as attack complexity increases. The radar plot visually reaffirms this trend, where HCI-Integrated traces the most uniform and outward-reaching profile, indicating a more balanced and effective detection strategy. Fig. 26 shows Threat Detection Rate by Attack Category, and Fig. 27 illustrates Detection Rates by Attack Category.

Fig. 28 shows the testing and training of the three major datasets, while Fig. 29 shows their comparative evaluations. These long-term results highlight the HCI-Integrated IDS’s maturity of operations and strategic advantage on technical and human-centered performance dimensions. By optimizing alert context interpretation, reducing time-to-detect, effectively prioritizing, scaling under load, and maintaining classification integrity, the system resolves the critical conditions for deployment within contemporary cybersecurity architectures. The cumulative evidence validates the HCI-Integrated model as a technological advancement and a paradigm-shifting approach to intrusion detection design. The evidence collectively and vehemently supports the assertion that the HCI-Integrated IDS represents a substantial enhancement over conventional IDS solutions. It offers faster and more accurate detections, lowers operational costs, enhances user experience, and conserves computational resources. These multi-faceted advantages validate the value of integrating human-centered design principles and modern machine learning techniques in the design of intelligent security systems. The HCI-Integrated system ranked the highest in every category, demonstrating its overall superiority in intrusion detection, efficiency, and accuracy. The reduced false positive rate is particularly significant, lowering the cognitive burden on security analysts and averting alert fatigue. The experimental results demonstrate the HCI-Integrated IDS’s substantial improvement over traditional rule-based systems and standard machine learning techniques. Its better accuracy, precision, recall, and low false positive rate, coupled with quick detection time, demonstrate its viability as a next-generation IDS solution. Integrating HCI concepts renders the system more usable and facilitates intelligent and effective anomaly detection. This performance confirms the potential of HCI-based approaches to cybersecurity, particularly in configurations requiring real-time threat detection and high decision reliability.