Original scientific paper
https://doi.org/10.24138/jcomss-2025-0236
A Novel Hybrid Threat Modeling Framework for IoT Security using STRIDE-DREAD and Machine Learning
Gaurav Thakur
; Central University of Jammu, Bagla (Rahya Suchani), India
*
Pradeep Chouksey
; Central University of Himachal Pradesh, Shahpur Parisar, India
Mayank Chopra
; Central University of Himachal Pradesh, Shahpur Parisar, India
Parveen Sadotra
; Central University of Himachal Pradesh, Shahpur Parisar, India
Neha Thakur
; Central University of Himachal Pradesh, Shahpur Parisar, India
Diksha Sharma
; Central University of Himachal Pradesh, Shahpur Parisar, India
Arpit Koundal
; Central University of Himachal Pradesh, Shahpur Parisar, India
Shaina Mahajan
; Central University of Himachal Pradesh, Shahpur Parisar, India
* Corresponding author.
Abstract
The rapid growth of Internet of Things (IoT)
deployments has increased security risks due to diverse device
vulnerabilities, large scale interconnected environments, and the
heterogeneity of communication protocols. Traditional threat
assessment methods such as STRIDE and DREAD provide a
structured foundation for identifying and categorizing security
risks, yet they lack automated, real-time detection capabilities
required for modern IoT systems that operate in dynamic and
resource-constrained environments. To address these limitations,
this study presents a hybrid threat modeling framework that
integrates machine learning with STRIDE–DREAD to enhance
threat identification, prioritization, and quantitative risk
analysis. An ML-based classifier is trained on the CIC-BCCCNRC
TabularIoTAttack-2024 dataset to detect and categorize
various IoT attack types, with particular emphasis on DDoS
variants due to their high prevalence. Ensemble learning
techniques are applied to pre-processed network traffic, enabling
accurate, scalable, and computationally efficient classification
suitable for deployment on lightweight IoT hardware. The
proposed system achieves 92.5% detection accuracy, surpassing
conventional STRIDE–DREAD assessments by 10–15% while
providing enriched decision support for security analysts.
Overall, the results demonstrate that integrating ML with
established threat modeling methods significantly improves
automation, reduces manual evaluation time, and strengthens the
precision, adaptability, and operational reliability of IoT security
assessment frameworks.
Keywords
IoT Security; Threat Modeling; STRIDE; DREAD; Machine Learning; Risk Assessment
Hrčak ID:
348534
URI
Publication date:
31.3.2026.
Visits: 0 *