Lightweight and Reliable IoT Intrusion Detection at the Edge: Compression, Calibration, and Shift-Aware Evaluation on CICIoT2023

Abstract

The Internet of Things (IoT) is now used across many connected settings, yet a large number of edge devices and gateways still have limited memory, processing capacity, and energy. Because of this, deployability becomes a central issue in intrusion detection, not something secondary to model accuracy. A detector that performs well in experiments may still be difficult to use in practice if it is too heavy or behaves unreliably at the edge. In this work, we study a lightweight intrusion detection framework using the CICIoT2023 benchmark. The framework includes leakage-aware preprocessing, aligned binary and multiclass labeling, several lightweight supervised models, compression for the neural model, and post hoc confidence calibration. We evaluate it under both a standard in-dataset setting and a more difficult within-dataset shift setting, where selected attack categories where selected attack categories are left out during training. The experiments cover Logistic Regression, Random Forest, LightGBM, and a compact multilayer perceptron, along with INT8 quantization, structured pruning, feature-subset ablation, and threshold-based decision control. In the standard setting, the tree-based models give the strongest overall results, while the compact neural model has the smallest footprint. The results are less reassuring under shift. When some attack families are absent from training, performance drops in a number of cases, most notably for reconnaissance-related traffic, even though the random-split results remain strong. A similar tradeoff appears in the calibration analysis: stricter thresholds reduce false alarms, but they also lower recall for malicious traffic. Overall, the results suggest that IoT intrusion detection should be evaluated with deployment in mind, considering predictive performance, runtime cost, confidence behavior, and robustness to distribution shift together.

Keywords

• IoT security
• Edge intrusion detection
• Lightweight IDS
• Model compression
• Confidence calibration
• Within-dataset shift

References

1. Al Rawajbeh, M., Maria Soosai, A. J., Ramasamy, L. K., & Khan, F. (2025). Trustworthy adaptive AI for real-time intrusion detection in industrial IoT security. IoT, 6(3), Article 53. https://doi.org/10.3390/iot6030053
2. Alandjani, G. (2024). Optimizing malware detection for IoT and edge environments with quantization awareness. IEEE Access, 12, 166776–166791. https://doi.org/10.1109/access.2024.3495635
3. Arcot, S., Masum, M., Kader, M. S., Saha, A., & Chowdhury, M. (2024). TinyML for cybersecurity: Deploying optimized deep learning models for on-device threat detection on resource-constrained devices. In 2024 IEEE International Conference on Big Data (BigData) (pp. 5542–5550). IEEE. https://doi.org/10.1109/bigdata62323.2024.10825955
4. Hasan, T., Hossain, A., Ansari, M. Q., & Syed, T. H. (2025). Enhanced intrusion detection in IIoT networks: A lightweight approach with autoencoder-based feature learning [Preprint]. arXiv. https://doi.org/10.48550/ARXIV.2501.15266
5. Hoang, T.-M., Pham, T.-A., Do, V.-V., Nguyen, V.-N., & Nguyen, M.-H. (2022). A lightweight DNN-based IDS for detecting IoT cyberattacks in edge computing. In 2022 International Conference on Advanced Technologies for Communications (ATC) (pp. 136–140). IEEE. https://doi.org/10.1109/atc55345.2022.9943049
6. Ismail, S., Dandan, S., Dawoud, D. W., & Reza, H. (2024). A comparative study of lightweight machine learning techniques for cyber-attacks detection in blockchain-enabled industrial supply chain. IEEE Access, 12, 102481–102491. https://doi.org/10.1109/access.2024.3432454
7. Katsura, Y., Endo, A., Arai, I., & Fujikawa, K. (2025). Efficient IDS for IoT networks using host-based data aggregation and multi-entropy analysis. IEEE Access, 13, 125406–125419. https://doi.org/10.1109/access.2025.3589057
8. Liu, Z., Thapa, N., Shaver, A., Roy, K., Siddula, M., Yuan, X., & Yu, A. (2021). Using embedded feature selection and CNN for classification on CCD-INID-V1—A new IoT dataset. Sensors, 21(14), Article 4834. https://doi.org/10.3390/s21144834

9. Malik, K., Rehman, F., Maqsood, T., Mustafa, S., Khalid, O., & Akhunzada, A. (2022). Lightweight Internet of Things botnet detection using one-class classification. Sensors, 22(10), Article 3646. https://doi.org/10.3390/s22103646
10. Musthafa, M. B., Huda, S., Nguyen, T. T., Kodera, Y., & Nogami, Y. (2025). Optimized ensemble deep learning for real-time intrusion detection on resource-constrained Raspberry Pi devices. IEEE Access, 13, 113544–113556. https://doi.org/10.1109/access.2025.3584373
11. Neto, E. C. P., Dadkhah, S., Ferreira, R., Zohourian, A., Lu, R., & Ghorbani, A. A. (2023). CICIoT2023: A real-time dataset and benchmark for large-scale attacks in IoT environment. Sensors, 23(13), Article 5941. https://doi.org/10.3390/s23135941
12. Otokwala, U., Petrovski, A., & Kalutarage, H. (2024). Optimized common features selection and deep-autoencoder (OCFSDA) for lightweight intrusion detection in Internet of things. International Journal of Information Security, 23(4), 2559–2581. https://doi.org/10.1007/s10207-024-00855-7
13. Phan, V. A., Jerabek, J., & Malina, L. (2024). Comparison of multiple feature selection techniques for machine learning-based detection of IoT attacks. In Proceedings of the 19th International Conference on Availability, Reliability and Security (ARES 2024) (pp. 1–10). ACM. https://doi.org/10.1145/3664476.3670440
14. Popoola, S. I., Adebisi, B., Hammoudeh, M., Gui, G., & Gacanin, H. (2021). Hybrid deep learning for botnet attack detection in the Internet-of-Things networks. IEEE Internet of Things Journal, 8(6), 4944–4956. https://doi.org/10.1109/jiot.2020.3034156
15. Rawat, R., Rawat, H., & Rawat, A. (2025). Energy-aware detection of threat information propagation speed in social network of things using XGBoost and sequential pattern mining. Discover Computing, 28(1). https://doi.org/10.1007/s10791-025-09741-9
16. Reis, M. J. C. S. (2025). Scalable intrusion detection in IoT networks via property testing and federated edge AI. IEEE Access, 13, 153244–153262. https://doi.org/10.1109/access.2025.3603937
17. Rguibi, A., Younes, A., Ahmed, A., & Lahcen, O. (2025). Hybrid edge-based intrusion detection for IoT using adaptive lightweight SVM with dynamic feature pruning. In 2025 International Conference on Circuit, Systems and Communication (ICCSC) (pp. 1–6). IEEE. https://doi.org/10.1109/iccsc66714.2025.11135296
18. Saheed, Y. K., Abdulganiyu, O. H., & Tchakoucht, T. A. (2024). Modified genetic algorithm and fine-tuned long short-term memory network for intrusion detection in the Internet of Things networks with edge capabilities. Applied Soft Computing, 155, Article 111434. https://doi.org/10.1016/j.asoc.2024.111434
19. Umar, H. G. A., Yasmeen, I., Aoun, M., Mazhar, T., Khan, M. A., Jaghdam, I. H., & Hamam, H. (2025). Energy-efficient deep learning-based intrusion detection system for edge computing: A novel DNN-KDQ model. Journal of Cloud Computing, 14(1). https://doi.org/10.1186/s13677-025-00762-9
20. Wang, Z., Li, J., Yang, S., Luo, X., Li, D., & Mahmoodi, S. (2024). A lightweight IoT intrusion detection model based on improved BERT-of-Theseus. Expert Systems with Applications, 238, Article 122045. https://doi.org/10.1016/j.eswa.2023.122045
21. Wang, Z., Zhou, R., Yang, S., He, D., & Chan, S. (2025). A novel lightweight IoT intrusion detection model based on self-knowledge distillation. IEEE Internet of Things Journal, 12(11), 16912–16930. https://doi.org/10.1109/jiot.2025.3533092
22. Yang, Y.-M., Chang, K.-C., & Luo, J.-N. (2025). Hybrid neural network-based intrusion detection system: Leveraging LightGBM and MobileNetV2 for IoT security. Symmetry, 17(3), Article 314. https://doi.org/10.3390/sym17030314
23. Zang, M., Zheng, C., Koziak, T., Zilberman, N., & Dittmann, L. (2024). Federated in-network machine learning for privacy-preserving IoT traffic analysis. ACM Transactions on Internet Technology, 24(4), 1–24. https://doi.org/10.1145/3696354
24. Zhang, D., Huang, D., Chen, Y., Lin, S., & Li, C. (2025). A lightweight IoT intrusion detection method based on two-stage feature selection and Bayesian optimization. AIMS Electronics and Electrical Engineering, 9(3), 359–389. https://doi.org/10.3934/electreng.2025017