An Explainable Ensemble Feature Selection Framework for Enhanced IoT Edge Attack Detection

A resource efficient IoT intrusion detection model using hybrid feature selection for edge computing

The Internet of Things (IoT) devices have grown at a very fast rate, which has led to escalated security threats. Most of the current IoT oriented lightweight intrusion detection systems do not maintain a high rate of detection performance with heterogeneous and imbalanced traffic, or the expense of increased computation and memory occurs with high detection rate. To resolve this problem, this paper presents a resource efficient IoT attack detection framework called BGL-RID (Boruta-Greedy LightGBM Resource-Efficient IoT Detection). The framework applies a hybrid feature selection pipeline that integrates both Boruta and Greedy Forward Selection (GFS) to remove unnecessary features and only include the most useful features in the pipeline. The Synthetic Minority Oversampling Technique (SMOTE) is used to deal with the issue of class imbalance. Performance is measured based on accuracy and efficiency ratio, which indicates efficiency between quality of detection and resource consumption. The performance of the proposed BGL-RID model has been tested on benchmark, edge collected and IoT specific datasets namely TONIoT, proxy-labeled Raspberry Pi, CICIDS2018, and CICIoT2023. Experimental results demonstrate strong performance across these datasets. For binary and multiclass classifications, BGL-RID attained 99.72% and 98.94% accuracy on TONIoT dataset respectively. It also attained 99.91%, 99.94%, and 98.88% accuracy on the Raspberry Pi, CICIDS2018, and the IoT-specific CICIoT2023 datasets respectively. Besides having high detection rates, the model also achieves the highest efficiency ratio across different datasets, showing that it is robust and scalable, with minimal computation and memory requirements, suggesting its potential suitability for resource-constrained IoT applications.

Enhancing IoT network security with explainable deep learning-based intrusion detection systems.

A lightweight, explainable IDS that combines a 1D-CNN for spatial feature analysis with SHAP for model interpretation, yielding streamlined models that preserve over 93% F1-score and reduce computational overhead by more than 38%, facilitating millisecond-level inference on edge hardware.

An Edge-Based LSTM Approach for Predictive Intrusion Detection in Massive IoT Networks

The Internet of Things (IoT) has become increasingly integrated into our daily lives, offering a wide range of services through the proliferation of connected devices. While this connectivity enhances convenience and functionality, it also introduces significant security challenges, exposing IoT systems to various forms of cyberattacks. In this paper, we propose a lightweight edge-based intrusion detection approach for massive IoT networks, leveraging a Long Short-Term Memory (LSTM) model to achieve high accuracy with minimal resource consumption. Unlike centralized solutions, the proposed system is fully implemented and deployed at the edge level, enabling local traffic analysis directly on edge devices. This design reduces latency, minimizes bandwidth consumption, enhances data privacy, and ensures real-time detection capabilities in large-scale IoT environments. The approach incorporates an efficient data pre-processing methodology applied to the wellknown Avast IoT-23 dataset, resulting in a detection accuracy of 99.9% with a compact model size of only 1767 KB. To further optimize performance, the system decomposes the data into clusters before applying a tailored LSTM model for each subset. Experimental evaluation using real malicious traffic demonstrates that the proposed model achieves up to 90% specificity and 88% precision under real-world conditions. These results confirm the effectiveness of our edge-level LSTM framework in providing secure, scalable, and resource-efficient intrusion detection for large-scale IoT environments.

A Correlation-Based Feature Selection and Weighted XGBoost Framework for Minority IoT Attack Detection

The rapid expansion of Internet of Things (IoT) environments has increased exposure to diverse cyberattacks, while severe class imbalance in network traffic continues to limit the effectiveness of intrusion detection systems (IDS), particularly for rare but security-critical attacks. This study proposes a Correlation-Based Feature Selection (CFS)–Weighted XGBoost framework that combines redundancy-aware feature selection with an embedded class-weighted learning classifier to improve minority-attack detection. The framework was evaluated on an attack-aware sampled subset of the CICIoT2023 dataset containing all 34 attack classes while preserving the original attack-frequency hierarchy. Using only the top 25 selected features, the proposed framework achieved 93.7% accuracy, 87.0% macro-F1, and 93.8% weighted F1, outperforming both full-featured baseline models and the recent Attack-aware Feature Aggregation Model (AFAM) while reducing the feature set by 37.5%. The proposed framework improved detection of minority web-based and reconnaissance attacks while maintaining strong performance on majority attack classes without relying on over-sampling or synthetic data generation. These findings demonstrate that integrating redundancy-aware feature selection with embedded class-weighted learning enables accurate, computationally efficient, and reliable intrusion detection for highly imbalanced IoT environments.

FFICIENT IoT INTRUSION DETECTION USING MUTUAL INFORMATION AND ENSEMBLE MACHINE LEARNING

A Computationally Efficient Ensemble Boosting Framework for Optimized DoS Attack Detection in Wireless Sensor Networks

As Wireless Sensor Networks (WSNs) become more prevalent in modern IoT deployments, Denial of Service (DoS) attacks, which are capable of exhausting node resources and disrupting entire network segments, have emerged as their most significant security threat. In this research, we propose a computationally efficient intrusion detection framework based on the eXtreme Gradient Boosting (XGBoost) model, specifically tailored for energy-constrained environments, and designed for deployment at the cluster-head or gateway levels of WSN architectures. The framework integrates a systematic feature selection process that reduces the initial 19-column curated dataset to an optimal 16-feature subset, addressing correlation and redundancy while maintaining high-fidelity detection. Unlike many existing studies that optimize for accuracy alone, this work uniquely combines four complementary evaluation dimensions: classification accuracy, per-fold stability (standard deviation), ultra-low prediction latency, and adaptive threshold analysis for deployment flexibility. We validated our results through five-fold cross-validation on the WSN-DS dataset. The proposed framework achieved a mean accuracy of 99.74% with an exceptionally low standard deviation of ±0.000174, a prediction latency of 0.0017 ms per sample, and demonstrated a 20× computational efficiency advantage over state-of-the-art ensemble learners like CatBoost, with a compressed model size of 235 KB and an estimated inference cost of 2,550 FLOPs per prediction. The overall outcomes of the study support that the proposed framework provides a resilient, adaptable solution for real-world WSN deployment