A lightweight, explainable IDS that combines a 1D-CNN for spatial feature analysis with SHAP for model interpretation, yielding streamlined models that preserve over 93% F1-score and reduce computational overhead by more than 38%, facilitating millisecond-level inference on edge hardware.
Abstract
Deploying effective intrusion detection systems on low-power IoT devices requires a careful balance of performance, efficiency, and transparency. Current neural-network-based solutions are often too resource-intensive and opaque for practical edge use. We introduce a lightweight, explainable IDS that combines a 1D-CNN for spatial feature analysis with SHAP for model interpretation. To the best of our knowledge, this work presents the first comparative analysis of a SHAP-augmented 1D-CNN against traditional CNN and LSTM models for IoT intrusion detection. Our method outperforms these benchmarks on real-world datasets (UNSW-NB15 and WUSTL-IIoT-2021). Crucially, SHAP analysis enables feature reduction, yielding streamlined models that preserve over 93% F1-score and reduce computational overhead by more than 38%, facilitating millisecond-level inference on edge hardware. These results demonstrate a viable path for reconciling high detection accuracy with the stringent resource limitations of IoT environments.
Resource-constrained Internet of Things (IoT) environments require intrusion detection systems (IDS) that provide high detection performance while maintaining low computational overhead. Although deep learning models have demonstrated strong predictive capability, their computational complexity often limits deployment on edge gateways with restricted memory, processing power, and energy budgets. Conversely, lightweight machine learning models are computationally efficient but may struggle with difficult or ambiguous attack patterns. To ad-dress this trade-off, this paper proposes a confidence-based hybrid Light Gradient Boosting Machine (LightGBM) and Convolutional Neural Network (CNN) framework that selectively routes low-confidence predictions generated by LightGBM to a lightweight CNN for further analysis. The proposed approach was evaluated using the UNSW-NB15 multi-class intrusion detection dataset under a Central Processing Unit (CPU)-only execution environment. Experimental results show that the hybrid model achieved the highest classification accuracy of 85.85%, outperforming standalone LightGBM (83.75%), Random Forest (RF) (80.72%), and CNN (80.15%). The proposed framework also achieved the highest macro precision of 77.29% while maintaining a compact model size of approximately 17 MB through selective inference. Threshold analysis further demonstrates that the confidence threshold effectively controls the trade-off between predictive performance and computational cost by adjusting the proportion of samples processed by the CNN. These findings indicate that confidence-based selective inference provides a practical and resource-efficient solution for deploying hybrid IDS in edge-based IoT environments while maintaining competitive detection performance.
Darius Felix Lummawie, Rojali, M. E. Syahputra· International Conference on...· 0 citations
In the fast-growing world of Internet of Things (IoT), devices have exploded that are not only efficient but also expose serious security vulnerabilities that can be used as vectors for more advanced cyber-attacks. Traditional IDS has the challenge of false positive rate, which could cause critical operations to be disrupted in various domains from smart medical devices (SMDs) to municipal infrastructure. Machine Learning (ML) and Deep Learning (DL) models are state-of-the art solutions to detect complex, high-dimensional and temporal network anomalies in terms of accuracy but their deployment is still hampered severely due to the fact that they lack interpretability. This paper introduces a new explainable hybrid IDS architecture for IoT environments named XABiL-IDS (Explainable Attention-based Bi LSTM-Intrusion Detection System) in response to this challenge. This study uses a robust hybrid architecture to detect attacks effectively. Global analysis using the SHAP method for determining the most relevant traffic attributes affecting the classification process in the dataset on the other hand local analysis done by LIME for providing explanation at the instance level on the prediction made regarding network flows. The key differentiating feature of this approach compared to earlier methods is the incorporation of both global and local explainability in single pipeline.
Ravi Patni, Gurvinder Singh· International journal of com...· 0 citations
The rapid growth of IoT-enabled technologies and interconnected smart devices has significantly increased security risks associated with poorly protected and resource-constrained IoT environments. Efficient anomaly detection mechanisms can help mitigate these threats by analyzing network traffic and identifying abnormal activities. However, such mechanisms must also preserve user privacy and maintain scalability for deployment on low-power edge devices. This paper presents
XP-IDS
: a hybrid deep gradient boosting framework for intrusion detection in IoT networks. Using the
CIC IoT-DIAD 2024
dataset,
XP-IDS
learns from three categories of handcrafted features: (i) strategic-based features that capture high-level protocol semantics and flow behavior, (ii) time-based features that represent sequential relationships and traffic evolution over time, and (iii) IP-based features that characterize packet-flow communication among IoT endpoints. Feature representations extracted through stacked Convolutional Neural Networks are subsequently forwarded to an Extreme Gradient Boosting classifier for final prediction. In addition, SHapley Additive exPlanation (SHAP) is utilized to provide interpretability for model decisions and to identify overall feature importance, thereby enhancing transparency and privacy-aware analysis. Extensive experimental evaluation demonstrates that the proposed framework achieves strong detection accuracy across several common attack categories while outperforming multiple baseline approaches. The proposed accurate and interpretable framework shows strong potential as an edge-deployable security solution for safeguarding IoT devices and improving cyber resilience.
Prabhav Jain, Aashima Sharma, A. Noonia et al.· Scientific Reports· 0 citations
The growth of Internet of Things devices has expanded the number of attackable targets of advanced cyber threats by orders of magnitude, and the limited computational capabilities of IoT devices have made more traditional intrusion detection systems infeasible to execute at the edge. A Knowledge-Distilled Multi-Model Intrusion Detection and Prevention System is presented, which combines a Residual Graph Convolutional Network, Long Short-Term Memory classifier, and a Conditional Tabular Generative Adversarial Network enhanced with the student-only autoencoders through multi-loss knowledge distillation to create a high-performing Teacher ensemble and compresses its intelligence into an edge-deployed system. The system is evaluated using the IoT-23 benchmark of 325 million network flow records and attains 98.2% Teacher-Student fidelity, 0.94 Knowledge Retention Score, and 4.4x throughput increase with 82.7% reduction in the parameter and provides per-packet SHapely Additive exPlanation forensic explainability.
S. K, Menaka T K, N. R· 2026 4th International Confe...· 0 citations
Traditional rule-based intrusion detection systems generally fail in identifying unknown or evolving threats; thus, automated and adaptive kinds of methods are crucial. Deep learning models provide promising solutions, but many recent studies depend on hybrid architecture, which increase the computational cost and reduce deploying ability on real-time or resource-limited systems. In this paper, we present and test a standalone LSTM model for multiclass cyberattack detection based on a CIC_IoT_Dataset2023, a recent labeled dataset that mirrors the actual network environment containing 33 attack categories. The dataset was extremely imbalanced as benign traffic accounted for most of the classes. To detect such attacks, we used the Synthetic Minority Oversampling Technique (SMOTE) to increase the frequency of less common types of address. The pre-processed dataset was then employed to train four models (RNN, CNN, DNN and the proposed LSTM) for performance analysis with sequential data. The proposed LSTM model achieved an accuracy between 2% and 7%. LSTM had good detection for frequent attacks and slow-changing patterns, which shows its capacity in learning long-lasting dependencies. The results demonstrate that a simple, lightweight standalone LSTM model can be used for effective and realistic intrusion detection without the need for complex hybrid architecture.
Jawad Hussain Awan, Misbah Safdar, Muhammad Ayaz Shirazi et al.· Italian National Conference...· 0 citations
The results show a success in implementing a real time, scalable, privacy-preserving, and adaptive IDS in large-scale IoT deployments through intelligent workload distribution between edge and cloud layers.
Chidera Winifred John, Eduediuyai Ekerete Dan, P. Asuquo et al.· E3S Web of Conferences· 0 citations