ALEIDF: An Adaptive Lightweight and Explainable Hybrid Deep Learning Framework for Intrusion Detection in Resource-Constrained IoT Networks
TL;DR
A unified framework (ALEIDF) which consolidates eight tightly coupled modules, namely: Adaptive Feature Evolution Module (AFE), Hybrid Deep Learning Engine (HDLE), Adaptive Threat Memory (ATM), Explainability Module (XM), Decision Engine (DE), Resource Optimization Module (ROM), and Online Learning Module (OLM) is proposed.
Abstract
The proliferation of Internet of Things (IoT) networks in smart homes, healthcare, industrial systems, and critical infrastructure has greatly extended the attack surface, and the deep learning models that are best suited to detecting these attacks are challenging to deploy on resource-limited edge devices, difficult to trust because they are black-box, and difficult to maintain effectively because traffic and attack distributions are evolving over time. Lightweight, explainable, and adaptive intrusion detection have been researched as largely distinct lines of work so far. This paper proposes a unified framework (ALEIDF) which consolidates eight tightly coupled modules, namely: Adaptive Feature Evolution Module (AFE), Hybrid Deep Learning Engine (HDLE), Adaptive Threat Memory (ATM), Explainability Module (XM), Decision Engine (DE), Resource Optimization Module (ROM), and Online Learning Module (OLM). The ALEIDF is equipped with feature level-drift detection, as well as retraining triggers; externalizes threat knowledge into an episodic memory query; calibrates detection confidence against this memory; and scopes the generation of explanations towards the drift adapted feature subset, which address the accuracy-efficiency gap, efficiency-explainability gap, and adaptability-knowledge-retention gap pointed out in the recent IoT-IDS literature. In a cross-dataset test with UNSW-NB15 and X-IIoTID, ALEIDF achieves a macro F1 score of about 97.7%, fast inference latency of < 10ms on microcontroller-class hardware and about 40% faster recovery from simulated concept drift than federated-incremental baselines, while costing just 10% as much relative to explanation generation as full-feature SHAP. Having identified joint integration of efficiency, explainability and adaptability as an open field in recent surveys regarding IoT network security research, ALEIDF is well positioned to further this integration.