Sequential submodular feature-sample selection for lightweight and update-efficient IoT intrusion detection

Abstract

The exponential expansion of the Internet of Things (IoT) has created a complex threat landscape that challenges traditional intrusion detection systems (IDS), particularly on edge devices with stringent computational and memory budgets. Beyond lightweight inference, practical IoT security increasingly requires on-device learning and frequent retraining so that models can adapt to evolving traffic patterns and emerging attacks; however, repeatedly training on high-dimensional data and large traffic corpora remains prohibitively expensive for resource-constrained devices. Existing lightweight IDS solutions often treat dimensionality reduction and data pruning as isolated tasks, leading to suboptimal representations and a lack of theoretical guarantees. To address this, we propose the Sequential Submodular Feature-Sample Selection (SSFSS) framework, a theoretically grounded approach that sequentially optimizes the feature and sample spaces to reduce training cost while preserving detection fidelity. First, we introduce Label-Aware Coreset Greedy-Based Feature Selection (LA-CGFS), which formulates feature selection as a label-conditioned facility location problem. This stage maximizes coverage across class manifolds, preserving discriminative power for minority attack classes without relying on synthetic oversampling. Second, we employ a geometry-aware coreset selection strategy that minimizes geometric coverage error in the reduced feature space. By leveraging the submodular property of diminishing returns, SSFSS provides a proven \documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$(1-1/e)$$\end{document} approximation guarantee to the optimal subset. Extensive evaluation on the RT-IoT2022, Edge-IIoTset, and CICIoT2023 datasets demonstrates that SSFSS reduces the feature space to 20 features and the training set to as little as 5% of the original samples, achieving average training speedups of up to \documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$70\times $$\end{document} and up to a 96% reduction in peak training RAM; even when the one-time coreset-construction cost is included, the end-to-end pipeline remains faster than a single full-data fit. Across four differentiable empirical-risk-minimization classifiers (kernel logistic regression, kernel SVM, kernel ridge, and softmax regression), the best reduced model retains 97.5–99.5% accuracy at \documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$10\%$$\end{document} budget, and the weighted coreset improves macro-F1 and balanced accuracy on the imbalanced benchmarks. Supported by the reported results, we position the proposed SSFSS framework as an efficient update-aware preprocessing framework whose measured speedups and RAM consumption motivate deployment on resource-constrained edge hardware.