Balancing Accuracy and Efficiency in IoT Intrusion Detection Using a Confidence-Based Hybrid LightGBM–CNN Model

Abstract

Resource-constrained Internet of Things (IoT) environments require intrusion detection systems (IDS) that provide high detection performance while maintaining low computational overhead. Although deep learning models have demonstrated strong predictive capability, their computational complexity often limits deployment on edge gateways with restricted memory, processing power, and energy budgets. Conversely, lightweight machine learning models are computationally efficient but may struggle with difficult or ambiguous attack patterns. To ad-dress this trade-off, this paper proposes a confidence-based hybrid Light Gradient Boosting Machine (LightGBM) and Convolutional Neural Network (CNN) framework that selectively routes low-confidence predictions generated by LightGBM to a lightweight CNN for further analysis. The proposed approach was evaluated using the UNSW-NB15 multi-class intrusion detection dataset under a Central Processing Unit (CPU)-only execution environment. Experimental results show that the hybrid model achieved the highest classification accuracy of 85.85%, outperforming standalone LightGBM (83.75%), Random Forest (RF) (80.72%), and CNN (80.15%). The proposed framework also achieved the highest macro precision of 77.29% while maintaining a compact model size of approximately 17 MB through selective inference. Threshold analysis further demonstrates that the confidence threshold effectively controls the trade-off between predictive performance and computational cost by adjusting the proportion of samples processed by the CNN. These findings indicate that confidence-based selective inference provides a practical and resource-efficient solution for deploying hybrid IDS in edge-based IoT environments while maintaining competitive detection performance.