Aug 2026· 2026 6th International Conference on Emerging Smart Technologies and Applications (eSmarTA)· pp. 1-8· 0 citations· 18 references
Abstract
The rapid propagation of Internet of Things (IoT) devices has significantly expanded the cyber-attack surface, particularly in essential infrastructure sectors such as energy, water, and healthcare. Machine learning (ML) based intrusion detection systems (IDS) offer a promising defense, but their real-world deployment is often hindered by data imbalance, lack of interpretability, and computational demands. In this paper, we introduce a lightweight ensemble approach, which integrates XGBoost and LightGBM using a soft-voting method. The system is evaluated on the IDSAI dataset after eliminating duplicates, resulting in 693,116 unique samples with a natural class imbalance. The preprocessing phase includes data cleansing and data scaling. The results indicate that the proposed ensemble achieves 99.95% accuracy, 99.95% F1-score, and a perfect AUC of 1.0 on a test set of 207,935 samples. Training completes in under 8 seconds on a standard CPU. The feature importance (gain) highlights delta_time; packet inter-arrival time, as the most significant feature, followed by source/destination ports. SHapley Additive exPlanations (SHAP) analysis provides local explanations, revealing that high inter-arrival times push predictions toward malicious—likely due to slow scanning or burst-and-pause attack patterns. All code and the trained model are publicly available to facilitate reproducibility1.
The exponential growth of IoT (Internet of Things) devices and their deployment has raised numerous threats of botnet-based cyberattacks, making IoT networks more vulnerable than traditional IT systems. The deployment of intelligent network-based intrusion detection systems (NIDS) on these edge devices forces researchers into an impossible trilemma: accuracy, speed, or size of the model. This study presents Tiny-IDS, an intelligent, lightweight system that predicts Mirai botnet attacks on IoT devices. Tiny-IDS is a lightweight and efficient Intrusion Detection System (IDS) that jointly optimizes for four key objectives: high accuracy, low inference latency, a nominal memory footprint, and high interpretability. The core of Tiny-IDS is a three-phase pipeline applied on N-BaIoT dataset. Model performance was evaluated using accuracy, inference time, model size, and interpretability. LightGBM achieved accuracy of 0.999999 but with a inference time of $0.904~\mu $ s/sample and bigger model size of 1.74 MB. Our proposed Distilled Student Tree outperformed other models in terms of efficiency, and achieved classification accuracy of 0.999562 while reducing inference time to $0.278~\mu $ s/sample and model size to 6.25 KB. The results demonstrate the effectiveness of the proposed Tiny-IDS in accurately identifying Mirai botnet attacks on IoT devices along with a minimal memory footprint and low inference time, while also emphasizing the need for IoT-specific evaluation frameworks to support the development of robust and lightweight IDS.
Shyam Bahadur, Sudhanshu Kumar Jha, Rajkumar Singh Rathore et al.· IEEE Open Journal of the Com...· 0 citations
The majority of assaults in heterogeneous networks are detected by intrusion detection systems (IDS). Cyberattack kinds that seriously harm networks are difficult for conventional IDSs to detect. The majority of existing solutions rely on deep learning models, which have a significant computational and energy overhead that limits their use in IoT environments with limited resources. A lightweight IDS based on ML is proposed in this research as a solution to this difficulty. Predicting the behavior of network traffic is achieved using ToN-IoT data and a tailored preprocessing pipeline. The voting-based ensemble classifier is built through the combination of models of RF and LightGBM to enhance the stability of the classification. The standard performance measures that are utilized to evaluate the proposed approach include accuracy, precision, recall, F1score, false alarm rates, and ROC analysis. The experimental findings indicate that RF achieve 99.81% accuracy, LGBM achieve 99.83%, and the ensemble model has a high accuracy of 99.99% with very low false alarms. Comparative evaluation with traditional ML and DL models demonstrates improved detection reliability with reduced computational overhead. These results prove that the suggested architecture is both computationally efficient and practically applicable to IoT settings with limited resources. However, direct hardware-level energy measurements are required to fully quantify the energy-saving characteristics of the proposed IDS.
Abhinay Kumar Reddy Seella, Rupesh Shirke, Vijay Kumar Kasuba et al.· International Conference on...· 0 citations
The vast expansion of IoT devices significantly expands the potential attack surface for networks; therefore, the increased complexity in detecting intrusions from these new sources is caused by the large dimensionality of the data, the severe class imbalance issue that exists when defining a normal versus abnormal behavior model based upon this data and the chaotic nature of network traffic.
This paper proposes a fully automated IoT-based Network Intrusion Detection System (NIDS), utilizing the Gotham Dataset 2025. Two AutoML approaches are used as part of the proposed system: TPOT (Tree-based Pipeline Optimization Tool) and FLAML (cost-aware lightweight AutoML framework). Both systems were evaluated using four different validation methods against approximately 5.8 million network traffic instances. FLAML achieved better results than TPOT in all evaluations, including achieving 99.98% accuracy at one evaluation. TPOT achieved comparable or slightly better performance than FLAML for precision and recall, but was less stable in its performance when dealing with class imbalance.
Susan M. Al Naqshbandi· Sulaimani Journal for Engine...· 0 citations
In the fast-growing world of Internet of Things (IoT), devices have exploded that are not only efficient but also expose serious security vulnerabilities that can be used as vectors for more advanced cyber-attacks. Traditional IDS has the challenge of false positive rate, which could cause critical operations to be disrupted in various domains from smart medical devices (SMDs) to municipal infrastructure. Machine Learning (ML) and Deep Learning (DL) models are state-of-the art solutions to detect complex, high-dimensional and temporal network anomalies in terms of accuracy but their deployment is still hampered severely due to the fact that they lack interpretability. This paper introduces a new explainable hybrid IDS architecture for IoT environments named XABiL-IDS (Explainable Attention-based Bi LSTM-Intrusion Detection System) in response to this challenge. This study uses a robust hybrid architecture to detect attacks effectively. Global analysis using the SHAP method for determining the most relevant traffic attributes affecting the classification process in the dataset on the other hand local analysis done by LIME for providing explanation at the instance level on the prediction made regarding network flows. The key differentiating feature of this approach compared to earlier methods is the incorporation of both global and local explainability in single pipeline.
Ravi Patni, Gurvinder Singh· International journal of com...· 0 citations
A lightweight, explainable IDS that combines a 1D-CNN for spatial feature analysis with SHAP for model interpretation, yielding streamlined models that preserve over 93% F1-score and reduce computational overhead by more than 38%, facilitating millisecond-level inference on edge hardware.
Miracle Udurume, Vladimir V. Shakhov, Insoo Koo· Scientific Reports· 0 citations
With the expansion of the Internet of Things (IoT) and cloud computing networks, the volume and complexity of cyberattacks have increased. Traditional signature-based intrusion detection systems (IDS) are insufficient, especially in unstable datasets and complex attack vectors. In this study, a hybrid ensemble learning model combining Random Forest (RF) and Extreme Gradient Boosting (XGBoost) algorithms is proposed to improve network security. The model makes decisions by weighting the probability scores of the classifiers using a "Soft Voting" mechanism. In experiments conducted on the NSL-KDD dataset, the proposed model achieved a 99.91% accuracy rate, surpassing most current (2024-2025) studies in literature. Furthermore, feature importance analysis is performed to increase the model's transparency, and the 20 most critical features are identified. Finally, the data space is visualized in 3D using the t-SNE algorithm, and it has been observed that the attack classes are separable.
Önder Özçam, Y. Yalman, Coşkun Mermer· Signal Processing and Commun...· 0 citations