Reservoir computing for network intrusion classification

Abstract

Network Intrusion Detection Systems (NIDS) play a critical role in securing IoT environments, where resource constraints demand lightweight yet effective solutions. While Convolutional Neural Network (CNN) and Long Short-Term Memory (LSTM) networks are widely adopted as benchmarks for intrusion detection, their high computational demands pose challenges for real-time deployment on IoT devices. Deep learning has emerged as a powerful approach for intrusion detection, and to explore lightweight alternatives, we investigate reservoir computing models, namely Echo State Networks (ESNs) and Liquid State Machines (LSMs). In the proposed framework, ESN and LSM act as temporal feature-learning and attack-classification engines, leveraging fixed recurrent reservoirs to efficiently capture network traffic dynamics while requiring minimal training overhead. We propose custom ESN- and LSM-based architectures that offer significantly lower computational complexity than conventional deep learning models. Our models demonstrate performance comparable to CNN and LSTM-based approaches while achieving substantial reductions in resource usage, making them suitable for real-time intrusion detection in IoT networks. We utilize the latest NF-ToN-IoT dataset from the University of Queensland, comprising 1,379,274 network flows spanning diverse attack categories. Furthermore, despite their potential advantages, ESN and LSM remain relatively underexplored in NIDS applications. The results highlight the viability of reservoir computing as an efficient, scalable, and responsive alternative for lightweight intrusion detection in IoT environments.