LARO-IDS: Family-leakage-aware robust multi-objective optimization for model selection in IoT intrusion detection
Machine learning-based intrusion detection systems (IDS) are commonly selected based on conventional validation or development metrics, although such criteria may not sufficiently reflect robustness against unseen attack families or suitability for resource-constrained Internet of Things and edge environments. This study proposes learned acquisition and reconstruction optimization (LARO)—IDS (LARO-IDS), a family-leakage-aware robust multi-objective optimization framework for model selection in Internet of Things intrusion detection. Instead of selecting the model that only maximizes conventional predictive performance, LARO-IDS jointly considers development macro-F1, mean cross-family robustness, worst-family behavior, robustness variability, and prediction latency in the candidate-selection objective, while training time and model size are retained as additional deployment-cost indicators for final comparison. Candidate models were evaluated using a model-selection evaluation subset and a leave-one-attack-family-out robustness protocol, then ranked using a weighted-sum scalarization of normalized objectives, with the results further supported by Pareto-efficiency analysis. Experiments on the CICIoT2023 dataset show that conventional score-based selection favors RF_03_regularized, which achieved the highest macro-F1. In contrast, LARO-IDS selects RF_01_fast, which preserves nearly identical predictive performance, with only a −0.0015 macro-F1 difference, while achieving slightly higher mean cross-family F1 scores across attack families. The LARO-selected model also reduces training time by 49.49%, prediction latency by 46.36%, and model size by 50.12% compared with the conventionally selected model. Sensitive analysis of objective weights further shows that RF_01_fast remains selected under balanced, performance-priority, robustness-priority, and edge-priority scenarios. These results demonstrate that robust IDS model selection should integrate family-leakage-aware robustness and latency-aware deployment cost rather than relying solely on conventional predictive performance.