A lightweight, explainable IDS that combines a 1D-CNN for spatial feature analysis with SHAP for model interpretation, yielding streamlined models that preserve over 93% F1-score and reduce computational overhead by more than 38%, facilitating millisecond-level inference on edge hardware.
Abstract
Deploying effective intrusion detection systems on low-power IoT devices requires a careful balance of performance, efficiency, and transparency. Current neural-network-based solutions are often too resource-intensive and opaque for practical edge use. We introduce a lightweight, explainable IDS that combines a 1D-CNN for spatial feature analysis with SHAP for model interpretation. To the best of our knowledge, this work presents the first comparative analysis of a SHAP-augmented 1D-CNN against traditional CNN and LSTM models for IoT intrusion detection. Our method outperforms these benchmarks on real-world datasets (UNSW-NB15 and WUSTL-IIoT-2021). Crucially, SHAP analysis enables feature reduction, yielding streamlined models that preserve over 93% F1-score and reduce computational overhead by more than 38%, facilitating millisecond-level inference on edge hardware. These results demonstrate a viable path for reconciling high detection accuracy with the stringent resource limitations of IoT environments.
Resource-constrained Internet of Things (IoT) environments require intrusion detection systems (IDS) that provide high detection performance while maintaining low computational overhead. Although deep learning models have demonstrated strong predictive capability, their computational complexity often limits deployment on edge gateways with restricted memory, processing power, and energy budgets. Conversely, lightweight machine learning models are computationally efficient but may struggle with difficult or ambiguous attack patterns. To ad-dress this trade-off, this paper proposes a confidence-based hybrid Light Gradient Boosting Machine (LightGBM) and Convolutional Neural Network (CNN) framework that selectively routes low-confidence predictions generated by LightGBM to a lightweight CNN for further analysis. The proposed approach was evaluated using the UNSW-NB15 multi-class intrusion detection dataset under a Central Processing Unit (CPU)-only execution environment. Experimental results show that the hybrid model achieved the highest classification accuracy of 85.85%, outperforming standalone LightGBM (83.75%), Random Forest (RF) (80.72%), and CNN (80.15%). The proposed framework also achieved the highest macro precision of 77.29% while maintaining a compact model size of approximately 17 MB through selective inference. Threshold analysis further demonstrates that the confidence threshold effectively controls the trade-off between predictive performance and computational cost by adjusting the proportion of samples processed by the CNN. These findings indicate that confidence-based selective inference provides a practical and resource-efficient solution for deploying hybrid IDS in edge-based IoT environments while maintaining competitive detection performance.
Darius Felix Lummawie, Rojali, M. E. Syahputra· International Conference on...· 0 citations
A new explainable hybrid IDS architecture for IoT environments named XABiL-IDS (Explainable Attention-based Bi LSTM-Intrusion Detection System) in response to this challenge, which uses a robust hybrid architecture to detect attacks effectively.
Ravi Patni, Gurvinder Singh· International journal of com...· 0 citations
The rapid growth of IoT-enabled technologies and interconnected smart devices has significantly increased security risks associated with poorly protected and resource-constrained IoT environments. Efficient anomaly detection mechanisms can help mitigate these threats by analyzing network traffic and identifying abnormal activities. However, such mechanisms must also preserve user privacy and maintain scalability for deployment on low-power edge devices. This paper presents
XP-IDS
: a hybrid deep gradient boosting framework for intrusion detection in IoT networks. Using the
CIC IoT-DIAD 2024
dataset,
XP-IDS
learns from three categories of handcrafted features: (i) strategic-based features that capture high-level protocol semantics and flow behavior, (ii) time-based features that represent sequential relationships and traffic evolution over time, and (iii) IP-based features that characterize packet-flow communication among IoT endpoints. Feature representations extracted through stacked Convolutional Neural Networks are subsequently forwarded to an Extreme Gradient Boosting classifier for final prediction. In addition, SHapley Additive exPlanation (SHAP) is utilized to provide interpretability for model decisions and to identify overall feature importance, thereby enhancing transparency and privacy-aware analysis. Extensive experimental evaluation demonstrates that the proposed framework achieves strong detection accuracy across several common attack categories while outperforming multiple baseline approaches. The proposed accurate and interpretable framework shows strong potential as an edge-deployable security solution for safeguarding IoT devices and improving cyber resilience.
Prabhav Jain, Aashima Sharma, A. Noonia et al.· Scientific Reports· 0 citations
The growth of Internet of Things devices has expanded the number of attackable targets of advanced cyber threats by orders of magnitude, and the limited computational capabilities of IoT devices have made more traditional intrusion detection systems infeasible to execute at the edge. A Knowledge-Distilled Multi-Model Intrusion Detection and Prevention System is presented, which combines a Residual Graph Convolutional Network, Long Short-Term Memory classifier, and a Conditional Tabular Generative Adversarial Network enhanced with the student-only autoencoders through multi-loss knowledge distillation to create a high-performing Teacher ensemble and compresses its intelligence into an edge-deployed system. The system is evaluated using the IoT-23 benchmark of 325 million network flow records and attains 98.2% Teacher-Student fidelity, 0.94 Knowledge Retention Score, and 4.4x throughput increase with 82.7% reduction in the parameter and provides per-packet SHapely Additive exPlanation forensic explainability.
S. K, Menaka T K, N. R· 2026 4th International Confe...· 0 citations
LSTM had good detection for frequent attacks and slow-changing patterns, which shows its capacity in learning long-lasting dependencies, which shows its capacity in learning long-lasting dependencies.
Jawad Hussain Awan, Misbah Safdar, Muhammad Ayaz Shirazi et al.· Italian National Conference...· 0 citations
The results show a success in implementing a real time, scalable, privacy-preserving, and adaptive IDS in large-scale IoT deployments through intelligent workload distribution between edge and cloud layers.
Chidera Winifred John, Eduediuyai Ekerete Dan, P. Asuquo et al.· E3S Web of Conferences· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
