2026· IEEE Open Journal of the Communications Society· Vol 7, pp. 9256-9267· 0 citations· 40 references
TL;DR
The results demonstrate the effectiveness of the proposed Tiny-IDS in accurately identifying Mirai botnet attacks on IoT devices along with a minimal memory footprint and low inference time, while also emphasizing the need for IoT-specific evaluation frameworks to support the development of robust and lightweight IDS.
Abstract
The exponential growth of IoT (Internet of Things) devices and their deployment has raised numerous threats of botnet-based cyberattacks, making IoT networks more vulnerable than traditional IT systems. The deployment of intelligent network-based intrusion detection systems (NIDS) on these edge devices forces researchers into an impossible trilemma: accuracy, speed, or size of the model. This study presents Tiny-IDS, an intelligent, lightweight system that predicts Mirai botnet attacks on IoT devices. Tiny-IDS is a lightweight and efficient Intrusion Detection System (IDS) that jointly optimizes for four key objectives: high accuracy, low inference latency, a nominal memory footprint, and high interpretability. The core of Tiny-IDS is a three-phase pipeline applied on N-BaIoT dataset. Model performance was evaluated using accuracy, inference time, model size, and interpretability. LightGBM achieved accuracy of 0.999999 but with a inference time of $0.904~\mu $ s/sample and bigger model size of 1.74 MB. Our proposed Distilled Student Tree outperformed other models in terms of efficiency, and achieved classification accuracy of 0.999562 while reducing inference time to $0.278~\mu $ s/sample and model size to 6.25 KB. The results demonstrate the effectiveness of the proposed Tiny-IDS in accurately identifying Mirai botnet attacks on IoT devices along with a minimal memory footprint and low inference time, while also emphasizing the need for IoT-specific evaluation frameworks to support the development of robust and lightweight IDS.
The rapid propagation of Internet of Things (IoT) devices has significantly expanded the cyber-attack surface, particularly in essential infrastructure sectors such as energy, water, and healthcare. Machine learning (ML) based intrusion detection systems (IDS) offer a promising defense, but their real-world deployment is often hindered by data imbalance, lack of interpretability, and computational demands. In this paper, we introduce a lightweight ensemble approach, which integrates XGBoost and LightGBM using a soft-voting method. The system is evaluated on the IDSAI dataset after eliminating duplicates, resulting in 693,116 unique samples with a natural class imbalance. The preprocessing phase includes data cleansing and data scaling. The results indicate that the proposed ensemble achieves 99.95% accuracy, 99.95% F1-score, and a perfect AUC of 1.0 on a test set of 207,935 samples. Training completes in under 8 seconds on a standard CPU. The feature importance (gain) highlights delta_time; packet inter-arrival time, as the most significant feature, followed by source/destination ports. SHapley Additive exPlanations (SHAP) analysis provides local explanations, revealing that high inter-arrival times push predictions toward malicious—likely due to slow scanning or burst-and-pause attack patterns. All code and the trained model are publicly available to facilitate reproducibility1.
Nooruddine F. Assarwie, F. Alqasemi, Tasnim M. Al-Khawlani et al.· 2026 6th International Confe...· 0 citations
A lightweight, explainable IDS that combines a 1D-CNN for spatial feature analysis with SHAP for model interpretation, yielding streamlined models that preserve over 93% F1-score and reduce computational overhead by more than 38%, facilitating millisecond-level inference on edge hardware.
Miracle Udurume, Vladimir V. Shakhov, Insoo Koo· Scientific Reports· 0 citations
A machine learning-based framework to tackle issues in traditional systems in traditional systems is introduced by combining large language models (LLMs) and is effective in identifying possible threats as well as filling the semantic gap.
Mamoon M. Saeed, Rashid A. Saeed, Salah Hagahmoodi et al.· Baghdad Science Journal· 0 citations
A new explainable hybrid IDS architecture for IoT environments named XABiL-IDS (Explainable Attention-based Bi LSTM-Intrusion Detection System) in response to this challenge, which uses a robust hybrid architecture to detect attacks effectively.
Ravi Patni, Gurvinder Singh· International journal of com...· 0 citations
Rapid growth in Internet of Things (IoT) devices has expanded the attack surface of modern-day networks. Therefore, it is imperative to deploy an IoT Intrusion Detection System (IDS) for secure communication and reliable operation. However, traditional IDS systems are often inefficient when dealing with high-dimensional data, new attack strategies, and severe imbalanced data problems, leading to low detection performance and high false alarms. In order to solve these problems, this paper introduces a novel intelligent IDS system using the Feature Selection technique inspired by Bowerbird Courtship (BBFS) and Long Short-Term Memory Autoencoder (LSTM-AE) using Seagull Optimizer (SGO). The most important objective here is to build an effective and scalable IDS that can perform efficient feature selection, learn deep temporal dependencies, and tune its hyperparameters to classify malicious and benign traffic more effectively. In this way, we consider all aspects of data preprocessing, feature optimization, balancing, and classification, overcoming the limitations of existing techniques. The evaluation of the CIC IoT 2023 intrusion dataset proves the efficiency of the model, which is shown by high scores: 99.63% of accuracy, 99.55% of detection rate, 99.71% of precision, and 99.59% of F1 score. As seen from the comparison with other models, the BBFS-LSTM-AE-SGO model is better than the compared model in terms of all metrics. It means that the proposed IDS can detect various types of attacks with minimum errors. All through this research has made way for the design of a novel, optimized IoT-IDS model that thereby strengthens cybersecurity resilience, supports real-time monitoring, and hence advances the intrusion detection for IoT-enabled environments.
Nancy Thomas, R. Gunasundari· international journal of eng...· 0 citations
The explosion of Internet of Things (IoT) deployment over the past decade has served as a foundational pillar for global digital transformation. However, the rapid expanding attack surface of IoT architectures often suffers from compromised security paradigms, rendering smart environments highly vulnerable to malicious exploitations. While traditional Intrusion Detection Systems (IDS) mitigate network threats, conventional datasets lack the granular, protocol-specific traffic anomalies characteristic of IoT environments. This research addresses this gap by developing an automated machine learning framework designed to differentiate reconnaissance and anomalous activities from baseline behaviors within smart home IoT infrastructures. Utilizing the Hacking and Countermeasure Research Lab (HCRL) dataset, we evaluate and contrast the efficacy of Naïve Bayes (NB) and Support Vector Machine (SVM) algorithms across varying data-split ratios. Experimental results indicate that while Naïve Bayes offers competitive computational recall in localized environments, the SVM classifier demonstrates superior robustness, achieving an accuracy threshold approaching 99.99% in isolating low-frequency reconnaissance attacks.
