A Lightweight Hybrid Cnn-Lstm Intrusion Detection System for Resource-Constrained Iot Networks

IoT devices keep multiplying, and so do the ways attackers can get into them. Most of these devices simply don't have the CPU, RAM, or power budget to run the deep learning-based intrusion detection systems (IDS) that perform best in the research literature, which creates a real gap between what's accurate and what's actually deployable. In this paper we build a hybrid CNN-LSTM classifier and, instead of shrinking it after the fact, we design it to be small from the start: depthwise-separable convolutions handle the spatial side, a deliberately narrow LSTM layer picks up temporal patterns across flow sequences, and the whole thing goes through structured pruning and post-training quantization before it ever gets tested. We ran it against TON_IoT and IoTID20, two datasets built from different testbeds with different attack mixes, and stacked it up against Random Forest, SVM, and plain (uncompressed) CNN and LSTM models. The compressed hybrid model came out ahead on both datasets - 98.6% accuracy on TON_IoT, 97.9% on IoTID20 - while ending up about 71% smaller and 58% faster at inference than its own uncompressed version. So it seems like joint design (architecture and compression together, not compression bolted on later) is a workable path to models that are both accurate and small enough to actually run at the edge. We close with a look at the accuracy/latency/energy trade-offs we hit along the way, and where this could go next - federated learning, online updates, that kind of thing.

Intrusion Detection System, Internet of Things, Deep Learning, CNN-LSTM, Model Compression, Edge Security

1. Y. LeCun, Y. Bengio, and G. Hinton, "Deep learning," Nature, vol. 521, no. 7553, pp. 436-444, 2015. [Google Scholar] [Crossref]

2. A. Javaid, Q. Niyaz, W. Sun, and M. Alam, "A deep learning approach for network intrusion detection system," in Proc. 9th EAI Int. Conf. Bio-inspired Information and Communications Technologies (BIONETICS), 2016, pp. 21-26. [Google Scholar] [Crossref]

3. Z. Li, W. Fang, C. Zhu, G. Song, and W. Zhang, "Toward deep learning based intrusion detection system: A survey," in Proc. 2024 6th Int. Conf. Big Data Engineering (BDE), 2024. [Google Scholar] [Crossref]

4. T. Gaber, J. B. Awotunde, M. Torky, S. A. Ajagbe, M. Hammoudeh, and W. Li, "Metaverse-IDS: Deep learning-based intrusion detection system for Metaverse-IoT networks," Internet of Things, vol. 24, p. 100977, 2023. [Google Scholar] [Crossref]

5. W. Fang, C. Zhu, and W. Zhang, "Toward secure and lightweight data transmission for cloud-edge-terminal collaboration in Artificial Intelligence of Things," IEEE Internet of Things Journal, vol. 11, no. 1, pp. 105-113, 2024. [Google Scholar] [Crossref]

6. S. Hosseininoorbin et al., "A lightweight intrusion detection method for IoT based on deep learning and dynamic quantization," PeerJ Computer Science, vol. 9, p. e1569, 2023. [Google Scholar] [Crossref]

7. N. Jeyanthi and B. Indrani, "ACAAS: An efficient feature extraction and recurrent neural network based intrusion detection approach for IoTID20," 2023. [Google Scholar] [Crossref]

8. S. I. Popoola, B. Adebisi, M. Hammoudeh, G. Gui, and H. Gacanin, "Hybrid deep learning for botnet attack detection in the internet-of-things networks," IEEE Internet of Things Journal, vol. 8, no. 6, pp. 4944-4956, 2020. [Google Scholar] [Crossref]

9. A. Alsaedi, N. Moustafa, Z. Tari, A. Mahmood, and A. Anwar, "TON_IoT telemetry dataset: A new generation dataset of IoT and IIoT for data-driven intrusion detection systems," IEEE Access, vol. 8, pp. 165130-165150, 2020. [Google Scholar] [Crossref]

10. J. Li, X. Tong, J. Liu, and L. Cheng, "An efficient federated learning system for network intrusion detection," IEEE Systems Journal, vol. 17, no. 2, pp. 2455-2464, 2023. [Google Scholar] [Crossref]

11. M. J. Idrissi, H. Alami, A. El Mahdaouy, A. El Mekki, S. Oualil, Z. Yartaoui, and I. Berrada, "Fed-anids: Federated learning for anomaly-based network intrusion detection systems," Expert Systems with Applications, vol. 234, p. 121000, 2023. [Google Scholar] [Crossref]

12. T. T. Thein, Y. Shiraishi, and M. Morii, "Personalized federated learning-based intrusion detection system: Poisoning attack and defense," Future Generation Computer Systems, vol. 153, pp. 182-192, 2024. [Google Scholar] [Crossref]

• What the Desert Fathers Teach Data Scientists: Ancient Ascetic Principles for Ethical Machine-Learning Practice
• Comparative Analysis of Some Machine Learning Algorithms for the Classification of Ransomware
• Comparative Performance Analysis of Some Priority Queue Variants in Dijkstra’s Algorithm
• Transfer Learning in Detecting E-Assessment Malpractice from a Proctored Video Recordings.
• Dual-Modal Detection of Parkinson’s Disease: A Clinical Framework and Deep Learning Approach Using NeuroParkNet