Task-scaled spiking neural networks with multi-stage feature selection for resource-constrained iot intrusion detection

Abstract

Distributed IoT systems in critical infrastructure demand intrusion detection solutions that balance detection accuracy with the computational constraints of edge deployment. This study presents a lightweight Spiking Neural Network (SNN) framework for network intrusion detection, utilizing the computational properties of spike-based processing - namely, replacement of multiply-accumulate (MAC) operations with sparse accumulate (AC) operations and input-adaptive computation through natural spike sparsity - to explore neuromorphic-compatible architectures suited to resource-constrained edge deployment. The framework is validated on the Edge-IIoTset dataset [1] through five-fold stratified cross-validation. A multi-stage feature selection pipeline reduces the input space from 97 to 35 features (63.9% reduction), including removal of seven features exhibiting strong target correlation (|r| > 0.70) to promote broader feature diversity. Task-scaled architectures match network capacity to classification granularity, ranging from 9,342 parameters (36.5 KB) for binary to 51,347 parameters (200.6 KB) for fifteen-class classification. Cross-validation results show consistent performance: binary 99.18% (+/- 0.03%), six-class 96.99% (+/- 0.11%), and fifteen-class 96.79% (+/- 0.08%) accuracy. Minority class detection remains a limitation, with Fingerprinting (54.04%) and Password (59.46%) recall indicating challenges from class imbalance and feature overlap. These results suggest that compact spiking architectures can provide effective intrusion detection within the memory budgets of edge processors, establishing architectural groundwork for future neuromorphic deployment.