Reliability-aware lightweight network-flow intrusion detection for IoT and IIoT edge communication networks

Abstract

The rapid expansion of Internet of Things (IoT) and Industrial Internet of Things (IIoT) communication networks has increased the exposure of edge-connected devices and services to denial-of-service, reconnaissance, spoofing, brute-force, malware, and injection attacks. Although machine-learning-based intrusion detection systems achieve strong benchmark performance, practical edge reliability also depends on calibration quality, false-alarm behavior, model size, latency, throughput, and robustness to unseen attack families. This study presents a unified, reproducible reliability-and-edge-inference evaluation protocol for lightweight network-flow intrusion detection in IoT/IIoT edge communication networks. The protocol evaluates logistic regression, random forest, LightGBM, XGBoost, and TinyMLP using binary detection, multiclass attack classification, leave-one-attack-category-out testing, binary and multiclass calibration, threshold-policy analysis, SHAP explainability, feature ablation, TinyMLP compression, and Raspberry Pi 5 CPU-only inference. CICIoT2023 is used as the main benchmark, while Edge-IIoTset provides an independent within-dataset replication of the evaluation protocol. Across five random seeds, validation-tuned LightGBM obtains the highest mean multiclass macro-F1 on CICIoT2023 and Edge-IIoTset, at 0.6940 and 0.9034, respectively. XGBoost remains a strong overall tabular model and obtains the strongest tuned Edge-IIoTset binary result, with a mean macro-F1 of 0.9624; the normal-approximation uncertainty intervals of leading models overlap in some comparisons. TinyMLP provides the smallest serialized model among the principal model families and the lowest measured batch-1 latency, at 0.1569 ms/flow on CICIoT2023 and 0.1454 ms/flow on Edge-IIoTset. PyTorch dynamic INT8 quantization reduces TinyMLP serialized size by approximately 57%, but does not improve batch-1 latency and can reduce detection reliability. These conclusions are limited to the evaluated lightweight tabular models and TinyMLP.