AI-Based Intrusion Detection for IoT-Enabled Smart Infrastructure: A Cross-Dataset, Explainable, and Resource-Aware Framework

AI-based intrusion detection for Internet of Things (IoT) systems is often evaluated by within-dataset accuracy, even though operational smart infrastructure must tolerate changes in traffic, devices, and computational constraints. This study develops and empirically evaluates a cross-dataset, explainable, and resource-aware framework using 1,800 harmonized observations labeled as originating from CICIoT2023, Edge-IIoTset, and TON_IoT (600 per source). Five classifiers were compared under within-dataset validation, six directed source-to-target transfers, and leave-one-dataset-out (LODO) testing. Random Forest achieved the strongest strict transfer performance with mean F1 = 0.926 (range 0.918-0.932), while LightGBM achieved the highest mean LODO F1 (0.937). SHAP explanations for the Random Forest were highly stable across target datasets, with mean top-10 Jaccard overlap of 0.818 and mean rank correlation of 0.990. Resource profiling exposed a clear accuracy-efficiency trade-off: Random Forest provided the highest external F1 but required 124.9 ms per 1,000 inferences and a 1.415 MB serialized model, whereas XGBoost retained mean external F1 = 0.918 at 7.84 ms per 1,000 inferences and 0.135 MB. A secondary 10-class LODO experiment yielded mean macro-F1 = 0.527, showing that attack-family transfer remains substantially harder than binary detection. The findings support joint assessment of transfer robustness, explanation stability, and deployment efficiency rather than benchmark accuracy alone.

Keywords: Internet of Things; intrusion detection; cross-dataset generalization; explainable AI; SHAP; edge AI; resource-aware computing; smart infrastructure.