A Lightweight AI-Driven Intrusion Detection System for Cyber-Physical IoT Networks: Balancing Detection Performance and Edge Deployability

Machine learning-based intrusion detection systems for IoT networks are predominantly evaluated on detection metrics alone; computational efficiency is left unmeasured and deployment feasibility unaddressed. This study presents a dual-axis evaluation of five lightweight ML models on the TON_IoT network traffic dataset under a bias-aware preprocessing protocol that removes testbed-specific identifiers before feature selection. The preprocessing protocol is designed to produce feature sets that generalise beyond the training topology. A hybrid mutual information and recursive feature elimination pipeline reduced 60 candidate features to 18 behavioural attributes. Five models were trained and evaluated on the held-out test partition under CPU-only, single-core inference conditions (Random Forest, LightGBM, XGBoost, a Pruned MLP, and a 1D-CNN); each was assessed on four detection metrics (accuracy, macro-F1, false positive rate, AUC-ROC) and three efficiency dimensions (per-sample latency, serialised model size, peak RAM at inference). Tree-based models achieved macro-F1 scores of 0.923–0.936 and false positive rates of 0.003. Neural network models recorded macro-F1 scores of 0.599–0.637; the margin below the tree models (0.287–0.337 points) is attributable to calibration effects under class imbalance rather than to architectural limitations. Random Forest recorded the lowest latency (0.017 ms per sample) and is recommended for gateway-class deployment. The Pruned MLP, at 218.5 KB and 0.070 ms latency, is the only model satisfying all MCU-class constraints and is recommended for severely resource-constrained endpoints. When deployment tier thresholds are applied, four models are assigned to gateway class and one to MCU class. Detection performance and computational efficiency impose different model rankings; deployment decisions require both axes of evaluation.

Keywords: Intrusion detection system, Internet of Things, Edge deployment, Lightweight machine learning, TON_IoT, Feature selection, Computational efficiency.