Real-Time Network IDS for SOHO Using Hybrid Edge Machine Learning Techniques

Abstract

Small Office/Home Office (SOHO) networks increasingly rely on Internet of Things (IoT) devices, thereby expanding their attack surface while leaving many users without enterprise-grade security support. This paper presents a twostage intrusion detection and alert-enrichment system that combines Suricata with machine learning (ML) classification on edge devices, including a Raspberry Pi 4 and a Mini-PC. Suricata serves as the primary detection engine, while the ML classifier processes only flows associated with Suricata alerts to provide a secondary traffic-class prediction. The offline ML evaluation used a subset of CIC-IDS2017 containing only flow records associated with Suricata alerts. The evaluation included data preprocessing, feature selection, resampling, and class weighting. Random Forest achieved the highest aggregate classification performance on the Suricata-alerted test subset, with an accuracy of 99.59% and a weighted F1-score of 0.9959. Decision Tree achieved the second-highest weighted F1-score, while XGBoost and KNN obtained weighted F1-scores of 0.9891 and 0.9863, respectively. Logistic Regression produced substantially lower accuracy and weighted F1-score than the other evaluated classifiers. Edge deployment was evaluated in terms of CPU utilization, feature-to-classification latency, and network throughput. Real-time alerts containing Suricata alert fields and ML predictions were forwarded to a Discord channel through a webhook. The prototype operated on both evaluated edge platforms under the laboratory traffic profile, with sustained throughput of 82 Mbps on the Raspberry Pi 4 and 310 Mbps on the Mini-PC.