Confidence-driven lightweight adaptive online deep learning for IoT intrusion detection

Abstract

The Internet of Things (IoT) paradigm has become a technology used in homes, industry, agriculture, energy, and healthcare. Because of this technology’s widespread adoption and the weak security architecture of most IoT devices, the ecosystem has become an attractive target for cyberattacks. One mitigation technology for securing IoT networks is an intrusion detection system (IDS); however, most existing IDS cannot run on IoT edge hardware because they require substantial computational resources. Moreover, these IDS models are trained offline, making them difficult to adapt to data drift. To address these limitations, we proposed an online deep learning framework that combines an adaptive feature gate and a confidence-modulated learning rate. Experimental results on six IoT-based datasets show that the proposed framework outperformed online machine learning baselines on four datasets. The proposed model also outperforms three drift detection algorithms across all six datasets, achieving up to an 11.8 percentage-point improvement over reset-based drift methods. Post-training quantization reduces the model by up to 98% without degrading performance. The results show that the proposed framework reduces model size and adapts to data drift in real time without negatively impacting the model’s detection capability, making it ideal for edge deployment. However, minority-class detection remains a weak and important area to address going forward, as attack classes such as DNS spoofing in CIC-IoT, injection in NF-ToN-IoT, and malformed, SlowITe, and brute-force traffic in MQTTset exhibit high false-negative rates. The code used for our experimental validation is available in the GitHub repository, https://github.com/v-pragbe/Adaptive_Online_Deep_Quantization.git