A Two-Stage Raspberry Pi Security Pipeline for Military IoT Attack Filtering and Quantum-Safe Cloud Transit

Abstract

Military IoT and tactical sensing deployments face dual threats: contemporary intrusions against MQTT commandand-telemetry channels and long-term quantum threats to operational confidentiality through harvest-now-decrypt-later (HNDL) attacks. We present a hardware-validated two-stage security pipeline for Raspberry Pi tactical IoT gateways. Stage 1 is a LightGBM-based network intrusion detection and prevention system (IDS/IPS) that intercepts TCP flows bound for the MQTT broker via Linux NetfilterQueue, extracts a 45-dimensional behavioral feature vector per flow, and issues a flow-level verdict using a model trained on the CIC IoMT 2024 dataset. Stage 2 is a post-quantum re-encryption gateway that upgrades surviving benign MQTT messages to ML-KEM-768 key encapsulation and ML-DSA-65 digital signatures (NIST Level 3, FIPS 203/204) before cloud or command-center forwarding. Evaluated on real Raspberry Pi 4B hardware using genuine liboqs primitives, Stage 1 achieves 99.6% attack detection across 5,309 flows covering seven attack categories (mean model confidence 1.0000, mean classify latency ${0.944 \text{ms}})$, while Stage 2 adds only 0.189 ms mean cryptographic overhead per message. Together, the pipeline provides a practical, deployable defense for military IoT gateways against both present-day network attacks and quantum-era confidentiality risks.