SLArDHO-Net: adaptation multi-model detection of IoT malware with self-learning dynamic hyperparameter optimization

Abstract

The Internet of Things (IoT) is becoming a widely deployed system with a high number of cybersecurity vulnerabilities, including zero-day and asymmetric attacks. The conventional intrusion detection systems (IDS) usually fail because of limited labelled data, large computational complexity as well as insufficient generalization in a heterogenous environment. The paper presents SLArDHO-Net, a multi-model framework that integrates LSTM-based temporal feature extraction with lightweight classifiers (XGBoost and Random Forest). The hyperparameter optimization, as well as the SLArDHO architecture, involves a semi-supervised learning loop, with pseudo-labels being built by confidence-thresholding unlabeled samples. Such pseudo-labels are repeatedly updated via self-training, where retraining the model with labeled data together with high-confidence pseudo-labeled data is periodically done. The model is employed to optimize both parameters and hyperparameters based on the validation performance ensuring consistency between pseudo-label quality and model generalization. To address class imbalance, a redistribution is applied to rare attacks using a defined threshold. The framework achieves accuracy of 0.97–0.99 at 0–100% labelling ratios on CIC-IoT-2023 data under semi-supervised learning using pseudo-labelling and self-training. Additionally, it demonstrates high efficiency being 1530 times faster during inference, requiring less than 2 GB of memory, and achieving inference times below 28 ms on hardware comparable to a Raspberry Pi 4, making it suitable for edge deployment. However, the approach has limitations, including sensitivity to pseudo-label noise in very low-label situations and the need for further validation of the long-term performance in real-world edge environments.