ACO-Optimized Dual-Ensemble Intrusion Detection for Resource-Constrained IoT Edge Networks

Abstract

The rapid proliferation of Internet of Things (IoT) devices has exponentially expanded the attack surface of modern networks, exposing them to threats ranging from massive DDoS floods to subtle web-based exploits. Traditional Intrusion Detection Systems (IDS) often struggle to balance high detection accuracy with the strict resource constraints of edge deployment, while also failing to address the severe class imbalance inherent in real-world IoT traffic. In this paper, we propose an ACO-optimized dual-ensemble intrusion detection framework designed for resource-constrained IoT edge networks, streamlining detection without compromising performance. We construct a Dual-Ensemble architecture combining Random Forest and LightGBM within a soft-voting mechanism. To ensure optimal performance, we employ Ant Colony Optimization (ACO) to navigate the hyperparameter space, identifying robust configurations that prioritize generalization over complexity. Furthermore, we integrate a targeted SMOTE strategy to augment rare attack classes and a feature selection layer that reduces data dimensionality by 35%. Evaluated on the comprehensive CICIoT2023 benchmark, the proposed system attains 99.53% overall accuracy and a weighted F1-score of 99.54%, with a macro-F1 of 0.81 reflecting the difficulty of ultra-rare classes. It narrows the detection gap for minority classes, improving Web-attack detection relative to the full-feature configuration. Practically, the model is highly efficient for edge gateways, with a reduced footprint of approximately 77 MB and an inference throughput exceeding 10,000 flows per second. These results confirm that a streamlined, ACO-optimized dual-ensemble can effectively secure IoT edges against both volumetric and stealthy threats.