A Lightweight Hybrid Cnn-Lstm Intrusion Detection System for Resource-Constrained Iot Networks
TL;DR
This paper builds a hybrid CNN-LSTM classifier and, instead of shrinking it after the fact, design it to be small from the start: depthwise-separable convolutions handle the spatial side, a deliberately narrow LSTM layer picks up temporal patterns across flow sequences, and the whole thing goes through structured pruning and post-training quantization before it ever gets tested.
Abstract
IoT devices keep multiplying, and so do the ways attackers can get into them. Most of these devices simply don't have the CPU, RAM, or power budget to run the deep learning-based intrusion detection systems (IDS) that perform best in the research literature, which creates a real gap between what's accurate and what's actually deployable. In this paper we build a hybrid CNN-LSTM classifier and, instead of shrinking it after the fact, we design it to be small from the start: depthwise-separable convolutions handle the spatial side, a deliberately narrow LSTM layer picks up temporal patterns across flow sequences, and the whole thing goes through structured pruning and post-training quantization before it ever gets tested. We ran it against TON_IoT and IoTID20, two datasets built from different testbeds with different attack mixes, and stacked it up against Random Forest, SVM, and plain (uncompressed) CNN and LSTM models. The compressed hybrid model came out ahead on both datasets - 98.6% accuracy on TON_IoT, 97.9% on IoTID20 - while ending up about 71% smaller and 58% faster at inference than its own uncompressed version. So it seems like joint design (architecture and compression together, not compression bolted on later) is a workable path to models that are both accurate and small enough to actually run at the edge. We close with a look at the accuracy/latency/energy trade-offs we hit along the way, and where this could go next - federated learning, online updates, that kind of thing.