Lightweight Intrusion Detection for Resource-Constrained IOT Devices Using Machine Learning

Abstract

Billions of low-cost Internet of Things (IoT) devices run on microcontrollers with kilobytes of memory and no room for conventional intrusion detection, which has made them easy targets for botnets such as Mirai. This paper presents the design of a lightweight, machine-learning-based intrusion detection system (IDS) that runs on the IoT device itself. A hook in the device\'s TCP/IP stack updates a few counters for every packet in constant time; every 2 s these are turned into 20 traffic and host features, using 64-bit bitmaps to estimate distinct addresses and ports. A depth-limited decision tree or an 8-bit quantized multilayer perceptron classifies each window as benign or malicious, and a 3-of-5 vote across consecutive windows decides whether to block the source and raise an MQTT alert. An optional gateway tier names the attack type. A review of 16 related studies shows that most machine-learning IDS work is evaluated offline on datasets, uses features that a microcontroller cannot compute, and rarely reports how models generalise across datasets. Design analysis shows that the multilayer perceptron needs 490 parameters and 464 multiply–accumulate operations per window, a full depth-8 tree at most 2.6 KB, and the feature state under 0.3 KB, all within the budget of a Class 1 constrained device; the voting rule reduces expected false alarms from 43 to under 0.001 per day at a 0.1% per-window false-positive rate, assuming independent windows. A validation protocol using TON_IoT, CICIoT2023, Edge-IIoTset and N-BaIoT, including cross-dataset tests and on-device measurements, is provided.

Introduction

This research focuses on developing a lightweight, machine-learning-based Intrusion Detection System (IDS) for resource-constrained Internet of Things (IoT) devices. IoT devices such as smart cameras, sensors, smart plugs, and controllers are vulnerable to cyberattacks because they often use weak default passwords, have limited security features, and receive infrequent software updates. The Mirai botnet demonstrated how compromised IoT devices can be used to launch large-scale Distributed Denial-of-Service (DDoS) attacks.

Traditional machine-learning-based IDS solutions generally require considerable memory and processing power, making them unsuitable for low-cost microcontrollers. Therefore, this research proposes an IDS that can operate directly on IoT devices with limited hardware resources.

The proposed system uses network traffic and host-based features to identify suspicious activities and classify device behaviour as normal or malicious. It extracts 20 lightweight features, including packet counts, packet sizes, TCP and UDP traffic, connection attempts, destination ports, memory usage, and CPU load. These features are calculated over fixed two-second monitoring windows using memory-efficient techniques.

Two machine-learning models are proposed for on-device intrusion detection:

• Decision Tree: A lightweight model suitable for highly resource-constrained devices.

• INT8 Multilayer Perceptron (MLP): A quantized neural network designed for devices with slightly higher computational capacity.

A k-of-n voting mechanism is introduced to reduce false alarms by requiring multiple consecutive suspicious predictions before generating an alert. When an attack is detected, the device can block or limit the suspicious source and send an MQTT notification to the gateway. An optional gateway-based model can provide more detailed attack classification.

The literature review examines 16 related studies covering IoT security threats, intrusion detection techniques, public datasets, and machine-learning models for constrained hardware. It identifies three major research gaps:

1. Many existing IDS models use network features that cannot be calculated directly on low-cost IoT devices.

2. Existing machine-learning models often require more memory than resource-constrained devices can provide.

3. Many studies lack sufficient cross-dataset testing, making it difficult to determine whether models perform reliably under different network conditions.

The proposed methodology uses four public datasets: TON_IoT, CICIoT2023, Edge-IIoTset, and N-BaIoT. The datasets will be processed using the same feature-extraction code implemented on the IoT device. The system will also be evaluated on a physical ESP32-C3 testbed using attacks such as SYN floods, UDP floods, ICMP floods, port scanning, brute-force login attempts, and resource-exhaustion attacks.

System performance will be evaluated using precision, recall, F1-score, false-positive rate, detection delay, memory consumption, processing overhead, and throughput impact. The proposed performance targets include an F1-score of at least 0.95 within individual datasets, a false-positive rate below 0.5%, detection delay below 10 seconds, and memory usage within the specified hardware limits.

The expected outcome is a compact and efficient intrusion detection system capable of detecting common cyberattacks directly on IoT devices without depending entirely on powerful external servers. It aims to improve IoT security through real-time monitoring, lightweight machine-learning models, reduced false alarms, and automatic threat response.

Conclusion

This paper presented a lightweight machine-learning intrusion detection system for resource-constrained IoT devices. A packet hook updates fixed-size state in constant time, 20 features are computed every 2 s, and a depth-limited decision tree or an INT8 perceptron of 490 parameters classifies each window, with a 3-of-5 vote controlling false alarms and a local block-and-alert response. The design needs at most a few kilobytes of flash and under 1 KB of RAM, within the budget of a Class 1 constrained device. A review of 16 studies showed that this focus on features computable on the device, small models and cross-dataset evaluation addresses the main obstacles to deploying machine-learning IDS on IoT hardware.

References

[1] C. Kolias, G. Kambourakis, A. Stavrou, and J. Voas, “DDoS in the IoT: Mirai and other botnets,” Computer, vol. 50, no. 7, pp. 80–84, 2017. [2] M. Antonakakis, T. April, M. Bailey, M. Bernhard, E. Bursztein et al., “Understanding the Mirai botnet,” in Proc. 26th USENIX Security Symposium, 2017, pp. 1093–1110. [3] C. Bormann, M. Ersue, and A. Keränen, “Terminology for constrained-node networks,” IETF RFC 7228, May 2014. [4] K. A. P. da Costa, J. P. Papa, C. O. Lisboa, R. Munoz, and V. H. C. de Albuquerque, “Internet of Things: A survey on machine learning-based intrusion detection approaches,” Computer Networks, vol. 151, pp. 147–157, 2019, doi: 10.1016/j.comnet.2019.01.023. [5] S. Raza, L. Wallgren, and T. Voigt, “SVELTE: Real-time intrusion detection in the Internet of Things,” Ad Hoc Networks, vol. 11, pp. 2661–2674, 2013, doi: 10.1016/j.adhoc.2013.04.014. [6] Y. Meidan, M. Bohadana, Y. Mathov, Y. Mirsky, A. Shabtai, D. Breitenbacher, and Y. Elovici, “N-BaIoT—Network-based detection of IoT botnet attacks using deep autoencoders,” IEEE Pervasive Computing, vol. 17, no. 3, pp. 12–22, 2018. [7] Y. Mirsky, T. Doitshman, Y. Elovici, and A. Shabtai, “Kitsune: An ensemble of autoencoders for online network intrusion detection,” in Proc. Network and Distributed System Security Symposium (NDSS), San Diego, CA, USA, 2018. [8] R. Doshi, N. Apthorpe, and N. Feamster, “Machine learning DDoS detection for consumer Internet of Things devices,” in Proc. IEEE Security and Privacy Workshops (SPW), 2018, pp. 29–35, doi: 10.1109/SPW.2018.00013. [9] N. Koroniotis, N. Moustafa, E. Sitnikova, and B. Turnbull, “Towards the development of realistic botnet dataset in the Internet of Things for network forensic analytics: Bot-IoT dataset,” arXiv:1811.00701, 2018. [10] A. Alsaedi, N. Moustafa, Z. Tari, A. Mahmood, and A. Anwar, “TON_IoT telemetry dataset: A new generation dataset of IoT and IIoT for data-driven intrusion detection systems,” IEEE Access, vol. 8, pp. 165130–165150, 2020, doi: 10.1109/ACCESS.2020.3022862. [11] M. A. Ferrag, O. Friha, D. Hamouda, L. Maglaras, and H. Janicke, “Edge-IIoTset: A new comprehensive realistic cyber security dataset of IoT and IIoT applications for centralized and federated learning,” IEEE Access, vol. 10, pp. 40281–40306, 2022. [12] E. C. P. Neto, S. Dadkhah, R. Ferreira, A. Zohourian, R. Lu, and A. A. Ghorbani, “CICIoT2023: A real-time dataset and benchmark for large-scale attacks in IoT environment,” Sensors, vol. 23, no. 13, Art. no. 5941, 2023, doi: 10.3390/s23135941. [13] Z. Alwaisi, T. Kumar, E. Harjula, and S. Soderi, “Securing constrained IoT systems: A lightweight machine learning approach for anomaly detection and prevention,” Internet of Things, vol. 28, Art. no. 101398, 2024, doi: 10.1016/j.iot.2024.101398. [14] A. Javed, A. Ehtsham, M. Jawad, M. N. Awais, A.-u.-H. Qureshi, and H. Larijani, “Implementation of lightweight machine learning-based intrusion detection system on IoT devices of smart homes,” Future Internet, vol. 16, no. 6, Art. no. 200, 2024, doi: 10.3390/fi16060200. [15] P. Fusco, G. P. Rimoli, and M. Ficco, “TinyIDS – An IoT intrusion detection system by tiny machine learning,” in Lecture Notes in Computer Science, vol. 14816, Springer, 2024, pp. 71–82, doi: 10.1007/978-3-031-65223-3_5. [16] J. Lundqvist, A. Hadzic, T. M. Kirkeluten, H. Pedersen, J. Holth, M. H. Johansson, and M. P. N. Halkjelsvik, “Lightweight machine learning models for intrusion detection on IoT devices,” in Proc. Norsk IKT-konferanse for forskning og utdanning (NIKT), vol. 37, no. 3, 2025, doi: 10.5324/jrxdjb92. [17] E. P. De Bernardis, O. Kuznetsov, M. Arnesano, P. Zhansaya, and M. Sydykova, “Lightweight machine learning intrusion detection for IoT/IIoT networks: Quantisation strategies and physical deployment on resource-constrained microcontrollers,” Electronics, no. 13, Art. no. 2869, 2026, doi: 10.3390/electronics15132869. [18] L. Breiman, “Random forests,” Machine Learning, vol. 45, no. 1, pp. 5–32, 2001. [19] T. Chen and C. Guestrin, “XGBoost: A scalable tree boosting system,” in Proc. 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, 2016, pp. 785–794. [20] G. Ke, Q. Meng, T. Finley, T. Wang, W. Chen, W. Ma, Q. Ye, and T.-Y. Liu, “LightGBM: A highly efficient gradient boosting decision tree,” in Advances in Neural Information Processing Systems (NeurIPS), vol. 30, 2017. [21] B. Jacob, S. Kligys, B. Chen, M. Zhu, M. Tang, A. Howard, H. Adam, and D. Kalenichenko, “Quantization and training of neural networks for efficient integer-arithmetic-only inference,” in Proc. IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2018, pp. 2704–2713. [22] R. David, J. Duke, A. Jain, V. Janapa Reddi, N. Jeffries et al., “TensorFlow Lite Micro: Embedded machine learning for TinyML systems,” in Proc. Machine Learning and Systems (MLSys), vol. 3, pp. 800–811, 2021. [23] F. Pedregosa, G. Varoquaux, A. Gramfort, V. Michel, B. Thirion et al., “Scikit-learn: Machine learning in Python,” Journal of Machine Learning Research, vol. 12, pp. 2825–2830, 2011. [24] Espressif Systems, “ESP32-C3 series datasheet,” technical documentation. [25] OASIS, “MQTT version 3.1.1,” OASIS Standard, A. Banks and R. Gupta, Eds., Oct. 2014.

Copyright

Copyright © 2026 Rakhi Kumari, Priti Kumari, Khushbu Kumari, Mahi Kumari. This is an open access article distributed under the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.