Lightweight Machine Learning Models for Intrusion Detection on IoT Devices

Abstract

The Internet of Things (IoT) continues to expand rapidly, yet IoT devices often lack on-device Intrusion Detection Systems (IDS) due to strict CPU, RAM, and memory limitations. While prior research has explored machine learning-based IDS, relatively few studies have evaluated models under realistic resource constraints. In this paper, we assess the feasibility of lightweight and efficient machine learning models for multiclass intrusion detection using the ToN_IoT dataset. We compare a Decision Tree (DT), Light Gradient Boosting Machine (LightGBM), a Feedforward Neural Network (FNN), and a TinyML-optimized FNN. Our results show that the TinyML FNN provides the best balance between accuracy and deployability, achieving an F1-Score of 0.976, an inference throughput of ≈120,000 packets per second, and a model size of only 31 KB. These findings demonstrate that TinyML-optimized neural networks are strong candidates for practical on-device intrusion detection on highly resource-constrained IoT devices.