What does this research mean for the field?

The lightweight attention-based GhostNet-LSTM (LAGL) model achieves superior IoT intrusion detection performance (F1 score 0.9844) while reducing trainable parameters by 27.3% compared to baseline models, providing an interpretable and computationally sustainable solution for resource-constrained edge devices. Novelty: ClaimNovelty.METHODOLOGICAL. Consensus alignment: ConsensusAlignment.NEUTRAL.

What question did this study set out to answer?

The research aims to develop an efficient and interpretable model for IoT threat detection that performs well in resource-limited conditions.

April 8, 2026

A lightweight attention-based hybrid GhostNet model for enhanced IoT threat detection

Key Points

The research aims to develop an efficient and interpretable model for IoT threat detection that performs well in resource-limited conditions.
Introduced a lightweight hybrid model combining GhostNet for feature extraction, LSTM for temporal information, and an attention mechanism.
Evaluated the model using the large-scale CICIoT2023 dataset.
Compared the performance of LAGL against a baseline CNN-LSTM model.
Achieved an F1 score of 0.9844, surpassing the baseline CNN-LSTM's performance.
Reduced the number of trainable parameters by 27.3%, indicating lower complexity and computational efficiency.
Demonstrated faster processing and lower memory requirements suitable for IoT systems.

Abstract

Purpose Internet of things (IoT) networks have grown cyber-attack exponentially, which demands efficient intrusion detection systems with high accuracy and interpretability. Existing deep learning (DL) techniques are usually heavily computationally expensive and non-interpretable and therefore are not viable in resource-constrained IoT scenarios. Design/methodology/approach To bridge this gap, this paper introduces sustainable lightweight attention-based GhostNet-LSTM (LAGL), a novel hybrid model which consists of an efficient lightweight GhostNet structure for extracting features, a long short-term memory network to capture temporal information and an attention mechanism to enhance both detection accuracy and model interpretability. The LAGL model was evaluated on the large-scale CICIoT2023 dataset and showed improved performance over the baseline CNN-LSTM model. Findings This essential reduction in model complexity directly explains lower memory requirements and faster processing. The model supports sustainability in computing of the IoT systems; thus, it is highly suitable for deployment on resource-constrained IoT gateways where traditional DL models are often infeasible. The attention weights also provide crucial insights into the model’s decision-making process, addressing the critical black-box problem. The first specific quantitative finding showed that the LAGL model achieved a higher F1 score (0.9844) than the baseline CNN-LSTM, demonstrating superior classification performance. This reduced the trainable parameters by 27.3%, a demonstration of its ability to provide the best balance solution for deploying real-world IoT security applications. Originality/value In addition to computational effectiveness, in this paper, the model is viewed as a design that relies on limited intelligence, energy sensitivity, interpretability and long-term operation sustainability. LAGL model purposefully avoids extensive complexity, hence promoting responsible, goal-oriented AI implementation, but not just trying to maximize its performance. The proposed model can not only support explainable, real-time intrusion detection at the IoT edge but also support human-in-the-loop security processes and reduce energy usage, hardware reliance and lifecycle costs at the same time.

Bookmark

Cite This Study

Altrad et al. (Mon,) studied this question.

synapsesocial.com/papers/69d5f03374eaea4b11a799bd https://doi.org/https://doi.org/10.1108/techs-10-2025-0233

Bookmark