Lightweight LSTM-Based Homogeneous Transfer Learning for Efficient On-Device IoT Intrusion Detection

The emergence of the Internet of Things (IoT) has introduced major security challenges. Deep learning models have shown strong potential for intrusion detection. However, they often require large datasets and high computational resources. In contrast, IoT environments are resource-constrained and lack sufficient labeled data. This paper proposes a lightweight intrusion detection approach based on Long Short-Term Memory (LSTM) networks and homogeneous transfer deep learning. The model is first trained on a subset of the BoT-IoT dataset as a source domain. It is then fine-tuned on a disjoint subset containing a rare attack type. This setup represents adaptation to unseen attack behaviors within the same environment. By freezing earlier layers and fine-tuning only the final layers, the method reduces training overhead while preserving performance. This is important to meet the IoT requirement for frequent, lightweight model updates on resource-constrained devices. The proposed model achieved 99.9% accuracy, a macro F1-score of 0.96, and a 47.8% reduction in training time compared to training from scratch. Extensive experiments confirm that it maintains balanced detection across both common and rare classes.