A lightweight attention-based hybrid GhostNet model for enhanced IoT threat detection

Purpose Internet of things (IoT) networks have grown cyber-attack exponentially, which demands efficient intrusion detection systems with high accuracy and interpretability. Existing deep learning (DL) techniques are usually heavily computationally expensive and non-interpretable and therefore are not viable in resource-constrained IoT scenarios. Design/methodology/approach To bridge this gap, this paper introduces sustainable lightweight attention-based GhostNet-LSTM (LAGL), a novel hybrid model which consists of an efficient lightweight GhostNet structure for extracting features, a long short-term memory network to capture temporal information and an attention mechanism to enhance both detection accuracy and model interpretability. The LAGL model was evaluated on the large-scale CICIoT2023 dataset and showed improved performance over the baseline CNN-LSTM model. Findings This essential reduction in model complexity directly explains lower memory requirements and faster processing. The model supports sustainability in computing of the IoT systems; thus, it is highly suitable for deployment on resource-constrained IoT gateways where traditional DL models are often infeasible. The attention weights also provide crucial insights into the model’s decision-making process, addressing the critical black-box problem. The first specific quantitative finding showed that the LAGL model achieved a higher F1 score (0.9844) than the baseline CNN-LSTM, demonstrating superior classification performance. This reduced the trainable parameters by 27.3%, a demonstration of its ability to provide the best balance solution for deploying real-world IoT security applications. Originality/value In addition to computational effectiveness, in this paper, the model is viewed as a design that relies on limited intelligence, energy sensitivity, interpretability and long-term operation sustainability. LAGL model purposefully avoids extensive complexity, hence promoting responsible, goal-oriented AI implementation, but not just trying to maximize its performance. The proposed model can not only support explainable, real-time intrusion detection at the IoT edge but also support human-in-the-loop security processes and reduce energy usage, hardware reliance and lifecycle costs at the same time.