Adapting the IDS-ML Framework for Automated Attack Detection on Edge Devices

As modern networks expand, the volume and destructiveness of cyberattacks continue to escalate, necessitating effective defense mechanisms. Intrusion Detection Systems (IDSs) are critical for maintaining network security; however, traditional signature-based systems often fail to detect zero-day attacks. This study explores recent advancements in Deep Learning (DL) for cybersecurity by analyzing and replicating the “IDS-ML” framework, an open-source repository for IDS development. We evaluate the performance of five deep learning Convolutional Neural Network (CNN) architectures adapted for intrusion detection via transfer learning on the CICIDS2017 dataset, and propose an enhancement by integrating Automated Machine Learning (AutoML) techniques that achieves a 94.7% reduction in model parameters while maintaining comparable accuracy, thus making our enhanced models suitable for deployment on edge devices. We further validate deployment feasibility by benchmarking both the baseline InceptionV3 and AutoML models on a Raspberry Pi 4, demonstrating an 18.7× inference speedup and 3.5× CPU reduction, with no change in predicted classes from model conversion. Our results confirm that lightweight AutoML architectures enable practical “zero-touch” edge-based intrusion detection on resource-constrained hardware.