Lightweight Malicious Traffic Detection Model for Edge Scenarios: Co-Optimization of Detection Accuracy and Computational Overhead

With the widespread deployment of IoT devices, deploying efficient network traffic classification models on resource-constrained edge nodes is critical for real-time boundary security. However, traditional lightweight models primarily rely on macro-level structural pruning, which often sacrifices crucial feature extraction capabilities when handling complex heterogeneous traffic, leading to a severe imbalance between parameter compression and detection accuracy. To overcome this bottleneck, we propose TinyFlowNet, an ultra-lightweight multi-module fusion architecture. To prevent the parameter explosion inherent in combining CNN, LSTM, and Transformer modules, TinyFlowNet innovatively adopts an extreme operator-level reconstruction strategy. By introducing debiased computations, affine-free normalization, and a customized micro-self-attention mechanism, it comprehensively strips away underlying redundant parameters. Simultaneously, an integrated parameter-free regularization mechanism is introduced to compensate for the representational capacity lost under this extreme compression, ensuring robust spatio-temporal feature fusion. Comprehensive evaluations on the custom X-IDS-20 balanced dataset alongside the complex CICDarknet2020 and ToNIoT public datasets demonstrate that TinyFlowNet achieves exceptional accuracies of 95. 31 percent, 99. 53 percent, and 97. 13 percent, respectively. Furthermore, it exhibits formidable robustness against extreme class imbalances by securing a peak Matthews Correlation Coefficient of 0. 9465 and an outstanding PR-AUC of 0. 9834, all while strictly confining the parameter count to merely 74, 600. Crucially, actual on-device hardware profiling on a commercial edge device corroborates its deployment viability, exhibiting a minimal dynamic memory footprint of 8. 26 MB, an average inference latency of 0. 79 ms, and a processing throughput exceeding 1200 FPS. Compared to a standard heavy Hybrid CNN-LSTM-Transformer baseline, TinyFlowNet achieves superior detection accuracy while drastically reducing the parameter footprint by over 99. 3% and computational FLOPs by 95. 8%. Furthermore, against mainstream lightweight benchmarks like DistilBERT and heavy baselines such as LSTM, TinyFlowNet reduces parameters by 61. 4% to 94% while simultaneously achieving absolute accuracy leaps and accelerating inference speed by nearly 4× over MobileNetV2, establishing a highly efficient new paradigm for intelligent edge defense.