A Lightweight Hybrid Convolutional Neural Network–Long Short-Term Memory (CNN–LSTM) and AdaBoost Framework for Edge-Based Internet of Things (IoT) Intrusion Detection

As Internet of Things (IoT) infrastructure scales, the demand for reliable intrusion detection systems increases. However, modern hybrid deep learning architectures are often too computationally heavy for resource-constrained edge gateways. This study introduces a TinyML-optimized 1D Convolutional Neural Network-Long Short-Term Memory (CNN-LSTM) and AdaBoost framework to address these hardware limitations. Using a merged UNSW-NB15 and RT-IoT2022 dataset stratified into a 70/30 normal-to-attack split, the methodology applies Correlation-Based Elimination and Mutual Information to select the top 30 network features (K-30). A custom Focal Loss function handles class imbalance natively without requiring synthetic data overhead. The core CNN-LSTM extracts deep spatiotemporal features, which are then passed to an AdaBoost ensemble. Sigmoid calibration is applied to restrict the False Positive Rate, and the entire pipeline is compressed via TensorFlow Lite dynamic range quantization. Deployed inside a simulated Docker-based edge gateway processing three continuous CCTV video streams, the quantized model occupied just 24 KB of memory. It consumed 23.8% of the host CPU and maintained an inference latency of ~60.16 ms under load. While yielding a raw accuracy of 94.87%, the mathematically calibrated threshold secured a False Positive Rate of 1.94%. These results demonstrate that structural compression and strict feature reduction provide viable, real-time edge security without overloading host hardware.