Lightweight Edge Detection and High-Precision Cloud Classification: A Cloud-Edge Collaborative Two-Stage NIDS Architecture

Network Intrusion Detection Systems (NIDS) face a trade-off between detection accuracy and computing efficiency, particularly in the edge environment with strict real-time requirements and limited resources. Current approaches rely on complicated models, which are computationally demanding, or simple ones, which sacrifice detection performance. To deal with this issue, we propose a lightweight cloud-edge cooperative two-stage NIDS architecture, which separates the real-time detection and detailed classification. At the edge, a decision tree based on feature selection is used for rapid binary classification by using only the top 10 most informative features, thus efficiently screening out abnormal traffic with minimum processing cost. Meanwhile, the cloud server identifies attack classification accurately by using a hybrid CNN-BiLSTM-Attention model to capture the spatial structures, temporal relationships, and semantic relevance. This hierarchical design effectively balances detection performance and system efficiency. Experiments conducted on UNSW-NB15, NSL-KDD, and CIC-IDS2017 datasets indicate that our suggested scheme can obtain competitive performance both at the edge and in the cloud. The edge model obtains binary classification accuracy of 86.04%, 95.27%, and 99.01%, respectively, with very low processing cost (less than 100 FLOPs per sample). The cloud model achieves multi-class accuracy of 92.23%, 97.18%, and 98.66%, respectively, with AUC values higher than 0.98. The hierarchical cloud–edge collaborative design provides an efficient and accurate solution for intrusion detection under resource-restricted situations.