Traffic-to-Image-Based IoT Intrusion Detection: Multi-Dataset Performance and Efficiency Analysis

This study presents a unified traffic-to-image-based intrusion detection framework evaluated across three heterogeneous IoT/IIoT benchmark datasets: CICIoT2023, TON-IoT, and Edge-IIoTset. MobileViT-XXS, EfficientNet-B0, and Swin-Tiny were systematically compared in terms of classification performance and computational efficiency. Under the controlled class-wise window construction protocol, MobileViT-XXS achieved a macro-F1 of 98.12% on CICIoT2023, while Swin-Tiny reached 99.88% and 100% on Edge-IIoTset and TON-IoT, respectively. Five-seed experiments characterized performance variability across training runs, with mean macro-F1 scores of 97.21% for MobileViT-XXS on CICIoT2023 and 99.53% and 99.17% for Swin-Tiny on Edge-IIoTset and TON-IoT, respectively. Sensitivity analyses showed generally strong performance across alternative representation settings. However, under label-independent window construction, MobileViT-XXS macro-F1 on CICIoT2023 decreased to 35.72%, with a mean window purity of 12.75%, revealing a substantial limitation of the class-wise representation under heterogeneous traffic conditions. Efficiency analysis further showed that MobileViT-XXS provides substantially lower model size and parameter count than the larger architectures, while the reported latency and throughput measurements reflect performance on the NVIDIA A100 experimental platform. Overall, the results establish performance–efficiency trade-offs under controlled class-wise evaluation while highlighting the need for label-independent validation before drawing conclusions about practical intrusion detection performance.