AHETFS: An Adaptive Hierarchical Ensemble with Temporal-Aware Feature Selection and Drift-Aware Aggregation for Real-Time IoT Intrusion Detection

Static gradient-boosting classifiers are frequently employed in IoT intrusion detection and perform well, although they often neglect temporal correlations in network traffic and are weak under concept drift. The Adaptive Hierarchical Ensemble with Temporal-Aware Feature Selection (AHETFS) framework for real-time IoT intrusion detection under shifting traffic distributions addresses these constraints. Four functionally related modules GAF/RP-based temporal feature engineering, attention-based feature routing, confidence-guided hierarchical inference, and EWMA-based drift-aware aggregation make up AHETFS. Temporal representations govern sample-specific and attack-aware feature routing, whereas prediction confidence determines whether a flow departs a lightweight classification layer or goes to deeper ensemble tiers. The EWMA mechanism adapts ensemble weights to distributional changes based on recent forecast errors. The system is tested using 123,117 network-flow samples from 11 classes from the public RT-IoT2022 dataset. AHETFS had an average single-flow inference latency of 9.62 ms, a batched throughput of 26,014 flows per second, and a serialised model size of 1.47 MB under the Google Colab experimental methodology. Early computational viability for real-time IoT intrusion detection is shown. We need cross-dataset evaluation and actual testing on physical, resource-constrained edge devices to prove the framework’s generalisation and deployment reliability.