Lightweight Intrusion Detection for Resource-Constrained IOT Devices Using Machine Learning

Billions of low-cost Internet of Things (IoT) devices run on microcontrollers with kilobytes of memory and no room for conventional intrusion detection, which has made them easy targets for botnets such as Mirai. This paper presents the design of a lightweight, machine-learning-based intrusion detection system (IDS) that runs on the IoT device itself. A hook in the device's TCP/IP stack updates a few counters for every packet in constant time; every 2 s these are turned into 20 traffic and host features, using 64-bit bitmaps to estimate distinct addresses and ports. A depth-limited decision tree or an 8-bit quantized multilayer perceptron classifies each window as benign or malicious, and a 3-of-5 vote across consecutive windows decides whether to block the source and raise an MQTT alert. An optional gateway tier names the attack type. A review of 16 related studies shows that most machine-learning IDS work is evaluated offline on datasets, uses features that a microcontroller cannot compute, and rarely reports how models generalise across datasets. Design analysis shows that the multilayer perceptron needs 490 parameters and 464 multiply–accumulate operations per window, a full depth-8 tree at most 2.6 KB, and the feature state under 0.3 KB, all within the budget of a Class 1 constrained device; the voting rule reduces expected false alarms from 43 to under 0.001 per day at a 0.1% per-window false-positive rate, assuming independent windows. A validation protocol using TON_IoT, CICIoT2023, Edge-IIoTset and N-BaIoT, including cross-dataset tests and on-device measurements, is provided