ExLightNet: A Lightweight and Explainable 1D-CNN for Real-Time Intrusion Detection in Resource-Constrained IoT Sensor Networks

Internet of Things (IoT) and Internet of Medical Things (IoMT) sensor deployments are pushing security decision-making from centralised servers towards resource-constrained edge gateways, where heavyweight deep learning detectors exceed the available compute, memory, and latency budgets, and where opaque alarms erode operator trust. This paper proposes ExLightNet, a lightweight one-dimensional convolutional neural network that couples depthwise-separable convolutions and squeeze-and-excitation channel attention with a tempered class-balanced training recipe (focal loss plus f−1 sampling) and per-channel INT8 weight quantisation, and attaches SHAP attributions directly to the deployed model. We evaluate the framework on the public RT-IoT2022 benchmark of 123,117 real bidirectional flows from smart-home and sensor IoT devices spanning nine attack behaviours and three normal device classes, an environment representative of the auxiliary sensing layer of home-based care settings. ExLightNet attains an attack-class recall (sensitivity) of 0.9976, missing only 40 of 16,592 attack flows, with macro-F1 0.9860 and AUC 0.9985 for binary attack detection (the 99.49% accuracy is retained for comparability with prior work, but accuracy is a misleading headline metric under the severe class imbalance of network traffic), and a macro-recall of 0.863 (97.70% accuracy, macro-F1 0.8621) across twelve fine-grained classes, surpassing a 4.5× larger standard CNN on the binary task while remaining within 0.0021 macro-F1 of Random Forest. Post-quantisation, the model shrinks from 162 KB to 37 KB (4.4×) with a macro-F1 drop of at most 0.007, sustaining 0.50 ms single-flow CPU latency, 66× faster than an accuracy-equivalent Random Forest. On a Raspberry Pi 4 gateway, the INT8 model sustains 2197 flow decisions per second across four Cortex-A72 cores, 21.4× faster than an accuracy-equivalent Random Forest, confirming the deployment profile on measured gateway-class hardware. SHAP analysis shows that forward payload statistics, backward header-size extremes, and packet-rate features dominate decisions, yielding operator-readable rationales.