Lightweight Anomaly-Based Intrusion Detection for IoT Networks Using Dispersion-Based Majority Class Reduction and Sparse Autoencoder Feature Extraction

The Internet of Things (IoT) has been a common target of network-level attacks due to its rapid growth, and anomaly-based intrusion detection powered by deep learning has emerged as a potential defense. The significant class imbalance found in IoT traffic captures and the restricted processing power on the gateway-level hardware where detection is expected to occur, are the two main challenges in this environment. The majority-reduction balancing techniques are still limited to non-IoT, non-deep learning settings and lack a tractable formulation at IoT-scale candidate-pool sizes, while autoencoder-based feature learning is almost exclusively paired with synthetic minority oversampling. This gap is filled by a collection of classifier heads of decreasing size are fed by the frozen encoder of a sparse autoencoder (SAE), which is trained without labels to develop a compact feature representation. Dispersion-based Majority Class Reduction (DMCR), which scores exactly via an order-statistics identity in \((O(ndlog n))\) time instead of the \((O(n^2))\) required by an all-pairs reading, achieves class balance instead of synthetic oversampling by keeping the most mutually dissimilar real majority samples instead of creating minority ones. Four configurations are compared using the BoT-IoT (5%) dataset. The balancing comparison is further validated against a classical random-undersampling baseline, against Cosine Similarity-based Majority Class Reduction (CSMCR), and against two synthetic-oversampling variants, ADASYN and Borderline-SMOTE, with every method, DMCR included, evaluated across multiple random seeds. A separate sensitivity analysis further shows that DMCR's stability depends on retaining a sufficiently filtered subset of its candidate pool: collapsing the pool and the retention target together reproduces a complete detection failure on the minority class in one seed out of three, a failure an aggregate F1 score does not reveal. Using DMCR instead of synthetic oversampling reduced training time by roughly one to two orders of magnitude while maintaining detection quality on a set that was about 116\((×)\) smaller and contained no fake data. A deeper, batch-normalized variant restored full ranking quality at less than a fifth of the baseline's size, while a compact MLP matched the convolutional baseline's zero-false-negative coverage at about a ninth of its parameter count. Results are evaluated with specific caution because of BoT-IoT's stereotypical, lab-generated traffic.