A lightweight flow-based intrusion detection system is proposed for identifying Mirai-based distributed denial-of-service attacks in Internet of Things (IoT) environments. Efficient intrusion detection at the network edge is essential for resource-constrained IoT deployments, where devices operate with limited processing, memory, and energy resources, making centralized or computationally intensive solutions impractical in real-world scenarios. Network traffic is represented using statistical and temporal features extracted from unidirectional flows constructed from the TII-SSRC-23 dataset. A balanced subset of 10,000 samples is used for training and evaluation, ensuring balanced data distribution and improving generalization across different traffic conditions. Three machine learning models, a multilayer perceptron, a support vector machine, and LightGBM, are investigated to evaluate trade-offs between detection performance, complexity, and suitability for deployment in resource-constrained edge environments. Experimental results show that LightGBM achieves the best performance, obtaining an accuracy of 0.99, an F1-score of 1.00, and an AUC of 1.00, while consistently maintaining a low false positive rate. The selected model is deployed on the NVIDIA Jetson Orin Nano platform for real-time inference under resource constraints and evaluated for continuous operational performance. The system operates with low latency and reduced memory and computational requirements, making it highly suitable for edge IoT security scenarios.
Diaz-Gorrin et al. (Thu,) studied this question.