KronNet a lightweight Kronecker enhanced feed forward neural network for efficient IoT intrusion detection

Area of Science:

• Cybersecurity
• Machine Learning
• Network Security

Background:

• The proliferation of Internet of Things (IoT) devices presents significant cybersecurity challenges due to their limited computational resources.
• Existing intrusion detection systems (IDS) often struggle to meet the performance demands within these constrained environments.
• Developing lightweight and efficient IDS is crucial for securing the expanding IoT ecosystem.

Purpose of the Study:

• To introduce KronNet, a novel, lightweight feed-forward neural network designed for real-time intrusion detection in IoT environments.
• To address the challenges of class imbalance and resource constraints in IoT security.
• To evaluate the performance and efficiency of KronNet against established datasets and state-of-the-art methods.

Main Methods:

• KronNet utilizes Kronecker product operations within a feed-forward neural network architecture.
• Gaussian Mixture Model (GMM)-based oversampling is employed to mitigate class imbalance.
• A hybrid loss function combining Focal Loss and Cross-Entropy with adaptive class weighting is implemented.
• The model's performance is validated on the CICIoT2023 and BoT-IoT datasets.

Main Results:

• KronNet achieved high detection accuracies (99.01% on CICIoT2023, 99.91% on BoT-IoT) and weighted F1-scores.
• The system demonstrated exceptionally low false positive rates (0.03% and 0.01%).
• KronNet exhibits minimal computational overhead, with low parameter counts (e.g., 19.82 KB) and fast inference times (e.g., 0.209 ms).
• Post-quantization, memory usage was significantly reduced (e.g., 4.96 KB) with negligible accuracy loss.

Conclusions:

• KronNet offers a highly efficient and accurate solution for real-time intrusion detection in resource-constrained IoT environments.
• Its lightweight design and superior performance metrics make it suitable for edge deployment.
• The model significantly outperforms existing state-of-the-art methods in terms of computational efficiency and detection capabilities.