Hybrid AI Intrusion Detection: Balancing Accuracy and Efficiency.

Area of Science:

• Cybersecurity
• Artificial Intelligence
• Internet of Things (IoT)

Background:

• The Internet of Things (IoT) presents significant security challenges due to resource constraints, diverse protocols, and infrastructure heterogeneity.
• Traditional Intrusion Detection Systems (IDS) struggle with IoT's scale, interoperability, real-time demands, data privacy, and imbalanced traffic leading to false positives.

Purpose of the Study:

• To systematically evaluate and compare the performance and latency of representative AI models for IoT intrusion detection.
• To provide empirical insights for selecting appropriate AI models based on accuracy-latency trade-offs in heterogeneous IoT environments.

Main Methods:

• Comparative analysis of three AI models: Convolutional Neural Network-Bidirectional Long Short-Term Memory (CNN-BiLSTM), Random Forest, and XGBoost.
• Evaluation conducted on two benchmark datasets: NSL-KDD and UNSW-NB15.
• Quantification of detection performance (e.g., F1 score) and inference latency for each model.

Main Results:

• CNN-BiLSTM achieved the highest detection capability with an F1 score up to 0.986, but incurred higher computational overhead.
• XGBoost and Random Forest demonstrated competitive accuracy with significantly lower inference latency (sub-millisecond on conventional hardware).
• A clear trade-off between detection accuracy and inference latency was observed across the evaluated models.

Conclusions:

• The choice of AI model for IoT intrusion detection depends on the specific application's requirements for accuracy versus speed.
• CNN-BiLSTM is suitable for accuracy-critical applications, while XGBoost and Random Forest are viable for latency-sensitive scenarios.
• These findings support informed deployment decisions for effective security in diverse IoT ecosystems.