Invariant state modelling for robust adaptive intrusion detection in software-defined internet of things environments

In the modern era, Software-Defined Internet of Things (SD-IoT) networks struggle with various challenges that include heterogeneous traffic, high-throughput limitations and non-recurrent or non-stationary attacks. Therefore, to address these gaps, a unified and deployable IDS framework, namely Robust Adaptive Intrusion Detection Using Invariant State (RADIUS) is designed. In particular, the proposed RADIUS framework utilizes a Temporal Convolution Encoder (TCE) that includes dilated and causal convolutions, which assist in constructing efficient traffic embeddings. Subsequently, an Adaptive State Transition Module (ASTM) is incorporated, which identifies latent state transitions that demonstrate interpretable and adaptive detections. Further, training the RADIUS framework uses dual-objective optimization, which minimizes both prediction accuracy and requires environment-invariance and sensitivity to rare events. Thus, both anomaly scores and classification calibration are attained through Extreme Value Theory (EVT) using conformal bounds. Hence, the proposed RADIUS framework achieves 99.8% accuracy, 99.5% precision, 99.8% recall, and 99.7% F1-score consistently, which outperforms the existing Extended Wrapper Approach (EWA) model. The EWA, a hybrid of deep learning and feature optimization, offers a favorable balance between detection accuracy and deployment efficiency in resource-constrained SD-IoT environments and is therefore used as the primary quantitative baseline for ablation comparisons.