Sequential submodular feature-sample selection for lightweight and update-efficient IoT intrusion detection

The exponential expansion of the Internet of Things (IoT) has created a complex threat landscape that challenges traditional intrusion detection systems (IDS), particularly on edge devices with stringent computational and memory budgets. Beyond lightweight inference, practical IoT security increasingly requires on-device learning and frequent retraining so that models can adapt to evolving traffic patterns and emerging attacks; however, repeatedly training on high-dimensional data and large traffic corpora remains prohibitively expensive for resource-constrained devices. Existing lightweight IDS solutions often treat dimensionality reduction and data pruning as isolated tasks, leading to suboptimal representations and a lack of theoretical guarantees. To address this, we propose the Sequential Submodular Feature-Sample Selection (SSFSS) framework, a theoretically grounded approach that sequentially optimizes the feature and sample spaces to reduce training cost while preserving detection fidelity. First, we introduce Label-Aware Coreset Greedy-Based Feature Selection (LA-CGFS), which formulates feature selection as a label-conditioned facility location problem. This stage maximizes coverage across class manifolds, preserving discriminative power for minority attack classes without relying on synthetic oversampling. Second, we employ a geometry-aware coreset selection strategy that minimizes geometric coverage error in the reduced feature space. By leveraging the submodular property of diminishing returns, SSFSS provides a proven [Formula: see text] approximation guarantee to the optimal subset. Extensive evaluation on the RT-IoT2022, Edge-IIoTset, and CICIoT2023 datasets demonstrates that SSFSS reduces the feature space to 20 features and the training set to as little as 5% of the original samples, achieving average training speedups of up to [Formula: see text] and up to a 96% reduction in peak training RAM; even when the one-time coreset-construction cost is included, the end-to-end pipeline remains faster than a single full-data fit. Across four differentiable empirical-risk-minimization classifiers (kernel logistic regression, kernel SVM, kernel ridge, and softmax regression), the best reduced model retains 97.5-99.5% accuracy at [Formula: see text] budget, and the weighted coreset improves macro-F1 and balanced accuracy on the imbalanced benchmarks. Supported by the reported results, we position the proposed SSFSS framework as an efficient update-aware preprocessing framework whose measured speedups and RAM consumption motivate deployment on resource-constrained edge hardware.