Network intrusion detection technology is key to cybersecurity regarding the Internet of Things (IoT). The traditional intrusion detection system targeting Binary or Multi-Classification can detect known attacks, but it is difficult to resist unknown attacks (such as zero-day attacks). Unknown attacks require security experts to confirm and retrain the model, but new models do not keep up to date. This paper proposes a Lightweight Intelligent NIDS using a One-Class Bidirectional GRU Autoencoder and Ensemble Learning. It can not only accurately identify normal and abnormal data, but also identify unknown attacks as the type most similar to known attacks. First, a One-Class Classification model based on a Bidirectional GRU Autoencoder is introduced. This model is trained with normal data, and has high prediction accuracy in the case of abnormal data and unknown attack data. Second, a multi-classification recognition method based on ensemble learning is proposed. It uses Soft Voting to evaluate the results of various base classifiers, and identify unknown attacks (novelty data) as the type most similar to known attacks, so that exception classification becomes more accurate. Experiments are conducted on WSN-DS, UNSW-NB15, and KDD CUP99 datasets, and the recognition rates of the proposed models in the three datasets are raised to 97.91%, 98.92%, and 98.23% respectively. The results verify the feasibility, efficiency, and portability of the algorithm proposed in the paper.

Network intrusion detection under severe class imbalance and diverse attack patterns often relies on reconstruction residuals. However, overlapping residual distributions, sparse tails, and distribution drift make single-threshold decision boundaries unstable and hard to reproduce. This study proposes a lightweight and reproducible intrusion detection framework based on Residual Threshold Validation (RTV) with a two-stage BiGRU autoencoder. In Phase 1, the autoencoder is trained on normal samples to learn a stable reconstruction baseline and per-dimension residual bounds. In Phase 2, weak supervision from coarse binary labels and class-conditional margin constraints enlarges inter-class separation in the residual space. During inference, Top-k aggregation generates a unified intrusion score, and the threshold is determined on a validation split and frozen for test evaluation. Experiments on KDDCUP99, UNSW-NB15, and WSN-DS show F1-scores of 0.9943, 0.9898, and 0.9795, with false-positive rates of 0.10%, 2.06%, and 2.43%. These results demonstrate both high accuracy and reproducible decision boundaries. The model size is 186-194 KB, enabling deployment in resource-constrained scenarios such as edge devices.