Internet of Things (IoT) devices are leading to advancements in innovation, efficiency, and sustainability across various industries. However, as the number of connected IoT devices increases, the risk of intrusion becomes a major concern in IoT security. To prevent intrusions, it is crucial to implement intrusion detection systems (IDSs) that can detect and prevent such attacks. IDSs are a critical component of cybersecurity infrastructure. They are designed to detect and respond to malicious activities within a network or system. Traditional IDS methods rely on predefined signatures or rules to identify known threats, but these techniques may struggle to detect novel or sophisticated attacks. The implementation of IDSs with machine learning (ML) and deep learning (DL) techniques has been proposed to improve IDSs’ ability to detect attacks. This will enhance overall cybersecurity posture and resilience. However, ML and DL techniques face several issues that may impact the models’ performance and effectiveness, such as overfitting and the effects of unimportant features on finding meaningful patterns. To ensure better performance and reliability of machine learning models in IDSs when dealing with new and unseen threats, the models need to be optimized. This can be done by addressing overfitting and implementing feature selection. In this paper, we propose a scheme to optimize IoT intrusion detection by using class balancing and feature selection for preprocessing. We evaluated the experiment on the UNSW-NB15 dataset and the NSL-KD dataset by implementing two different ensemble models: one using a support vector machine (SVM) with bagging and another using long short-term memory (LSTM) with stacking. The results of the performance and the confusion matrix show that the LSTM stacking with analysis of variance (ANOVA) feature selection model is a superior model for classifying network attacks. It has remarkable accuracies of $96.92\%$ and $99.77\%$ and overfitting values of $0.33\%$ and $0.04\%$ on the two datasets, respectively. The model’s ROC is also shaped with a sharp bend, with AUC values of $0.9665$ and $0.9971$ for the UNSW-NB15 dataset and the NSL-KD dataset, respectively.

The rapid growth of Internet of Things (IoT) networks has increased security risks, making it essential to have effective Intrusion Detection Systems (IDS) for real-time threat detection. Deep learning techniques offer promising solutions for such detection due to their superior complex pattern recognition and anomaly detection capabilities in large datasets. This paper proposes an optimized ensemble-based IDS designed specifically for efficient deployment on edge hardware. However, deploying such computationally intensive models on resource-limited edge devices remains a significant challenge due to model size and computational overhead on devices with limited processing capabilities. Building upon our previously developed stacked Long Short-Term Memory (LSTM) model integrated with ANOVA feature selection, we optimize it by integrating dual-stage model compression: pruning and quantization to create a lightweight model suitable for real-time inference on Raspberry Pi devices. To evaluate the system under realistic conditions, we combined with a Kafka-based testbed to simulate dynamic IoT environments with variable traffic loads, delays, and multiple simultaneous attack sources. This enables the assessment of detection performance under varying traffic volumes, latency, and overlapping attack scenarios. The proposed system maintains high detection performance with accuracy of 97.3% across all test scenarios, while efficiently leveraging multi-core processing with peak CPU usage reaching 111.8%. These results demonstrate the system’s practical viability for real-time IoT security at the edge.