With the rapid deployment of the Internet of Things (IoT) in critical domains such as power and industrial systems, the number of IoT devices has surged, accompanied by increasingly severe network security risks. IoT networks face diverse threats, including distributed denial-of-service attacks, advanced persistent threats, and data theft or tampering, while traditional detection and defense, lacking deep feature analysis, struggle with complex and unknown attacks, degrading security threat event detection. To this end, this paper proposes an IoT network security threat detection algorithm that integrates symmetric linear routing with a sparse mixture-of-experts model. The algorithm consists of a ConvNeXt feature extractor and a sparse BiLSTM expert layer, with symmetric linear routing embedded in the gating module. ConvNeXt provides refined global and local representations, Top-K gated BiLSTM experts for the module sequence-level dependencies among ordered features, and symmetric linear routing suppresses routing bias, enabling efficient and robust detection of IoT security threats. Experimental results on the CIC-IDS2018, TON-IoT, and BoT-IoT datasets indicate that the proposed IoT network security threat detection algorithm achieves accuracies of 94.08%, $99.99\pm 0.01$%, and 99.78%, respectively. Comparative experiments show the proposed algorithm outperforms baseline and state-of-the-art models, while the ablation and Top-K studies confirm module effectiveness for IoT intrusion detection.

The rapid growth of Internet of Things (IoT) devices has made cyberattacks increasingly covert and evolving. Traditional closed-set intrusion detection systems fail to identify unknown attacks that are unseen during training. Existing open-set methods often rely on a single rejection signal, while multi-representation approaches mainly focus on feature fusion or decision aggregation rather than exploiting complementary uncertainty responses across representations. In addition, probability-based rejection may become less reliable under severe class imbalance. To address these issues, we propose Multi-Representation Confidence Entropy Rejection with Dual-Reject (MRCER-DR), an open-set intrusion detection method for IoT with low inference overhead. It constructs four representations (Raw, Graph, 2D-Stat, and Fusion) and builds a joint rejection score, Confidence Entropy Rejection (CER), combining the maximum class probability and prediction entropy. The Multi-Representation Confidence Ensemble (MRCE) then aggregates the CER scores across representations, while Dual-Reject supplements MRCE with the Mahalanobis distance under severe class imbalance. On UNSW-NB15, MRCER-DR achieves 83.1% unknown recall and an 86.2% AUROC; on ToN-IoT, these reach 97.7% and 90.9%. The single-sample inference latency ranges from 0.04 to 1.01 ms. Without modifying the classifier training, our method balances known-class classification and unknown attack detection, providing a low-overhead approach for IoT open-set intrusion detection.