Edge Computing and the Internet of Things (IoT) are redefining industrial and medical architectures, as seen in Industry 4.0 factories where sensors monitor machinery status in real time or in smart hospitals equipped with connected IoT devices. This decentralization of data processing significantly reduces latency (below 10 ms in 95% of cases, as reported by
[1]
, but it also exposes these networks to increasingly sophisticated cyber threats. In a context where the number of sensors and connected devices is exploding, the potential attack surface widens considerably
[2]
. Device heterogeneity, protocol diversity, and the lack of security standardization exacerbate vulnerabilities
[3]
. Embedded devices, often lacking continuous supervision or regular updates, become critical entry points for cybercriminals
[4]
. Consider the critical example of a connected pacemaker: a zero-day attack could alter its telemetry data via malformed TCP/IP packets, potentially inducing fatal cardiac discharges. Traditional IDSs like Snort, which rely on predefined signatures, would fail to detect such attacks. In contrast, our approach based on reconstruction deviations generated by an LSTM-Autoencoder model successfully identifies them (F1-score = 0.96 on the TON_IoT dataset).
To address these challenges, we propose a self-adaptive IDS combining LSTM networks and Autoencoders, specifically designed for resource-constrained Edge environments (e.g., Raspberry Pi 4, latency = 42 ms). The system learns normal traffic behavior without supervision and detects anomalies, including novel ones, by analyzing reconstruction errors, with dynamically adjusted thresholds via the Peaks-Over-Threshold algorithm.
This work aims to achieve two major objectives:
1) Scientific: Demonstrate the superiority of hybrid unsupervised models over signature-based methods (accuracy gain ≥ 28% compared to Snort);
2) Practical: Ensure memory consumption ≤ 200 MB and real-time detection (<50 ms) on embedded devices.
The remainder of this paper is organized as follows: Section 2 reviews related work on Edge-IoT IDS. Section 3 details our LSTM-Autoencoder approach. Section 4 formalizes the mathematical model. Section 5 describes the experimental setup, Section 6 analyzes results, and Section 7 concludes with future directions.
2. Related Work
The state of the art in intrusion detection for Edge-IoT networks highlights a steady evolution toward lighter, more accurate solutions better suited to decentralized environments. Traditional systems like Snort
[2]
and Bro
[3]
, which rely on predefined signatures or manual rules, are effective at detecting known attacks. However, their rigidity limits their ability to identify zero-day threats or adapt to evolving IoT traffic patterns. These approaches often require regular updates and exhibit poor performance in detecting abnormal behaviors in highly heterogeneous environments.
Machine learning and statistical techniques, such as those proposed in
[3]
using the TON_IoT dataset or
[5]
with the LBDMIDS model, have improved anomaly detection. However, these architectures, often complex, rarely account for Edge platform resource constraints, particularly in energy consumption or memory capacity. For instance,
[6]
report a power consumption of 4.2 W on Raspberry Pi 4, limiting their deployment in battery-powered sensors.
Recent hybrid architectures combining LSTM networks and Autoencoders (
[7]
[8]
) have demonstrated effectiveness in anomaly detection, including for time-series data, with accuracies exceeding 96%. However, these works often lack practical integration into Edge platforms, particularly regarding energy efficiency, automated threat response, or validation on real hardware. For example,
[6]
report 92% accuracy with 850 MB memory usage on Jetson Nano, which remains excessive compared to our model’s 195 MB on Raspberry Pi 4.
While security challenges in Edge Computing remain partly theoretical
[1]
, integrating on-device AI through lightweight, high-performance models is critical for enabling real-time detection in heterogeneous environments. Emerging approaches, such as lightweight Transformers (FEDformer,
[9]
), enhance time-series modeling but face deployment barriers due to their complexity on platforms like Raspberry Pi. Similarly, federated methods (FELIDS,
[10]
) decentralize detection while preserving data privacy, crucial for sensitive environments.
In response to these limitations, our work distinguishes itself by proposing an unsupervised LSTM-Autoencoder-based IDS specifically optimized for Edge-IoT. It achieves high accuracy (97%) while maintaining low memory usage (200 MB) and energy consumption (1.8 W), compatible with platforms like Raspberry Pi 4. Leveraging representative datasets like TON_IoT, our solution bridges the gap between efficiency, lightweight design, and robustness, while enabling zero-day attack detection without predefined signatures or labeled data.
Addressing the gaps identified in existing literature, the following section details our lightweight, unsupervised LSTM-Autoencoder architecture.
3. Proposed Approach
The objective of our solution is to develop a lightweight, intelligent, and self-adaptive Intrusion Detection System (IDS) capable of operating in real-time within Edge-IoT environments where resources (CPU, memory, energy) are limited. Unlike many existing works, our architecture relies on an unsupervised LSTM-Autoencoder model, optimized for deployment on resource-constrained platforms such as the Raspberry Pi 4.
Our model does not require a signature database or prior data labeling, unlike traditional systems such as Snort. It autonomously learns the normal behavior of network traffic from real-time streams and identifies deviations as potentially malicious. This approach enables the effective detection of zero-day attacks, which represents a significant advancement over rule-based systems
[5]
[10]
. The following
Figure 1
presents IoT clients and sensors transmit data to a gateway equipped with an LSTM Autoencoder. Abnormal behaviors are detected in real time and trigger an automated response mechanism.
<xref ref-type="bibr" rid="scirp.145568-"></xref>Figure 1. Proposed IDS System Architecture.
4. Mathematical Model4.1. Mathematical Model
Let us consider a network data sequence:
where
is a feature vector at time t, composed of attributes such as:
The LSTM encodes this sequence into a temporal representation:
ht: Hidden state vector at time t, encapsulating the memory of past traffic patterns.
The Autoencoder compresses and reconstructs each input xt:
The reconstruction error is measured as:
(1)
Anomaly classification follows:
Anomaly threshold θ was computed as:
(2)
μe is the mean of the reconstruction error over normal traffic;
σe is the standard deviation of that error;
k is an empirical coefficient set to 1.5, based on validation performance.
This technique is aligned with best practices in anomaly detection using autoencoders, as described by
[11]
and more recently by
[12]
.
To further refine anomaly detection beyond a fixed threshold, we also integrate the Peaks-Over-Threshold (POT) algorithm. This method models the tail distribution of reconstruction errors and dynamically adjusts θ based on extreme value theory. POT is particularly effective in capturing rare but significant deviations in unsupervised learning scenarios. A detailed discussion of its implementation and impact is presented in Section 6.4.
We also integrate the Peaks-Over-Threshold (POT) method to automatically adjust the detection threshold based on the error distribution. This approach is applied in the work of
[13]
for a distributed anomaly detection system based on federated autoencoders, where POT is used to dynamically select a threshold suited to the data.
4.2. Pseudo Code
Algorithm: Real-Time Anomaly Detection via LSTM-Autoencoder
Inputs:
Outputs:
1) Begin Algorithm:
2) Continuous Loop:
a) Extract and normalize features (vector X)
b) Pass sequence through LSTM → obtain temporal representation ht
c) Compress (Encoder) and reconstruct (Decoder) via Autoencoder
d) Compute reconstruction error E
e) Compare E to threshold θ:
f) Wait for delay Δt before next sequence (e.g., 500 ms)
3) End Algorithm
<xref ref-type="bibr" rid="scirp.145568-"></xref>Figure 2. Flowchart of the anomaly detection process.
Figure 2
presents, the Real-time anomaly detection flow diagram based on the LSTM-Autoencoder model. Network packets are collected, transformed into sequences, processed by the LSTM, and reconstructed by the Autoencoder. The reconstruction error is compared to a threshold to generate an alert if an anomaly is detected.
5. Experimental Setup
Our approach was evaluated in a realistic Edge-IoT setting using low-resource hardware. Platforms Used:
Software Tools:
Datasets:
Evaluation Metrics:
With the experimental setup defined, we now present the obtained results and a comparative discussion.
6. Results and Discussion
This section presents the experimental performance of our LSTM-Autoencoder model, primarily evaluated on the TON_IoT dataset, and compared to classical approaches such as Snort, CNN, and Random Forest in an Edge context (Raspberry Pi 4).
6.1. Model Training Curve
The first curve (see
Figure 3
) illustrates the evolution of the loss function MSE (Mean Squared Error) over 50 training epochs. A steady decrease in MSE is observed for both training and validation phases, indicating the model’s strong learning capability. The gap between the two curves remains narrow and stable, suggesting no overfitting. This confirms that the model generalizes well to normal network traffic sequences, a critical prerequisite for reliable anomaly detection.
<xref ref-type="bibr" rid="scirp.145568-"></xref>Figure 3. Learning curve of the LSTM Autoencoder.
6.2. Reconstruction Error and Anomaly Detection
The second curve (
Figure 4
) illustrates the reconstruction error across the captured network traffic. The anomaly threshold (dashed red line) was empirically defined as the mean reconstruction error plus a standard deviation factor. Points above this threshold are classified as anomalies. This visualization demonstrates the model’s sensitivity to abnormal network behaviors. Most traffic falls below the threshold, indicating sequences classified as normal. Conversely, notable peaks above the threshold, particularly in later phases, highlight the model’s ability to detect anomalies, including potential Zero-Day attacks.
<xref ref-type="bibr" rid="scirp.145568-"></xref>Figure 4. Reconstruction Error with Anomaly Threshold.
6.3. Quantitative Performance
Table 1
below, presents a comparison between our proposed LSTM-Autoencoder model and three classical IDS systems: Snort, CNN, and Random Forest. The results highlight the superiority of our approach in terms of precision (97.2%), F1-Score (96.0%), and false positive rate (1.2%). Moreover, our model exhibits very low detection latency (0.9 s) and optimized resource usage (38% CPU usage and only 195 MB of memory). Finally, the system demonstrates excellent capabilities in detecting zero-day attacks, unlike traditional solutions. These performances make our model particularly suitable for energy- and memory-constrained Edge-IoT environments.
An analysis of false positives (FP) and false negatives (FN) reveals the following:
6.5. Discussion
The low resource usage of the proposed IDS has significant practical benefits for real-world deployment. With a power consumption of only 1.8 W, the system can operate efficiently on battery-powered IoT devices, even in remote or resource-constrained environments where continuous power supply is unavailable. Additionally, the lightweight memory footprint (<200 MB) allows the system to be deployed on fog nodes or embedded devices within dense sensor networks without overloading their computational capacity. These characteristics make the model highly suitable for scalable and autonomous security solutions in Edge-IoT infrastructures.
7. Conclusion and Future Work
In this paper, we proposed a lightweight, intelligent, and self-adaptive intrusion detection system (IDS) specifically designed for Edge-IoT environments. By combining the temporal capabilities of LSTM networks with the reconstruction power of Autoencoders in an unsupervised architecture, our approach effectively detects anomalies, including zero-day attacks, without requiring predefined signatures or labeled data.
Experimental results, obtained on the TON_IoT and NSL-KDD datasets and validated on embedded platforms like Raspberry Pi 4, confirm the model’s robustness and relevance. Compared to classical approaches such as Snort, CNN, or Random Forest, our solution demonstrates superior accuracy, reduced latency, and significantly optimized resource consumption.
This work contributes to the broader effort to secure embedded systems in critical domains (healthcare, industry, energy), where performance and reliability constraints are particularly stringent.
Future Work: Future research will focus on automating attack responses via smart contracts, enabling continuous adaptation to dynamic environments, and validating the system on real-world data.
Acknowledgements
The authors would like to thank the Laboratoire LASTIC (ESATIC) and the Université Virtuelle de Côte d’Ivoire (UVCI) for their institutional support during this research.
Special thanks are extended to colleagues from the Edge-IoT Security Research Group for their valuable insights and constructive discussions throughout the experimental phase.
This work received no specific grant from any funding agency in the public, commercial, or not-for-profit sectors.
References
Zhang, J., Chen, B., Zhao, Y., Cheng, X. and Hu, F. (2018) Data Security and Privacy-Preserving in Edge Computing Paradigm: Survey and Open Issues. IEEE Access, 6, 18209-18237. >https://doi.org/10.1109/access.2018.2820162
Roesch, M. (1999) Snort-Lightweight Intrusion Detection for Networks.
Paxson, V. (1999) Bro: A System for Detecting Network Intruders in Real-Time. Computer Networks, 31, 2435-2463. >https://doi.org/10.1016/s1389-1286(99)00112-7
Alsaedi, A., Moustafa, N., Tari, Z., Mahmood, A. and Anwar, A. (2020) TON_IoT Telemetry Dataset: A New Generation Dataset of IoT and IIoT for Data-Driven Intrusion Detection Systems. IEEE Access, 8, 165130-165150. >https://doi.org/10.1109/access.2020.3022862
Saurabh, K., Sood, S., Kumar, P.A., Singh, U., Vyas, R., Vyas, O.P., et al. (2022) LBDMIDS: LSTM Based Deep Learning Model for Intrusion Detection Systems for IoT Networks. 2022 IEEE World AI IoT Congress (AIIoT), Seattle, 6-9 June 2022, 753-759. >https://doi.org/10.1109/aiiot54504.2022.9817245
Paira, S. and Bhattacharya, U. (2018) Efficient Dynamic Survivable Multicasting in WDM Mesh Networks. 2018 10th International Conference on Communication Systems & Networks (COMSNETS), Bengaluru, 3-7 January 2018, 525‑527. >https://doi.org/10.1109/comsnets.2018.8328262
Raihan, A.S. and Ahmed, I. (2023) A Bi-LSTM Autoencoder Framework for Anomaly Detection—A Case Study of a Wind Power Dataset. 2023 IEEE 19th International Conference on Automation Science and Engineering (CASE), Auckland, 26-30 August 2023, 1-6. >https://doi.org/10.1109/case56687.2023.10260331
Varghese, B., Wang, N., Barbhuiya, S., Kilpatrick, P. and Nikolopoulos, D.S. (2016) Challenges and Opportunities in Edge Computing. 2016 IEEE International Conference on Smart Cloud (SmartCloud), New York, 18-20 November 2016, 20-26. >https://doi.org/10.1109/smartcloud.2016.18
Zhou, T., Ma, Z., Wen, Q., Wang, X., Sun, L. and Jin, R. (2022) FEDformer: Frequency Enhanced Decomposed Transformer for Long-Term Series Forecasting.
Chen, X., Zhu, S., Chen, D., Hu, S., Li, C. and Zhu, Z. (2015) On Efficient Protection Design for Dynamic Multipath Provisioning in Elastic Optical Networks. 2015 International Conference on Optical Network Design and Modeling (ONDM), Pisa, 11-14 May 2015, 251‑256. >https://doi.org/10.1109/ondm.2015.7127307
Malhotra, P., Ramakrishnan, A., Anand, G., Vig, L., Agarwal, P. and Shroff, G. (2016) LSTM-Based Encoder-Decoder for Multi-Sensor Anomaly Detection.
Rhachi, H., Balboul, Y. and Bouayad, A. (2025) Enhanced Anomaly Detection in IoT Networks Using Deep Autoencoders with Feature Selection Techniques. Sensors, 25, Article No. 3150. >https://doi.org/10.3390/s25103150
Kea, K., Han, Y. and Kim, T.-K. (2023) Enhancing Anomaly Detection in Distributed Power Systems Using Autoencoder-Based Federated Learning. PLOS ONE, 18, e0290337. >https://doi.org/10.1371/journal.pone.0290337