# Intrusion Detection on Resource-Constrained IoT Devices with Hardware-Aware ML and DL

arXiv: https://arxiv.org/abs/2512.02272 · HTML: https://mlsanity.com/paper/2512.02272/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 6 of its 24 references that are in the map.
- First posted on arXiv 1 Dec 2025.

## Builds on (most cited first, 6 of 6)

- [DARTS: Differentiable Architecture Search](https://mlsanity.com/paper/1806.09055/) (2018)
- [On-Device Machine Learning: An Algorithms and Learning Theory Perspective](https://mlsanity.com/paper/1911.00623/) (2019)
- [A Comprehensive Survey on Hardware-Aware Neural Architecture Search](https://mlsanity.com/paper/2101.09336/) (2021)
- [Tiny Neural Networks for Session-Level Traffic Classification](https://mlsanity.com/paper/2504.04008/) (2025)
- [Energy-Efficient Deep Learning for Traffic Classification on Microcontrollers](https://mlsanity.com/paper/2506.10851/) (2025)
- [Hardware-Aware Neural Architecture Search for Encrypted Traffic Classification on Resource-Constrained Devices](https://mlsanity.com/paper/2506.11319/) (2025)

## Abstract (arXiv)

This paper proposes a hardware-aware intrusion detection system (IDS) for Internet of Things (IoT) and Industrial IoT (IIoT) networks; it targets scenarios where classification is essential for fast, privacy-preserving, and resource-efficient threat detection. The goal is to optimize both tree-based machine learning (ML) models and compact deep neural networks (DNNs) within strict edge-device constraints. This allows for a fair comparison and reveals trade-offs between model families. We apply constrained grid search for tree-based classifiers and hardware-aware neural architecture search (HW-NAS) for 1D convolutional neural networks (1D-CNNs). Evaluation on the Edge-IIoTset benchmark shows that selected models meet tight flash, RAM, and compute limits: LightGBM achieves 95.3% accuracy using 75 KB flash and 1.2 K operations, while the HW-NAS-optimized CNN reaches 97.2% with 190 KB flash and 840 K floating-point operations (FLOPs). We deploy the full pipeline on a Raspberry Pi 3 B Plus, confirming that tree-based models operate within 30 ms and that CNNs remain suitable when accuracy outweighs latency. These results highlight the practicality of hardware-constrained model design for real-time IDS at the edge.