Lightweight IoT Intrusion Detection via Feature and Sample Reduction With Multi-Client Ensemble for Zero-Day Attacks

The rapid proliferation of the Internet of Things (IoT) exposes heterogeneous and resource-constrained devices to an increasingly diverse and evolving range of network attacks. Conventional centralized intrusion detection systems (IDS) and complex machine learning models often experience high computational and communication costs while lacking the capability to detect unknown threats. This paper proposes a lightweight distributed IDS framework that integrates multi-stage data compression, including feature selection, dimensionality reduction, and clustering-based sample compression, with lightweight classifiers and ensemble-based decision fusion. The framework is evaluated under two scenarios: (i) an extreme seven-client setting, where each client is trained on a single attack type, and (ii) a realistic five-client setting with heterogeneous attack distributions. Experimental results demonstrate that the proposed approach significantly reduces training cost and energy consumption while maintaining high detection performance. In the seven-client case, recall remains above 90% even with only 10% of samples retained under extreme heterogeneity, whereas in the five-client case, recall exceeds 97% under the same compression level. On the Raspberry Pi platform, total energy consumption decreases from 0.002015 kWh (without compression) to 0.000145 kWh, corresponding to a 92.8% reduction, while the prediction throughput reaches 7,117 to 173,005 samples per second across the five clients, ensuring real-time applicability. Ensemble strategies further improve robustness and enable effective detection of rare and zero-day attacks. These findings highlight the framework’s ability to balance performance, power consumption, and efficiency, making it well-suited for practical lightweight IoT deployments.