LCT-IDS: A Lightweight Transformer-Based Architecture for IoT Intrusion Detection

With the proliferation of Internet of Things (IoT) technologies, interconnectivity has enlarged the attack surface and intensified security risks. Conventional intrusion detection methods struggle with complex, stealthy intrusions under tight compute and memory budgets, motivating lightweight IDS solutions for accurate and efficient on-device detection. This paper proposes LCT-IDS, a lightweight cascaded Transformer-based IDS tailored to IoT scenarios characterized by high-dimensional, highly heterogeneous traffic and severe class imbalance. LCT-IDS employs a cascaded feature-fusion architecture that integrates local spatial cues extracted by convolutional neural networks (CNNs) with global semantic representations modeled by a compact Transformer; a residual fusion pathway enhances sensitivity to stealthy, low-frequency attacks. Additionally, a cost-sensitive training strategy mitigates performance degradation caused by class imbalance, and a structured modeling strategy improves generalization on high-dimensional inputs. Experiments on UNSW-NB15, NSL-KDD, and CIC-IoT2023 demonstrate high accuracy and efficiency: On UNSW-NB15, the model maintains high precision, recall, F1-score, and AUC, and achieves 99.40% accuracy for binary and 87.72% for multi-class classification. On NSL-KDD and CIC-IoT2023, it achieves highly competitive performance across all evaluated metrics. Compared with a Standard Transformer, LCT-IDS reduces model size by 60.2% and improves inference speed, providing a high-precision, low-overhead IDS that demonstrates strong theoretical potential for resource-constrained IoT deployments.