Efficient CNN–GRU Transfer Learning for Edge IoT Intrusion Detection

Intrusion detection in Internet of Things (IoT) environments is challenged by severe class imbalance, evolving attack patterns, and the limited computational resources of edge devices. To address these challenges, this paper proposes a lightweight transfer-learning framework based on a combined architecture of Convolutional Neural Network and Gated Recurrent Unit (CNN–GRU) for IoT intrusion detection. The model is first pretrained on a large-scale source dataset containing mixed benign and attack traffic, then adapted to a smaller and structurally different target dataset using partial finetuning. To enable efficient edge adaptation, early convolutional layers are frozen while only the GRU and classification head are updated on the target domain. A leakage-free, group-aware data preparation strategy with overlapping temporal windows is employed to ensure reliable evaluation. Experimental results demonstrate that the proposed lightweight transfer approach achieves solid macro-level detection performance while reducing training cost compared to full finetuning. Additional analysis using a CPU-based inference proxy shows low latency and a small model footprint. This supports the feasibility of edge deployment. The results confirm that lightweight transfer learning offers an effective balance between detection performance and adaptation efficiency for resource-constrained IoT intrusion detection systems.