A Lean and Modular Two-Stage Network Intrusion Detection System for IoT Traffic

The popularization of the Internet of Things (IoT) has led to cyberattacks targeting interconnected applications. Traditional intrusion detection systems (IDS) struggle to cope with the increasing volume and complexity of IoT data, hindering their ability to identify all threats. In order to address this issue, we propose a modular two-stage Network IDS for IoT, with each stage specialized in a specific set of attacks. This approach allows for independent training and optimization of each stage, improving processing time and classification metrics when compared to single-stage systems. The effectiveness of this design is demonstrated using the CICIoT2023 dataset. Compared to a single model, our proposal obtains better inference time (13 seconds vs. 94 seconds) and an overall enhanced detection rate (0.9055 vs. 0.8370 in terms of F1-Score). An additional contribution of our work is the sharing of all developed code as open-source software, facilitating the reproduction and extension of our proposal.