TinyML for Cybersecurity: Deploying Optimized Deep Learning Models for On-Device Threat Detection on Resource-Constrained Devices

Edge devices, which are integral to IoT ecosystems, are highly vulnerable to cyberattacks due to their limited computing power, storage, and network capacity. Traditionally, machine learning solutions based on CPUs, GPUs, and cloud infrastructure have mitigated such risks, but latency remains a significant challenge, allowing threats to cause damage before they can be detected. To address this, we explore the potential of Tiny Machine Learning (TinyML) to optimize models for low-powered, resource-constrained devices. Using TensorFlow Lite, we conducted experiments with deep learning models on edge devices, providing comparative results on their feasibility regarding security and privacy, without relying on cloud infrastructure. Our experiments on the USTC-TFC2016 and Ransomware PCAP datasets demonstrate the impact of various quantization techniques on accuracy, model size, and inference time. Quantization techniques demonstrated significant trade-offs between accuracy, model size, and inference time. While dynamic and static float16 quantization balanced performance on the USTC-TFC2016 dataset, preserving 85.67% accuracy and halving DenseNet169’s size, QAT boosted accuracy to 94.90% with slower inference times. Static int8 achieved the smallest size, shrinking models to 12.46 MB, but accuracy dropped sharply. For the Ransomware dataset, static float16 kept accuracy at 38.89% while cutting DenseNet169’s size to 23.99 MB. Dynamic quantization delivered the fastest inference, reducing MobileNetV2’s time to 0.001049 seconds. QAT preserved accuracy at 36.11% for DenseNet121, while static int8 compressed models to just 2.59 MB, but with significant accuracy loss.