Hybrid Deep Learning and Rule-Based Models for Real-Time Intrusion Detection in IoT Networks: Extending IDS to Edge AI

The rapid expansion of Internet of Things (IoT) networks has introduced significant security vulnerabilities, necessitating intelligent Intrusion Detection Systems (IDS) capable of operating under constrained edge environments. This paper presents a hybrid framework combining deep learning and rule-based models for real-time intrusion detection in IoT ecosystems. The proposed Edge-IDS integrates a CNN-LSTM-based deep model for behavioral pattern extraction with Snort-inspired rule-based decision fusion for anomaly validation. Evaluation across BoT-IoT, TON-IoT, and CICIDS2019 datasets demonstrates an average detection accuracy of 98.6% and latency reduction of 31% compared to centralized IDS architectures. The framework’s edge-deployable nature and adaptability to dynamic IoT environments make it suitable for future 6G and industrial automation networks.