Residual threshold validation enables lightweight intrusion detection with a two-stage BiGRU autoencoder

Network intrusion detection under severe class imbalance and diverse attack patterns often relies on reconstruction residuals. However, overlapping residual distributions, sparse tails, and distribution drift make single-threshold decision boundaries unstable and hard to reproduce. This study proposes a lightweight and reproducible intrusion detection framework based on Residual Threshold Validation (RTV) with a two-stage BiGRU autoencoder. In Phase 1, the autoencoder is trained on normal samples to learn a stable reconstruction baseline and per-dimension residual bounds. In Phase 2, weak supervision from coarse binary labels and class-conditional margin constraints enlarges inter-class separation in the residual space. During inference, Top-k aggregation generates a unified intrusion score, and the threshold is determined on a validation split and frozen for test evaluation. Experiments on KDDCUP99, UNSW-NB15, and WSN-DS show F1-scores of 0.9943, 0.9898, and 0.9795, with false-positive rates of 0.10%, 2.06%, and 2.43%. These results demonstrate both high accuracy and reproducible decision boundaries. The model size is 186-194 KB, enabling deployment in resource-constrained scenarios such as edge devices.