Lightweight CNN–BiLSTM Intrusion Detection on the CICIoT2023 Benchmark: Balancing Multi-Class Accuracy and Edge Deployability

IoT devices are now everywhere: smart homes, hospitals, factories, and surveillance networks. Most of them ship with weak default security and rarely get patched, which has made them an easy target. Signature-based intrusion detection systems miss attacks they have never seen before, and most deep learning alternatives are too heavy to run anywhere near the devices they are supposed to protect. This paper presents a hybrid model that pairs a one-dimensional convolutional neural network (1D-CNN) with a bidirectional long short-term memory network (BiLSTM). The CNN extracts spatial features from traffic records, and the BiLSTM captures how those features change over time. We train and evaluate the model on CICIoT2023, a recent benchmark containing 33 attacks in seven categories, including distributed denial of service (DDoS), Mirai botnet traffic, reconnaissance, spoofing, and web attacks. Preprocessing consists of class balancing, feature normalization, and feature reduction to keep the model small. The evaluation reports detection quality and computational cost together, comparing the hybrid against classical machine learning baselines and against standalone CNN and BiLSTM ablations, and measuring parameter count and central processing unit (CPU) inference latency rather than accuracy alone. We close by discussing the limits of the current design and two directions we plan to explore next: federated training across devices and explainable outputs for security analysts