LITH: A Lightweight Behavioral Anomaly-to-Hunt-Lead Framework for IoT Sensor Ecosystems

Internet of Things (IoT) sensor ecosystems increasingly support critical services, yet many endpoints cannot host conventional security stacks because of limited processing and memory resources. This paper presents the Lightweight IoT Threat Hunter (LITH), a hybrid endpoint-edge-central anomaly-to-hunt-lead framework that converts compact behavioral telemetry into calibrated, ranked investigation leads for downstream threat-hunting workflows while keeping automated anomaly detection separate from analyst confirmation. The framework was evaluated using a controlled multidevice telemetry benchmark across 10 Monte Carlo runs, with benign-only model fitting and validation-based anomaly-score calibration. At the common 99th-percentile operating point, One-Class Support Vector Machine (SVM) achieved the highest mean thresholded F1-score, although its difference from the autoencoder was not statistically significant after Holm correction, while Isolation Forest achieved the strongest mean Area Under the Receiver Operating Characteristic Curve (ROC-AUC) and average precision. Network-only telemetry retained performance close to the combined network-and-system feature set, while system-only telemetry was substantially weaker for the evaluated attack scenarios. Robustness and operating-point analyses showed that performance degrades under weaker attacks and increased benign variability and that higher sensitivity to subtle exfiltration behavior requires accepting a larger benign investigation workload. Beyond anomaly classification, LITH converts high-scoring observations into device-class-specific ranked hunt leads with behavioral indicators intended to support analyst triage rather than autonomous threat attribution. A limited three-feature external stress test on the Canadian Institute for Cybersecurity’s (CICIoT2023) dataset produced markedly different detector behavior: Max-Z achieved an F1-score of 0.824 and ROC-AUC of 0.835, while Isolation Forest did not transfer reliably at the fixed 99th-percentile operating point. This class-dependent result shows that the detector ranking observed in the controlled benchmark does not generalize uniformly. The results support proof-of-concept feasibility while emphasizing that broader device-aware external validation and physical endpoint and edge measurements remain necessary before claims of generalization or deployment readiness can be made.