CAMELOT-IDS: a multi-scale transformer with empirical uncertainty diagnostics for IoT intrusion detection

Internet of Things (IoT) intrusion detection must address severe class imbalance, heterogeneous traffic, and potential distribution shift while providing interpretable information about predictive uncertainty. CAMELOT-IDS integrates semantic local-global Transformer encoding, hierarchical supervision, Label-Distribution-Aware Margin loss with deferred reweighting (LDAM-DRW), deterministic Mondrian Regularized Adaptive Prediction Sets (RAPS), and stream-oriented monitoring. On the reported CICIoT2023 analysis subset, the reference model achieved 99.20% fine-class accuracy, 76.76% fine-class macro-F1, and 99.79% malicious-class F1. At α = 0.10, the deterministic RAPS implementation produced 99.95% empirical coverage with a mean prediction-set size of 1.60. Because probability scaling and RAPS-threshold estimation reused the same labeled calibration pool, these set-valued results are interpreted as empirical diagnostics rather than as a formal split-conformal validity result. Batch throughput was 18,141.6 samples/s on an NVIDIA RTX 3060 and 1062.3 samples/s on the tested dual-Xeon platform. Fine-class performance remained highly uneven, with the Uploading Attack class yielding an F1 score of 4.96%. The stream-monitoring pathway produced no trigger during the held-out stream replay. These findings support further provenance-aware external validation, dependence-aware calibration, and controlled distribution-shift evaluation.