Deployment-aware acceleration boundaries for Edge-IoT intrusion detection on Raspberry Pi 5 and Hailo-8

Abstract Edge-IoT intrusion detection systems must balance predictive performance with the throughput, latency, and resource constraints of embedded deployment. This study investigates when hardware acceleration is beneficial for tabular IoT intrusion detection on a Raspberry Pi 5 equipped with a Hailo-8 AI accelerator. We evaluate lightweight multilayer perceptrons, conventional 1D convolutional neural networks, and a quantization-friendly 1D-CNN across CICIoT2023 and Edge-IIoTset using ONNX Runtime, Hailo quantized-emulator evaluation, and physical HailoRT benchmarking. The results reveal an execution-regime-dependent acceleration boundary. For the evaluated MLPs, CPU throughput exceeds HailoRT streaming throughput under both reported CPU reference regimes, whereas the conventional 1D-CNNs achieve higher HailoRT streaming throughput than both CPU references. Relative to CPU batch-size-one execution, the CICIoT2023 and Edge-IIoTset 1D-CNNs reach streaming-throughput ratios of 10.34 $$\times $$ and 9.61 $$\times $$ , respectively; the corresponding ratios relative to buffered CPU execution are 1.88 $$\times $$ and 1.82 $$\times $$ . The quantization-friendly model reduces ONNX-to-quantized-emulator macro-F1 degradation by 7.66 percentage points relative to the standard Edge-IIoTset 1D-CNN while also reducing parameter count, HEF on-disk size, and accelerator-side hardware latency. These findings show that accelerator selection for Edge-IoT IDS should consider model structure, execution regime, runtime overhead, and quantization behavior jointly.