LIMITS: A Lightweight Two-Layer Hybrid IoT Intrusion Detection System with Mutual-Information Feature Selection

The growth of the Internet of Things (IoT) exposes resource-constrained devices to an expanding range of cyber attacks. Machine learning-based intrusion detection systems (IDSs) can detect these attacks, but they spend the same inference budget on every network flow, even when a flow is easy to classify. We propose LIMITS (Lightweight IoT Mutual-Information Two-layer System), a hybrid IDS in which a depth-limited Decision Tree resolves every flow that reaches a leaf of high training purity and escalates the remaining flows to an XGBoost classifier. The routing threshold is the mean leaf purity of the trained tree, so it needs no tuning, and mutual-information ranking with a parsimony rule selects the features. An evaluation over five stratified splits of two well-known IoT benchmark datasets showed that LIMITS resolved about half of the traffic in the first layer, nearly doubling the inference speed of the standalone ensemble with comparable detection performance and unchanged false-positive and missed-attack rates, that the operating point could be adjusted without retraining, and that LIMITS reached a higher mean macro-F1 than two re-implemented recurrent detectors on both datasets (significantly, only on CICIoT2023), with much shorter fitting and inference times. LIMITS does not, however, reduce the false alarms of XGBoost on benign traffic, which remain the main obstacle to deployment.