FLARE: Feature-based Lightweight Aggregation for Robust Evaluation of IoT Intrusion Detection

2025-04-21

AI Summary

To address poor feature representation robustness and high computational overhead in IoT intrusion detection, this paper proposes FLARE—a lightweight, three-tier collaborative feature aggregation framework tailored for IoT traffic. FLARE integrates session-level, flow-level, and multi-granularity temporal sliding-window information to construct structured network behavioral representations, significantly reducing input dimensionality while preserving semantic integrity and temporal fidelity. By optimizing feature engineering and maintaining compatibility with diverse models—including SVM, RF, LSTM, and CNN—FLARE achieves an average 8.3% improvement in F1-score and a 2.1× speedup in inference latency on a custom IoT dataset. The framework notably enhances detection robustness and reduces resource consumption. Its core innovation lies in the first-of-its-kind hierarchical lightweight aggregation mechanism specifically designed for heterogeneous IoT traffic.

Technology Category

• Machine Learning: Feature Construction/Reformulation
• Application Domains: Internet of Things, Sensor Networks & Smart Cities
• Data Mining & Knowledge Management: Anomaly/Outlier Detection

Application Category

• Systems and Infrastructure for Web, Mobile and WoT: Applied ML and AI for Web-based mobile applications
• Web Mining and Content Analysis: Large pretrained models with web data
• Security and Privacy: Large-scale security measurements

Abstract

The proliferation of Internet of Things (IoT) devices has expanded the attack surface, necessitating efficient intrusion detection systems (IDSs) for network protection. This paper presents FLARE, a feature-based lightweight aggregation for robust evaluation of IoT intrusion detection to address the challenges of securing IoT environments through feature aggregation techniques. FLARE utilizes a multilayered processing approach, incorporating session, flow, and time-based sliding-window data aggregation to analyze network behavior and capture vital features from IoT network traffic data. We perform extensive evaluations on IoT data generated from our laboratory experimental setup to assess the effectiveness of the proposed aggregation technique. To classify attacks in IoT IDS, we employ four supervised learning models and two deep learning models. We validate the performance of these models in terms of accuracy, precision, recall, and F1-score. Our results reveal that incorporating the FLARE aggregation technique as a foundational step in feature engineering, helps lay a structured representation, and enhances the performance of complex end-to-end models, making it a crucial step in IoT IDS pipeline. Our findings highlight the potential of FLARE as a valuable technique to improve performance and reduce computational costs of end-to-end IDS implementations, thereby fostering more robust IoT intrusion detection systems.

Problem

• Securing IoT environments with lightweight feature aggregation
• Enhancing IoT intrusion detection using multilayered data analysis
• Reducing computational costs while improving IDS model performance

Innovation

• Multilayered session, flow, time-based aggregation
• Supervised and deep learning model integration
• Lightweight feature engineering for IoT IDS