Optimizing IoT Intrusion Detection with Tabular Foundation Models for Smart City Forensics

2026-04-13

AI Summary

This study addresses the dual demands of real-time performance and high accuracy in intrusion detection for smart city IoT environments, where conventional high-accuracy ensemble methods like Random Forest are often impractical due to excessive computational overhead. To bridge this gap, the work introduces TabPFNv2.5—a tabular foundation model—into IoT security forensics for the first time, proposing a hybrid detection architecture that combines rapid initial screening with refined classification. Specifically, TabPFNv2.5 performs efficient preliminary filtering, followed by an ensemble model for precise final decisions. Experiments on the TON IoT dataset demonstrate that TabPFNv2.5 achieves 40× faster inference than Random Forest while maintaining a binary classification accuracy of 97%. The study also identifies a performance bottleneck in scan attack detection (F1 = 69.8%) and highlights the critical role of feature similarity in enabling cross-device generalization.

Technology Category

• Application Domains: Internet of Things, Sensor Networks & Smart Cities
• Machine Learning: Hardware-aware ML
• Data Mining & Knowledge Management: Anomaly/Outlier Detection

Application Category

• Systems and Infrastructure for Web, Mobile and WoT: Applied ML and AI for Web-based mobile applications
• Security and Privacy: Large-scale security measurements
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems

Abstract

Security operations in smart cities demand detection systems that balance accuracy with response time. While ensemble methods like Random Forest achieve high accuracy, their computational overhead impedes real-time forensic triage. We present the first systematic evaluation of TabPFNv2.5, a transformer-based foundation model, against traditional ensemble classifiers for IoT intrusion detection. Using the TON IoT dataset, we demonstrate that TabPFNv2.5 achieves 40 faster inference than Random Forest while maintaining 97% binary classification accuracy. We propose a hybrid pipeline in which TabPFNv2.5 performs rapid threat screening, while ensemble models handle detailed classification. Our analysis reveals that scanning attacks remain the hardest to detect (F1: 69.8%) and cross-device generalization depends critically on feature similarity. These findings establish foundation models as viable components for time-sensitive IoT security operations

Problem

• IoT intrusion detection
• smart city forensics
• real-time response
• computational overhead
• accuracy-latency trade-off

Innovation

• Tabular Foundation Models
• IoT Intrusion Detection
• Smart City Forensics
• Hybrid Detection Pipeline
• Real-time Security Triage