A Two-Stage Intrusion Detection Framework for IoT Networks

The increasing deployment of Industrial Internet of Things (IIoT) devices has raised the demand for intrusion detection systems (IDSs) that can operate efficiently in resource-constrained edge environments. Although machine learning and deep learning techniques have achieved strong performance for network intrusion detection, practical edge deployment requires consideration of both model complexity and input-feature dimensionality. Moreover, benchmark datasets may contain highly discriminative fields that reflect dataset-specific characteristics rather than generalizable attack behavior. This paper presents the Edge Lightweight Intrusion Detection System (ELIDS), organized as a two-stage processing framework for binary intrusion detection. The first stage performs feature-space preprocessing and ExtraTrees-based feature ranking to construct a compact subset of informative features, while the second stage applies a lightweight depthwise-separable one-dimensional convolutional neural network (1D-CNN) for Attack/Normal classification. The architecture maintains a fixed parameter count across different feature configurations, allowing feature reduction to be examined independently from model size. Experimental evaluation on Edge-IIoTset shows that ELIDS achieves a macro F1-score of 83.08% using 15 selected features and 11,269 trainable parameters. These results demonstrate the feasibility of jointly reducing feature dimensionality and model complexity for edge-oriented IIoT intrusion detection.