Ullah Saeed, Wu Junsheng, Kamal Mian Muhammad, Saudagar Abdul Khader Jilani
School of Software, Northwestern Polytechnical University, Xi'an, 710072, Shaanxi, China.
School of Electronic and Communication Engineering, Quanzhou University of Information Engineering, Quanzhou, 362000, Fujian, China.
Sci Rep. 2025 Jul 1;15(1):20850. doi: 10.1038/s41598-025-08921-3.
The rapid expansion of Internet of Things (IoT) networks necessitates efficient intrusion detection systems (IDS) capable of operating within the stringent resource constraints of IoT devices. This study introduces KronNet, a lightweight feed-forward neural network enhanced with Kronecker product operations, designed for real-time IoT intrusion detection. KronNet leverages Gaussian Mixture Model (GMM)-based oversampling and a hybrid loss function combining Focal Loss and Cross-Entropy with adaptive class weighting to address class imbalance, ensuring robust detection across diverse attack types. Evaluated on the CICIoT2023 and BoT-IoT datasets, KronNet achieves exceptional performance, with accuracies of 99.01% and 99.91%, weighted F1-scores of 99.01% and 99.91%, and low false positive rates of 0.03% and 0.01%, respectively. The model operates with minimal computational overhead, utilizing 5,074 parameters (19.82 KB) for CICIoT2023 and 4,703 parameters (18.37 KB) for BoT-IoT, with inference times of 0.209 ms and 0.208 ms. Post-quantization, memory usage reduces to 4.96 KB and 4.59 KB, with negligible accuracy degradation (0.06% and 0.01% loss). Compared to state-of-the-art models, KronNet demonstrates up to 15,829× lower FLOPS and 12,010× faster inference, making it a highly efficient solution for edge deployment in resource-constrained IoT environments. This work advances IoT cybersecurity by delivering a scalable, accurate, and lightweight IDS capable of real-time threat detection.
物联网（IoT）网络的迅速扩张需要高效的入侵检测系统（IDS），该系统要能在物联网设备严格的资源限制下运行。本研究介绍了KronNet，这是一种通过克罗内克积运算增强的轻量级前馈神经网络，专为物联网实时入侵检测而设计。KronNet利用基于高斯混合模型（GMM）的过采样以及结合了焦点损失和交叉熵并带有自适应类别加权的混合损失函数来解决类别不平衡问题，确保对各种攻击类型都能进行稳健检测。在CICIoT2023和BoT-IoT数据集上进行评估时，KronNet取得了卓越的性能，准确率分别为99.01%和99.91%，加权F1分数分别为99.01%和99.91%，误报率分别低至0.03%和0.01%。该模型以最小的计算开销运行，对于CICIoT2023使用5074个参数（19.82 KB），对于BoT-IoT使用4703个参数（18.37 KB），推理时间分别为0.209毫秒和0.208毫秒。量化后，内存使用量降至4.96 KB和4.59 KB，准确率下降可忽略不计（损失0.06%和0.01%）。与现有最先进的模型相比，KronNet的浮点运算次数（FLOPS）降低了多达15829倍，推理速度快了12010倍，使其成为资源受限的物联网环境中边缘部署的高效解决方案。这项工作通过提供一种能够进行实时威胁检测的可扩展、准确且轻量级的IDS，推动了物联网网络安全的发展。
