LiteShield: Hybrid Feature Selection-Driven Lightweight Intrusion Detection for Resource-Constrained IoT Networks

TL;DR

LiteShield is a lightweight, hybrid feature selection-based intrusion detection system designed for resource-constrained IoT networks, achieving high accuracy with low computational cost.

Contribution

The paper introduces LiteShield, combining hybrid feature selection with lightweight classifiers to enhance IoT intrusion detection efficiency and accuracy.

Findings

KNN achieved 98.26% binary classification accuracy.

Random Forest balanced detection performance and efficiency.

Class imbalance significantly impacts multiclass detection results.

Abstract

The rapid expansion of Internet of Things (IoT) deployments has enlarged the attack surface of modern digital infrastructure while exposing a key security mismatch: many intrusion detection systems (IDSs) remain too computationally expensive for constrained IoT environments. This paper presents LiteShield, a lightweight machine learning-based IDS that combines hybrid feature selection with efficient classifiers to support accurate attack detection under limited computational budgets. The proposed framework uses the UNSW-NB15 dataset, applies data preprocessing and imbalance-aware preparation, and employs a two-stage feature selection pipeline based on Mutual Information (MI) and Recursive Feature Elimination with Cross-Validation (RFECV). Six lightweight classifiers are evaluated for both binary and multiclass intrusion detection: Decision Tree, Random Forest, K-Nearest Neighbors (KNN), Logistic Regression, Na\"ive Bayes, and Support Vector Machine. Experimental results show that KNN achieved the highest raw predictive performance, reaching 98.26% accuracy for binary classification and 85.22% accuracy for multiclass classification. However, Random Forest delivered the most practical trade-off between detection quality and deployment efficiency, obtaining 98.01% binary accuracy and 80.39% multiclass accuracy with substantially lower model size and inference cost than KNN. Additional ablation analysis on minority attack classes indicates that class imbalance materially affects multiclass performance. Overall, LiteShield demonstrates that hybrid feature selection and lightweight machine learning can provide a viable path toward accurate and computationally feasible intrusion detection for IoT-focused environments.