KronNet a lightweight Kronecker enhanced feed forward neural network for efficient IoT intrusion detection
Abstract The rapid expansion of Internet of Things (IoT) networks necessitates efficient intrusion detection systems (IDS) capable of operating within the stringent resource constraints of IoT devices. This study introduces KronNet, a lightweight feed-forward neural network enhanced with Kronecker p...
Saved in:
| Main Authors: | , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
Nature Portfolio
2025-07-01
|
| Series: | Scientific Reports |
| Subjects: | |
| Online Access: | https://doi.org/10.1038/s41598-025-08921-3 |
| Tags: |
Add Tag
No Tags, Be the first to tag this record!
|
| _version_ | 1849403059940098048 |
|---|---|
| author | Saeed Ullah Junsheng Wu Mian Muhammad Kamal Abdul Khader Jilani Saudagar |
| author_facet | Saeed Ullah Junsheng Wu Mian Muhammad Kamal Abdul Khader Jilani Saudagar |
| author_sort | Saeed Ullah |
| collection | DOAJ |
| description | Abstract The rapid expansion of Internet of Things (IoT) networks necessitates efficient intrusion detection systems (IDS) capable of operating within the stringent resource constraints of IoT devices. This study introduces KronNet, a lightweight feed-forward neural network enhanced with Kronecker product operations, designed for real-time IoT intrusion detection. KronNet leverages Gaussian Mixture Model (GMM)-based oversampling and a hybrid loss function combining Focal Loss and Cross-Entropy with adaptive class weighting to address class imbalance, ensuring robust detection across diverse attack types. Evaluated on the CICIoT2023 and BoT-IoT datasets, KronNet achieves exceptional performance, with accuracies of 99.01% and 99.91%, weighted F1-scores of 99.01% and 99.91%, and low false positive rates of 0.03% and 0.01%, respectively. The model operates with minimal computational overhead, utilizing 5,074 parameters (19.82 KB) for CICIoT2023 and 4,703 parameters (18.37 KB) for BoT-IoT, with inference times of 0.209 ms and 0.208 ms. Post-quantization, memory usage reduces to 4.96 KB and 4.59 KB, with negligible accuracy degradation (0.06% and 0.01% loss). Compared to state-of-the-art models, KronNet demonstrates up to 15,829× lower FLOPS and 12,010× faster inference, making it a highly efficient solution for edge deployment in resource-constrained IoT environments. This work advances IoT cybersecurity by delivering a scalable, accurate, and lightweight IDS capable of real-time threat detection. |
| format | Article |
| id | doaj-art-71d0ed5a9a9a44cbaa1edbfa33822d60 |
| institution | Kabale University |
| issn | 2045-2322 |
| language | English |
| publishDate | 2025-07-01 |
| publisher | Nature Portfolio |
| record_format | Article |
| series | Scientific Reports |
| spelling | doaj-art-71d0ed5a9a9a44cbaa1edbfa33822d602025-08-20T03:37:22ZengNature PortfolioScientific Reports2045-23222025-07-0115112410.1038/s41598-025-08921-3KronNet a lightweight Kronecker enhanced feed forward neural network for efficient IoT intrusion detectionSaeed Ullah0Junsheng Wu1Mian Muhammad Kamal2Abdul Khader Jilani Saudagar3School of Software, Northwestern Polytechnical UniversitySchool of Software, Northwestern Polytechnical UniversitySchool of Electronic and Communication Engineering, Quanzhou University of Information EngineeringInformation Systems Department, College of Computer and Information Sciences, Imam Mohammad Ibn Saud Islamic University (IMSIU)Abstract The rapid expansion of Internet of Things (IoT) networks necessitates efficient intrusion detection systems (IDS) capable of operating within the stringent resource constraints of IoT devices. This study introduces KronNet, a lightweight feed-forward neural network enhanced with Kronecker product operations, designed for real-time IoT intrusion detection. KronNet leverages Gaussian Mixture Model (GMM)-based oversampling and a hybrid loss function combining Focal Loss and Cross-Entropy with adaptive class weighting to address class imbalance, ensuring robust detection across diverse attack types. Evaluated on the CICIoT2023 and BoT-IoT datasets, KronNet achieves exceptional performance, with accuracies of 99.01% and 99.91%, weighted F1-scores of 99.01% and 99.91%, and low false positive rates of 0.03% and 0.01%, respectively. The model operates with minimal computational overhead, utilizing 5,074 parameters (19.82 KB) for CICIoT2023 and 4,703 parameters (18.37 KB) for BoT-IoT, with inference times of 0.209 ms and 0.208 ms. Post-quantization, memory usage reduces to 4.96 KB and 4.59 KB, with negligible accuracy degradation (0.06% and 0.01% loss). Compared to state-of-the-art models, KronNet demonstrates up to 15,829× lower FLOPS and 12,010× faster inference, making it a highly efficient solution for edge deployment in resource-constrained IoT environments. This work advances IoT cybersecurity by delivering a scalable, accurate, and lightweight IDS capable of real-time threat detection.https://doi.org/10.1038/s41598-025-08921-3IoT intrusion detectionKronecker productGaussian mixture model (GMM)Lightweight deep learningResource-constrained environmentEdge deployment |
| spellingShingle | Saeed Ullah Junsheng Wu Mian Muhammad Kamal Abdul Khader Jilani Saudagar KronNet a lightweight Kronecker enhanced feed forward neural network for efficient IoT intrusion detection Scientific Reports IoT intrusion detection Kronecker product Gaussian mixture model (GMM) Lightweight deep learning Resource-constrained environment Edge deployment |
| title | KronNet a lightweight Kronecker enhanced feed forward neural network for efficient IoT intrusion detection |
| title_full | KronNet a lightweight Kronecker enhanced feed forward neural network for efficient IoT intrusion detection |
| title_fullStr | KronNet a lightweight Kronecker enhanced feed forward neural network for efficient IoT intrusion detection |
| title_full_unstemmed | KronNet a lightweight Kronecker enhanced feed forward neural network for efficient IoT intrusion detection |
| title_short | KronNet a lightweight Kronecker enhanced feed forward neural network for efficient IoT intrusion detection |
| title_sort | kronnet a lightweight kronecker enhanced feed forward neural network for efficient iot intrusion detection |
| topic | IoT intrusion detection Kronecker product Gaussian mixture model (GMM) Lightweight deep learning Resource-constrained environment Edge deployment |
| url | https://doi.org/10.1038/s41598-025-08921-3 |
| work_keys_str_mv | AT saeedullah kronnetalightweightkroneckerenhancedfeedforwardneuralnetworkforefficientiotintrusiondetection AT junshengwu kronnetalightweightkroneckerenhancedfeedforwardneuralnetworkforefficientiotintrusiondetection AT mianmuhammadkamal kronnetalightweightkroneckerenhancedfeedforwardneuralnetworkforefficientiotintrusiondetection AT abdulkhaderjilanisaudagar kronnetalightweightkroneckerenhancedfeedforwardneuralnetworkforefficientiotintrusiondetection |