Deep learning framework for edge intelligence in IoT systems : real-time anomaly detection

Abstract

Internet of Things technologies have been significantly adopted to increase efficiency and convenience through automation and remote management. Despite constantly evolving paradigms, IoT networks remain exposed to security threats, particularly for resource-constrained edge devices. Traditional Intrusion Detection Systems often fail to identify modern and evolving cyber threats due to computational limitations and the dynamic nature of IoT environments. This thesis proposed a framework using Deep Learning models to detect and analyze intrusion attacks and their resultant sensor anomalies in an IoT system. The models were trained on a novel IoT dataset that integrates real-time sensor data and injects various network-level and data-level anomalies, including sensor failure attacks, corrupted data injection, Denial-of-Service attacks through high-frequency Message Queuing Telemetry Transport publishing, and data overflow scenarios. The resulting dataset captures multi-modal characteristics of anomalies, bridging the gap between sensor and network-based intrusion detection. The approach is compatible with lightweight edge deployment using Tiny Machine Learning architectures. Classification algorithms, such as Random Forest, K-Nearest Neighbor, and Isolation Forest were evaluated for their robustness. Meanwhile, sequential models, including Recurrent Neural Networks, Long Short-Term Memory, and 1D Convolutional Neural Networks were applied to capture temporal patterns in sensor behavior over time. An Autoencoder-based unsupervised model was also explored for rapid anomaly detection with low computational overhead. The best performance was achieved by the 1D Convolutional Neural Networks (CNN), which attained a test accuracy of 96% and demonstrated reliable detection of both majority and minority anomaly classes, followed by the Autoencoder (AE) with 95% accuracy, and the Random Forest (RF) classifier with 88% accuracy. The proposed system was evaluated on accuracy, inference latency, and the capability to model and identify temporal patterns, which demonstrated suitability for real-time deployment on edge devices in IoT systems.