BENCHMARKING LIGHTWEIGHT ML MODELS FOR EDGE-IOT BOTNET DETECTION UNDER RESOURCE CONSTRAINTS
DOI:
https://doi.org/10.33003/Keywords:
Edge-IoT, botnet detection, intrusion detection system, XGBoost, LightGBM, Deep Forest, lightweight machine learning, Resource Constraints, Machine LearningAbstract
Increased use of Internet of Things (IoT) devices has resulted in the introduction of cyber vulnerabilities, necessitating automated Intrusion Detection Systems (IDS) at the network edge, where the decisions are localized. A significant research gap exists because proposed lightweight machine learning models are often evaluated on high-performance workstations, misrepresenting actual edge gateway resource constraints. This paper describes in detail the detection of IoT botnets experimentally under simulated hardware limitations using the three ensemble models: XGBoost, LightGBM, and Deep Forest. A Docker-based simulation environment was limited to 1 vCPU and 512 MB RAM. The methodology incorporated stratified sampling of the Bot-IoT dataset, preprocessed via SMOTE oversampling and Random Forest Feature Importance (RFFI). Alongside standard classification metrics, practical resource metrics such as inference latency, memory footprint, throughput, and energy consumption were measured. Achieving a zero False Positive Rate, XGBoost came out with the shortest inference latency (0.41 ms), highest throughput (2, 417 packets/sec), and lowest energy consumption (2.05 J), thus identifying it as the best fit for online, battery-powered deployments. On the other hand, LightGBM had the least memory usage (152 MB), so it can be considered for very RAM-constrained legacy devices. Deep Forest recorded a very high accuracy but used 25 times more energy than XGBoost, thus ruling it out for extreme edge applications. All models exceeded 99.98% accuracy. This paper presents a containerized and reproducible benchmarking framework to measure the energy efficiency, memory, and latency which offers scientifically grounded guidelines for lightweight IDS deployment in the Edge-IoT environments.
References
Adeyemi T. S., & Muhammed A. (2024). Botnet attack detection in IoT using machine learning models. Int. J. Sci. Res. Arch., 12(1), 2221-2229. https://doi.org/10.30574/ijsra.2024.12.1.0936
Ali Z., Tiberti W., Marotta A., & Cassioli D. (2025). Deep Transfer Learning for Intrusion Detection in Edge Computing Scenarios. IEEE Internet of Things J., 12(21), 44882.
Asimily. (2025). The Top Internet of Things (IoT) Cybersecurity Breaches in 2025. [Online]. https://asimily.com/blog
Bankó M. B., Dyszewski S., Králová M., Limpek M. B., Papaioannou M., Choudhary G., & Dragoni N. (2025). Advancements in Machine Learning-Based Intrusion Detection in IoT: Research Trends and Challenges. Algorithms, 18(4), 209.
Belachew H. M., Beyene M. Y., Desta A. B., Alemu B. T., Musa S. S., & Muhammed A. J. (2025). Design a Robust DDoS Attack Detection and Mitigation Scheme in SDN-EdgeIoT by Leveraging Machine Learning. IEEE Access.
Chen T., & Guestrin C. (2016). XGBoost: A scalable tree boosting system. Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, pp. 785-794. https://doi.org/10.1145/2939672.2939785
Eguavoen, V. O., Olanrewaju, B. S., & Okafor, C. N. (2025). A hybrid CNN-LSTM and AdaBoost model for classifying intrusion in IoT networks. FUDMA Journal of Sciences (FJS), 9(5), 204-212. https://doi.org/10.33003/fis-2025-0905-3495
Hejazi S. M., Alshalabi A. Y., Hatamleh M., & Albaroudi E. (2025). A Lightweight Hybrid Deep Learning-Based Intrusion Detection System for Detecting Botnet Attacks in IoT
Networks. J. Sci. Res. Rep., 31(11), 97-120. https://doi.org/10.9734/jsrr/2025/v311113654
IoT Analytics. (2025). State of IoT 2025: Number of connected IoT devices growing 14% to 21.1 billion. [Online]. https://iot-analytics.com
Jamshidi S., Erfan F., Abdul-Wahab O., Bellaiche M., & Khomh F. (2025). Lightweight Autoencoder-Isolation Forest Anomaly Detection for Green IoT Edge Gateways. arXiv preprint arXiv:2511.18235.
Kallimani R., Pai K., Raghuwanshi P., Iyer S., & López O. L. A. (2023). TinyML: Tools, Applications, Challenges, and Future Research Directions. arXiv preprint arXiv:2303.13569.
Ke G., Meng Q., Finley T., Wang T., Chen W., Ma W., & Liu T. Y. (2017). LightGBM: A highly efficient gradient boosting decision tree. Adv. Neural Inf. Process. Syst., 30.
Krebs B. (2025). DDoS Botnet 'Aisuru' Blankets U.S. ISPs in Record DDoS. KrebsOnSecurity. [Online]. https://krebsonsecurity.com
Lundqvist T., et al. (2025). Lightweight Machine Learning Models for Intrusion Detection on IoT Devices. ResearchGate.
Marzano A., Alexander D., Fonseca O., Fazzion E., Hoepers C., Steding-Jessen K., & Meira W. Jr. (2018). The Evolution of Bashlite and Mirai IoT Botnets. 2018 IEEE Symposium on Computers and Communications (ISCC), pp. 813-818.
Mostafavi A. (2025). Lightweight AI Models for IDS in IIoT: Balancing Accuracy and Computational Efficiency. M.Sc. Thesis, Mälardalen University, Sweden.
Moustafa N. (2021). ToN_IoT Datasets. University of New South Wales (UNSW). [Online]. https://research.unsw.edu.au/projects/toniot-datasets
Popoola S. I., Adebisi B., Ande R., Hammoudeh M., Anoh K., & Atayero A. A. (2021). SMOTE-DRNN: A Deep Learning Algorithm for Botnet Detection in the Internet-ofThings Networks. Sensors, 21(9), 2985.
Rahmati M. (2025). Towards Explainable and Lightweight AI for Real-Time Cyber Threat Hunting in Edge Networks. arXiv preprint arXiv:2504.16118.
Reis M. J. C. S. (2025). Edge-FLGuard+: A Federated and Lightweight Anomaly Detection Framework for Securing 5G-Enabled IoT in Smart Homes. Future Internet, 17, 179.
Roy S., Li J., & Bai Y. (2024). Federated Learning-Based Intrusion Detection System for IoT Environments with Locally Adapted Model. 2024 IEEE International Conference on Computing, Networking and Communications (ICNC). https://doi.org/10.1109/ICNC57223.2024.10417048
Rupanetti D., & Kaabouch N. (2025). Leveraging Machine Learning for Botnet Attack Detection in Edge-Computing Assisted IoT Networks. arXiv preprint arXiv:2508.01542.
Sharma A., Rani S., & Shabaz M. (2025). An optimized stacking-based TinyML model for attack detection in IoT networks. PLOS ONE, 20(8), e0329227. https://doi.org/10.1371/journal.pone.0329227
Singh N. J., Hoque N., Singh K. R., & Bhattacharyya D. K. (2024). Botnet-based IoT network traffic analysis using deep learning. Security and Privacy, 7(2), e355. https://doi.org/10.1002/spy2.355
Zhou Z. H., & Feng J. (2019). Deep Forest. Natl. Sci. Rev., 6(1), 74-86. https://doi.org/10.1093/nsr/nwy108
Downloads
Published
Issue
Section
Categories
License
Copyright (c) 2026 Aliyu Haruna, Salisu Ibrahim Yusuf, Suleiman Aliyu Muhammed
This work is licensed under a Creative Commons Attribution 4.0 International License.
