article · East African Journal of Information Technology
Network intrusion detection systems frequently demand substantial computational resources, limiting their practical deployment in constrained computing environments. A Bayesian optimisation framework enables the creation of compact deep learning models by balancing classification accuracy against parameter count and inference speed. Evaluated across software-defined networking and Internet of Things datasets, the resulting compact convolutional and recurrent models reduce trainable parameters by over 70 per cent compared to standard baselines. These configurations achieve inference speeds between 2.2 and 2.4 milliseconds per sample and macro-F1 scores between 81.20 and 88.76 per cent. While standard gradient boosting methods achieve higher detection accuracy across the same benchmarks, the optimised compact models establish consistent efficiency characteristics across structurally diverse network datasets. This trade-off provides an empirical baseline for sequential intrusion detection architectures in environments where computing capacity is strictly limited.
Many modern network security models require high-performance hardware that is impractical for edge devices or resource-constrained institutional networks. Demonstrating how to systematically reduce neural network size while measuring the exact trade-off in detection accuracy helps engineers design intrusion detection tools tailored to environments with strict processing, memory, and latency constraints.
This research represents early-stage, experimental development evaluated on benchmark datasets and controlled laboratory hardware rather than live network environments. The approach could eventually enable network security vendors and institutional system administrators to run lightweight intrusion detection on low-power devices, edge gateways, or software-defined infrastructure. Real-world deployment remains distant, as validation on actual target hardware and operational networks has not yet taken place.
AI-generated from the published abstract. Always read the original work before citing.
Intrusion detection research has consistently prioritised classification accuracy while treating computational cost as a secondary concern, producing models that perform well on individual benchmarks but whose efficiency properties, and whether those properties hold consistently across different network environments, are rarely evaluated systematically. Using a quantitative, experimental research design, this paper presents a Bayesian-optimised compact CNN-LSTM intrusion detection model and evaluates whether a favourable accuracy-efficiency trade-off, once achieved through hardware-aware hyperparameter optimisation, generalises across structurally heterogeneous benchmarks rather than being an artefact of a single dataset. Using a composite optimisation objective that jointly penalises inference latency and parameter count alongside macro-F1, the proposed model converges to architectures of 8,258 to 12,905 trainable parameters, a reduction of 70.8 to 81.4 per cent relative to a non-optimised baseline, across three heterogeneous benchmarks: InSDN (SDN), ToN-IoT (IoT telemetry), and Edge-IIoTset (edge-IoT). Six of nine optimised hyperparameters converge to consistent values across all three benchmarks, and a penalty weight sensitivity analysis confirms this compact configuration is a structural property of the optimisation objective rather than a per-dataset coincidence. The model achieves macro-F1 between 81.20% and 88.76% across the three benchmarks, with per-sample inference latency of 2.2 to 2.4 ms at batch size 1 on a controlled GPU benchmark, and performance differences across the eight evaluated methods are confirmed statistically significant by Friedman and Kruskal-Wallis tests. Gradient boosting baselines (XGBoost, LightGBM, CatBoost) consistently achieve higher macro-F1 than the compact CNN-LSTM across all three benchmarks, a finding this paper reports directly rather than minimises. The results characterise a reproducible, cross-dataset accuracy-efficiency trade-off pattern for compact sequential IDS models in resource-constrained deployment contexts, illustrated here with documented infrastructure and threat data from Sub-Saharan African institutional networks, presented as one practically relevant setting in which this trade-off is potentially meaningful, rather than as a claim validated through deployment on target hardware.
This page summarises published work. The authoritative version sits with the publisher.
DOI: 10.37284/eajit.9.2.5651
Is something wrong with this record? Report it or request removal.
Discussion
Have you built on this work, tried to replicate it, or seen it applied in practice? Share what you know. Verified researchers and MARATTO™ domain experts can open a discussion, and any member can reply. Contributions are reviewed before they appear.
No discussion yet. Open the first thread.
New to MARATTO™? Create a free account.
