Abstract

The proliferation of IoT devices creates a vast attack surface requiring intrusion detection systems (IDS) that balance high accuracy with the computational constraints of edge environments. This paper addresses the problem of achieving robust security within strict resource limits. We introduce a comprehensive benchmarking framework to jointly evaluate detection quality and computational efficiency. Our core contribution is the Graph-Temporal Aware Heterogeneous Ensemble (GTA-HE), a novel two-view ensemble. It strategically combines lightweight tree-based models with more powerful, but computationally expensive, deep sequence models only when necessary to optimize both detection performance and inference speed. Using the BoT-IoT dataset, we apply multi-stage preprocessing and enrich features with graph-temporal summaries capturing inter-device patterns and temporal dynamics. Results show that while traditional tree-based methods (Random Forest, XGBoost) saturate at 0.99 accuracy, our GTA-HE is the only architecture to achieve 1.00 accuracy and F1 scores (two-decimal precision) due to the selected dataset’s relatively distinct feature values. The ensemble successfully corrects the false negatives produced by lighter models when faced with complex attack patterns. In contrast, standalone deep sequence models show poor minority-class recall while requiring orders of magnitude more computation time. The proposed GTA-HE achieves 1.00 accuracy with exceptional computational efficiency, achieving an inference time of only 5.90 ms and a throughput exceeding 6.2 million samples per second, indicating that our approach could be used in real-time-critical systems. Our work demonstrates that sophisticated, selective ensembles like GTA-HE can deliver superior security without compromising the operational efficiency required at the edge.