KronNet a lightweight Kronecker enhanced feed forward neural network for efficient IoT intrusion detection.

The rapid expansion of Internet of Things (IoT) networks necessitates efficient intrusion detection systems (IDS) capable of operating within the stringent resource constraints of IoT devices. This study introduces KronNet, a lightweight feed-forward neural network enhanced with Kronecker product operations, designed for real-time IoT intrusion detection. KronNet leverages Gaussian Mixture Model (GMM)-based oversampling and a hybrid loss function combining Focal Loss and Cross-Entropy with adaptive class weighting to address class imbalance, ensuring robust detection across diverse attack types. Evaluated on the CICIoT2023 and BoT-IoT datasets, KronNet achieves exceptional performance, with accuracies of 99.01% and 99.91%, weighted F1-scores of 99.01% and 99.91%, and low false positive rates of 0.03% and 0.01%, respectively. The model operates with minimal computational overhead, utilizing 5,074 parameters (19.82 KB) for CICIoT2023 and 4,703 parameters (18.37 KB) for BoT-IoT, with inference times of 0.209 ms and 0.208 ms. Post-quantization, memory usage reduces to 4.96 KB and 4.59 KB, with negligible accuracy degradation (0.06% and 0.01% loss). Compared to state-of-the-art models, KronNet demonstrates up to 15,829× lower FLOPS and 12,010× faster inference, making it a highly efficient solution for edge deployment in resource-constrained IoT environments. This work advances IoT cybersecurity by delivering a scalable, accurate, and lightweight IDS capable of real-time threat detection.