{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,14]],"date-time":"2026-10-14T08:03:17Z","timestamp":1791964997524,"version":"4.3.4"},"reference-count":50,"publisher":"MDPI AG","issue":"1","license":[{"start":{"date-parts":[[2022,12,26]],"date-time":"2022-12-26T00:00:00Z","timestamp":1672012800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/501100001602","name":"Science Foundation Ireland","doi-asserted-by":"publisher","award":["12\/RC\/2289-P2"],"award-info":[{"award-number":["12\/RC\/2289-P2"]}],"id":[{"id":"10.13039\/501100001602","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Future Internet"],"abstract":"<jats:p>This study proposes a heterogeneous hardware-based framework for network intrusion detection using lightweight artificial neural network models. With the increase in the volume of exchanged data, IoT networks\u2019 security has become a crucial issue. Anomaly-based intrusion detection systems (IDS) using machine learning have recently gained increased popularity due to their generation\u2019s ability to detect unseen attacks. However, the deployment of anomaly-based AI-assisted IDS for IoT devices is computationally expensive. A high-performance and ultra-low power consumption anomaly-based IDS framework is proposed and evaluated in this paper. The framework has achieved the highest accuracy of 98.57% and 99.66% on the UNSW-NB15 and IoT-23 datasets, respectively. The inference engine on the MAX78000EVKIT AI-microcontroller is 11.3 times faster than the Intel Core i7-9750H 2.6 GHz and 21.3 times faster than NVIDIA GeForce GTX 1650 graphics cards, when the power drawn was 18mW. In addition, the pipelined design on the PYNQ-Z2 SoC FPGA board with the Xilinx Zynq xc7z020-1clg400c device is optimised to run at the on-chip frequency (100 MHz), which shows a speedup of 53.5 times compared to the MAX78000EVKIT.<\/jats:p>","DOI":"10.3390\/fi15010009","type":"journal-article","created":{"date-parts":[[2022,12,27]],"date-time":"2022-12-27T07:31:56Z","timestamp":1672126316000},"page":"9","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":19,"title":["HH-NIDS: Heterogeneous Hardware-Based Network Intrusion Detection Framework for IoT Security"],"prefix":"10.3390","volume":"15","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-9253-8777","authenticated-orcid":false,"given":"Duc-Minh","family":"Ngo","sequence":"first","affiliation":[{"name":"Electrical and Electronic Engineering, University College Cork, T12 K8AF Cork, Ireland"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Dominic","family":"Lightbody","sequence":"additional","affiliation":[{"name":"Electrical and Electronic Engineering, University College Cork, T12 K8AF Cork, Ireland"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6548-0971","authenticated-orcid":false,"given":"Andriy","family":"Temko","sequence":"additional","affiliation":[{"name":"Electrical and Electronic Engineering, University College Cork, T12 K8AF Cork, Ireland"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-2917-1244","authenticated-orcid":false,"given":"Cuong","family":"Pham-Quoc","sequence":"additional","affiliation":[{"name":"Computer Science and Engineering, Ho Chi Minh City University of Technology (HCMUT), VNU-HCM, 268 Ly Thuong Kiet St., Dist. 10, Ho Chi Minh City 740050, Vietnam"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3899-7566","authenticated-orcid":false,"given":"Ngoc-Thinh","family":"Tran","sequence":"additional","affiliation":[{"name":"Computer Science and Engineering, Ho Chi Minh City University of Technology (HCMUT), VNU-HCM, 268 Ly Thuong Kiet St., Dist. 10, Ho Chi Minh City 740050, Vietnam"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Colin C.","family":"Murphy","sequence":"additional","affiliation":[{"name":"Electrical and Electronic Engineering, University College Cork, T12 K8AF Cork, Ireland"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Emanuel","family":"Popovici","sequence":"additional","affiliation":[{"name":"Electrical and Electronic Engineering, University College Cork, T12 K8AF Cork, Ireland"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2022,12,26]]},"reference":[{"key":"ref_1","unstructured":"Vailshery, L.S. (2022, November 08). Number of Internet of Things (IoT) Connected Devices Worldwide from 2019 to 2030. Available online: https:\/\/www.statista.com\/statistics\/1183457\/iot-connected-devices-worldwide\/."},{"key":"ref_2","doi-asserted-by":"crossref","first-page":"19","DOI":"10.1016\/j.jnca.2015.11.016","article-title":"A survey of network anomaly detection techniques","volume":"60","author":"Ahmed","year":"2016","journal-title":"J. Netw. Comput. Appl."},{"key":"ref_3","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1016\/j.comcom.2014.04.012","article-title":"False alarm minimization techniques in signature-based intrusion detection systems: A survey","volume":"49","author":"Hubballi","year":"2014","journal-title":"Comput. Commun."},{"key":"ref_4","doi-asserted-by":"crossref","unstructured":"Heidari, A., and Jabraeil Jamali, M.A. (2022). Internet of Things intrusion detection systems: A comprehensive review and future directions. Cluster Comput., 1\u201328.","DOI":"10.1007\/s10586-022-03776-z"},{"key":"ref_5","doi-asserted-by":"crossref","first-page":"18","DOI":"10.1016\/j.cose.2008.08.003","article-title":"Anomaly-based network intrusion detection: Techniques, systems and challenges","volume":"28","year":"2009","journal-title":"Comput. Secur."},{"key":"ref_6","doi-asserted-by":"crossref","unstructured":"Gao, C., Braun, S., Kiselev, I., Anumula, J., Delbruck, T., and Liu, S. (2019, January 26\u201329). Real-Time Speech Recognition for IoT Purpose using a Delta Recurrent Neural Network Accelerator. Proceedings of the 2019 IEEE International Symposium on Circuits and Systems (ISCAS), Sapporo, Japan.","DOI":"10.1109\/ISCAS.2019.8702290"},{"key":"ref_7","doi-asserted-by":"crossref","unstructured":"Maitra, S., Richards, D., Abdelgawad, A., and Yelamarthi, K. (2019, January 11\u201313). Performance Evaluation of IoT Encryption Algorithms: Memory, Timing, and Energy. Proceedings of the 2019 IEEE Sensors Applications Symposium (SAS), Sophia Antipolis, France.","DOI":"10.1109\/SAS.2019.8706017"},{"key":"ref_8","doi-asserted-by":"crossref","unstructured":"Antonopoulos, C.P., and Voros, N.S. (2017). A data compression hardware accelerator enabling long-term biosignal monitoring based on ultra-low power IoT platforms. Electronics, 6.","DOI":"10.3390\/electronics6030054"},{"key":"ref_9","unstructured":"Expertsystem (2022, November 08). What Is Machine Learning? A Definition. Available online: https:\/\/www.expertsystem.com\/machine-learning-definition\/."},{"key":"ref_10","unstructured":"Sidana, M. (2022, November 08). Types of Classification Algorithms in Machine Learning. Available online: https:\/\/medium.com\/@Mandysidana\/machine-learning-types-of-classification-9497bd4f2e14."},{"key":"ref_11","doi-asserted-by":"crossref","unstructured":"Ngo, D.M., Temko, A., Murphy, C.C., and Popovici, E. (September, January 30). FPGA Hardware Acceleration Framework for Anomaly-based Intrusion Detection System in IoT. Proceedings of the 2021 31st International Conference on Field-Programmable Logic and Applications (FPL), Dresden, Germany.","DOI":"10.1109\/FPL53798.2021.00020"},{"key":"ref_12","unstructured":"Garcia, S., Parmisano, A., and Erquiaga, M. (2020). IoT-23: A Labeled Dataset with Malicious and Benign IoT Network Traffic, Stratosphere Lab."},{"key":"ref_13","doi-asserted-by":"crossref","unstructured":"Moustafa, N., and Slay, J. (2015, January 10\u201312). UNSW-NB15: A comprehensive data set for network intrusion detection systems (UNSW-NB15 network data set). Proceedings of the 2015 Military Communications and Information Systems Conference (MilCIS), Canberra, Australia.","DOI":"10.1109\/MilCIS.2015.7348942"},{"key":"ref_14","unstructured":"Integrated, M. (2022, November 08). MAX78000\u2014Artificial Intelligence Microcontroller with Ultra-Low-Power Convolutional Neural Network Accelerator. Available online: https:\/\/www.maximintegrated.com\/en\/products\/microcontrollers\/MAX78000.html."},{"key":"ref_15","unstructured":"Integrated, M. (2022, November 08). MAX78000EVKIT\u2014Evaluation Kit for the MAX78000. Available online: https:\/\/www.maximintegrated.com\/en\/products\/microcontrollers\/MAX78000EVKIT.html."},{"key":"ref_16","unstructured":"Xilinx (2022, November 08). XUP PYNQ-Z2. Available online: https:\/\/www.xilinx.com\/support\/university\/xup-boards\/XUPPYNQ-Z2.html."},{"key":"ref_17","doi-asserted-by":"crossref","first-page":"102675","DOI":"10.1016\/j.cose.2022.102675","article-title":"A systematic literature review of methods and datasets for anomaly-based network intrusion detection","volume":"116","author":"Yang","year":"2022","journal-title":"Comput. Secur."},{"key":"ref_18","doi-asserted-by":"crossref","unstructured":"Alsoufi, M.A., Razak, S., Siraj, M.M., Nafea, I., Ghaleb, F.A., Saeed, F., and Nasser, M. (2021). Anomaly-based intrusion detection systems in IoT using deep learning: A systematic literature review. Appl. Sci., 11.","DOI":"10.3390\/app11188383"},{"key":"ref_19","doi-asserted-by":"crossref","unstructured":"Mishra, A., and Yadav, P. (2020, January 28\u201329). Anomaly-based IDS to detect attack using various artificial intelligence & machine learning algorithms: A review. Proceedings of the 2nd International Conference on Data, Engineering and Applications (IDEA), Bhopal, India.","DOI":"10.1109\/IDEA49133.2020.9170674"},{"key":"ref_20","doi-asserted-by":"crossref","first-page":"100059","DOI":"10.1016\/j.iot.2019.100059","article-title":"Attack and anomaly detection in IoT sensors in IoT sites using machine learning approaches","volume":"7","author":"Hasan","year":"2019","journal-title":"Internet Things"},{"key":"ref_21","doi-asserted-by":"crossref","first-page":"137","DOI":"10.3103\/S0146411621020085","article-title":"Design of anomaly-based intrusion detection system using fog computing for IoT network","volume":"55","author":"Kumar","year":"2021","journal-title":"Autom. Control Comput. Sci."},{"key":"ref_22","doi-asserted-by":"crossref","first-page":"95","DOI":"10.47760\/ijcsmc.2020.v09i10.012","article-title":"Attack and anomaly detection in IoT networks using machine learning","volume":"9","author":"Thamaraiselvi","year":"2020","journal-title":"Int. J. Comput. Sci. Mob. Comput"},{"key":"ref_23","doi-asserted-by":"crossref","first-page":"41525","DOI":"10.1109\/ACCESS.2019.2895334","article-title":"Deep learning approach for intelligent intrusion detection system","volume":"7","author":"Vinayakumar","year":"2019","journal-title":"IEEE Access"},{"key":"ref_24","doi-asserted-by":"crossref","first-page":"48697","DOI":"10.1109\/ACCESS.2018.2867564","article-title":"An intrusion detection system using a deep neural network with gated recurrent units","volume":"6","author":"Xu","year":"2018","journal-title":"IEEE Access"},{"key":"ref_25","doi-asserted-by":"crossref","unstructured":"Nguyen, T.D., Marchal, S., Miettinen, M., Fereidooni, H., Asokan, N., and Sadeghi, A.R. (2019, January 7\u20139). D\u00cfoT: A federated self-learning anomaly detection system for IoT. Proceedings of the 2019 IEEE 39th International Conference on Distributed Computing Systems (ICDCS), Dallas, TX, USA.","DOI":"10.1109\/ICDCS.2019.00080"},{"key":"ref_26","doi-asserted-by":"crossref","first-page":"2545","DOI":"10.1109\/JIOT.2021.3077803","article-title":"Federated-Learning-Based Anomaly Detection for IoT Security Attacks","volume":"9","author":"Mothukuri","year":"2021","journal-title":"IEEE Internet Things J."},{"key":"ref_27","doi-asserted-by":"crossref","unstructured":"Vaccari, I., Chiola, G., Aiello, M., Mongelli, M., and Cambiaso, E. (2020). MQTTset, a New Dataset for Machine Learning Techniques on MQTT. Sensors, 20.","DOI":"10.3390\/s20226578"},{"key":"ref_28","doi-asserted-by":"crossref","first-page":"77396","DOI":"10.1109\/ACCESS.2020.2986013","article-title":"Effective attack detection in internet of medical things smart environment using a deep belief neural network","volume":"8","author":"Manimurugan","year":"2020","journal-title":"IEEE Access"},{"key":"ref_29","doi-asserted-by":"crossref","first-page":"112","DOI":"10.1109\/TSMC.2020.2968516","article-title":"Anomaly detection based on convolutional recurrent autoencoder for IoT time series","volume":"52","author":"Yin","year":"2020","journal-title":"IEEE Trans. Syst. Man Cybern. Syst."},{"key":"ref_30","doi-asserted-by":"crossref","unstructured":"Bovenzi, G., Aceto, G., Ciuonzo, D., Persico, V., and Pescap\u00e9, A. (2020, January 7\u201311). A hierarchical hybrid intrusion detection approach in IoT scenarios. Proceedings of the GLOBECOM 2020 IEEE Global Communications Conference, Taipei, Taiwan.","DOI":"10.1109\/GLOBECOM42002.2020.9348167"},{"key":"ref_31","doi-asserted-by":"crossref","first-page":"19","DOI":"10.1007\/s12530-020-09347-0","article-title":"A graph neural network method for distributed anomaly detection in IoT","volume":"12","author":"Protogerou","year":"2021","journal-title":"Evol. Syst."},{"key":"ref_32","doi-asserted-by":"crossref","unstructured":"Dutta, V., Chora\u015b, M., Pawlicki, M., and Kozik, R. (2020). A deep learning ensemble for network anomaly and cyber-attack detection. Sensors, 20.","DOI":"10.3390\/s20164583"},{"key":"ref_33","doi-asserted-by":"crossref","first-page":"62722","DOI":"10.1109\/ACCESS.2022.3176317","article-title":"Design and Development of RNN Anomaly Detection Model for IoT Networks","volume":"10","author":"Ullah","year":"2022","journal-title":"IEEE Access"},{"key":"ref_34","doi-asserted-by":"crossref","unstructured":"Hussain, F., Abbas, S.G., Fayyaz, U.U., Shah, G.A., Toqeer, A., and Ali, A. (2020). Towards a Universal Features Set for IoT Botnet Attacks Detection. arXiv.","DOI":"10.21203\/rs.3.rs-114467\/v1"},{"key":"ref_35","unstructured":"Storcheus, D., Rostamizadeh, A., and Kumar, S. (2015, January 11). A survey of modern questions and challenges in feature extraction. Proceedings of the Feature Extraction: Modern Questions and Challenges. PMLR, Montreal, QC, Canada."},{"key":"ref_36","unstructured":"Stoian, N.A. (2020). Machine Learning for Anomaly Detection in IoT Networks: Malware Analysis on the IoT-23 Data Set. [Bachelor Thesis, University of Twente]."},{"key":"ref_37","doi-asserted-by":"crossref","unstructured":"Hegde, M., Kepnang, G., Al Mazroei, M., Chavis, J.S., and Watkins, L. (2020, January 19\u201322). Identification of Botnet Activity in IoT Network Traffic Using Machine Learning. Proceedings of the 2020 International Conference on Intelligent Data Science Technologies and Applications (IDSTA), Valencia, Spain.","DOI":"10.1109\/IDSTA50958.2020.9264143"},{"key":"ref_38","doi-asserted-by":"crossref","unstructured":"Nobakht, M., Javidan, R., and Pourebrahimi, A. (2022). DEMD-IoT: A deep ensemble model for IoT malware detection using CNNs and network traffic. Evol. Syst., 1\u201317.","DOI":"10.1007\/s12530-022-09471-z"},{"key":"ref_39","doi-asserted-by":"crossref","unstructured":"Alani, M.M., and Miri, A. (2022). Towards an Explainable Universal Feature Set for IoT Intrusion Detection. Sensors, 22.","DOI":"10.3390\/s22155690"},{"key":"ref_40","doi-asserted-by":"crossref","unstructured":"Douiba, M., Benkirane, S., Guezzaz, A., and Azrour, M. (2022). An improved anomaly detection model for IoT security using decision tree and gradient boosting. J. Supercomput., 1\u201320.","DOI":"10.1007\/s11227-022-04783-y"},{"key":"ref_41","doi-asserted-by":"crossref","unstructured":"Kumar, S., Sahoo, S., Mahapatra, A., Swain, A.K., and Mahapatra, K.K. (2017, January 18\u201320). Security enhancements to system on chip devices for IoT perception layer. Proceedings of the 2017 IEEE International Symposium on Nanoelectronic and Information Systems (iNIS), Bhopal, India.","DOI":"10.1109\/iNIS.2017.39"},{"key":"ref_42","doi-asserted-by":"crossref","unstructured":"Ch\u00e9our, R., Khriji, S., Abid, M., and Kanoun, O. (2020, January 2\u201316). Microcontrollers for IoT: Optimizations, computing paradigms, and future directions. Proceedings of the 2020 IEEE 6th World Forum on Internet of Things (WF-IoT), New Orleans, LA, USA.","DOI":"10.1109\/WF-IoT48130.2020.9221219"},{"key":"ref_43","first-page":"150","article-title":"Semantic caching framework: An FPGA-based application for IoT security monitoring","volume":"4","author":"Lallet","year":"2018","journal-title":"Open J. Internet Things (OJIoT)"},{"key":"ref_44","unstructured":"van Long, N.H., Lallet, J., Casseau, E., and d\u2019Orazio, L. (2020, January 4). Mascara (ModulAr semantic caching framework) towards FPGA acceleration for IoT security monitoring. Proceedings of the International Workshop on Very Large Internet of Things (VLIoT 2020), Tokyo, Japan."},{"key":"ref_45","doi-asserted-by":"crossref","unstructured":"Wielgosz, M., and Karwatowski, M. (2019). Mapping neural networks to FPGA-based IoT devices for ultra-low latency processing. Sensors, 19.","DOI":"10.3390\/s19132981"},{"key":"ref_46","doi-asserted-by":"crossref","unstructured":"Kalantar, A., Zimmerman, Z., and Brisk, P. (2021, January 9\u201312). FA-LAMP: Fpga-accelerated learned approximate matrix profile for time series similarity prediction. Proceedings of the 2021 IEEE 29th Annual International Symposium on Field-Programmable Custom Computing Machines (FCCM), Orlando, FL, USA.","DOI":"10.1109\/FCCM51124.2021.00013"},{"key":"ref_47","doi-asserted-by":"crossref","unstructured":"Ioannou, L., and Fahmy, S.A. (2019, January 9\u201313). Network intrusion detection using neural networks on FPGA SoCs. Proceedings of the 2019 29th International Conference on Field Programmable Logic and Applications (FPL), Barcelona, Spain.","DOI":"10.1109\/FPL.2019.00043"},{"key":"ref_48","doi-asserted-by":"crossref","first-page":"1","DOI":"10.5121\/ijdkp.2015.5201","article-title":"A review on evaluation metrics for data classification evaluations","volume":"5","author":"Hossin","year":"2015","journal-title":"Int. J. Data Min. Knowl. Manag. Process"},{"key":"ref_49","doi-asserted-by":"crossref","first-page":"1422","DOI":"10.3897\/jucs.2020.075","article-title":"Detection of Cyberattacks Traces in IoT Data","volume":"26","author":"Dutta","year":"2020","journal-title":"J. Univers. Comput. Sci."},{"key":"ref_50","first-page":"465","article-title":"Dos detection method based on artificial neural networks","volume":"8","author":"Idhammad","year":"2017","journal-title":"Int. J. Adv. Comput. Sci. Appl."}],"container-title":["Future Internet"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1999-5903\/15\/1\/9\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,11]],"date-time":"2025-10-11T01:51:25Z","timestamp":1760147485000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1999-5903\/15\/1\/9"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,12,26]]},"references-count":50,"journal-issue":{"issue":"1","published-online":{"date-parts":[[2023,1]]}},"alternative-id":["fi15010009"],"URL":"https:\/\/doi.org\/10.3390\/fi15010009","relation":{},"ISSN":["1999-5903"],"issn-type":[{"value":"1999-5903","type":"electronic"}],"subject":[],"published":{"date-parts":[[2022,12,26]]}}}