{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,4]],"date-time":"2026-03-04T17:17:31Z","timestamp":1772644651749,"version":"3.50.1"},"reference-count":35,"publisher":"MDPI AG","issue":"3","license":[{"start":{"date-parts":[[2026,3,4]],"date-time":"2026-03-04T00:00:00Z","timestamp":1772582400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"KAU Endowment (WAQF) at King Abdulaziz University, Jeddah, Saudi Arabia"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Future Internet"],"abstract":"<jats:p>The emergence of the Internet of Things (IoT) has introduced major security challenges. Deep learning models have shown strong potential for intrusion detection. However, they often require large datasets and high computational resources. In contrast, IoT environments are resource-constrained and lack sufficient labeled data. This paper proposes a lightweight intrusion detection approach based on Long Short-Term Memory (LSTM) networks and homogeneous transfer deep learning. The model is first trained on a subset of the BoT-IoT dataset as a source domain. It is then fine-tuned on a disjoint subset containing a rare attack type. This setup represents adaptation to unseen attack behaviors within the same environment. By freezing earlier layers and fine-tuning only the final layers, the method reduces training overhead while preserving performance. This is important to meet the IoT requirement for frequent, lightweight model updates on resource-constrained devices. The proposed model achieved 99.9% accuracy, a macro F1-score of 0.96, and a 47.8% reduction in training time compared to training from scratch. Extensive experiments confirm that it maintains balanced detection across both common and rare classes.<\/jats:p>","DOI":"10.3390\/fi18030133","type":"journal-article","created":{"date-parts":[[2026,3,4]],"date-time":"2026-03-04T13:11:36Z","timestamp":1772629896000},"page":"133","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["Lightweight LSTM-Based Homogeneous Transfer Learning for Efficient On-Device IoT Intrusion Detection"],"prefix":"10.3390","volume":"18","author":[{"ORCID":"https:\/\/orcid.org\/0009-0000-1615-7852","authenticated-orcid":false,"given":"Amjad","family":"Gamlo","sequence":"first","affiliation":[{"name":"Department of Computer Science, Faculty of Computing and Information Technology, King Abdulaziz University, Jeddah 21589, Saudi Arabia"},{"name":"Department of Computer Science, Jamoum University College, Umm Al-Qura University, Makkah 21955, Saudi Arabia"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-0806-1396","authenticated-orcid":false,"given":"Sanaa","family":"Sharaf","sequence":"additional","affiliation":[{"name":"Department of Computer Science, Faculty of Computing and Information Technology, King Abdulaziz University, Jeddah 21589, Saudi Arabia"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-7574-611X","authenticated-orcid":false,"given":"Rania","family":"Molla","sequence":"additional","affiliation":[{"name":"Department of Computer Science, Faculty of Computing and Information Technology, King Abdulaziz University, Jeddah 21589, Saudi Arabia"}]}],"member":"1968","published-online":{"date-parts":[[2026,3,4]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"103111","DOI":"10.1016\/j.jnca.2021.103111","article-title":"Towards Secure Intrusion Detection Systems Using Deep Learning Techniques: Comprehensive Analysis and Review","volume":"187","author":"Lee","year":"2021","journal-title":"J. Netw. Comput. Appl."},{"key":"ref_2","doi-asserted-by":"crossref","first-page":"105","DOI":"10.1016\/j.knosys.2019.105124","article-title":"Deep Learning Approaches for Anomaly-Based Intrusion Detection Systems: A Survey, Taxonomy, and Open Issues","volume":"189","author":"Aldweesh","year":"2020","journal-title":"Knowl. Based Syst."},{"key":"ref_3","doi-asserted-by":"crossref","unstructured":"Lakshmanna, K., Kaluri, R., Gundluru, N., Alzamil, Z.S., Rajput, D.S., Khan, A.A., Haq, M.A., and Alhussen, A. (2022). A Review on Deep Learning Techniques for IoT Data. Electronics, 11.","DOI":"10.3390\/electronics11101604"},{"key":"ref_4","doi-asserted-by":"crossref","first-page":"43","DOI":"10.1109\/JPROC.2020.3004555","article-title":"A Comprehensive Survey on Transfer Learning","volume":"Volume 109","author":"Zhuang","year":"2021","journal-title":"Proceedings of the IEEE"},{"key":"ref_5","unstructured":"Khouas, A.R., Bouadjenek, M.R., Hacid, H., and Aryal, S. (2024). Training Machine Learning Models at the Edge: A Survey. arXiv."},{"key":"ref_6","doi-asserted-by":"crossref","unstructured":"Gyamfi, E., and Jurcut, A. (2022). Intrusion Detection in Internet of Things Systems: A Review on Design Approaches Leveraging Multi-Access Edge Computing, Machine Learning, and Datasets. Sensors, 22.","DOI":"10.3390\/s22103744"},{"key":"ref_7","doi-asserted-by":"crossref","unstructured":"Alrayes, F.S., Amin, S.U., and Hakami, N. (2025). An Adaptive Framework for Intrusion Detection in IoT Security Using MAML (Model-Agnostic Meta-Learning). Sensors, 25.","DOI":"10.3390\/s25082487"},{"key":"ref_8","doi-asserted-by":"crossref","unstructured":"Rodr\u00edguez, E., Valls, P., Otero, B., Costa, J.J., Verd\u00fa, J., Pajuelo, M.A., and Canal, R. (2022). Transfer-Learning-Based Intrusion Detection Framework in IoT Networks. Sensors, 22.","DOI":"10.3390\/s22155621"},{"key":"ref_9","doi-asserted-by":"crossref","unstructured":"Mehedi, S.T., Anwar, A., Rahman, Z., Ahmed, K., and Islam, R. (2022). Dependable Intrusion Detection System for IoT: A Deep Transfer Learning-based Approach. IEEE Transactions on Industrial Informatics, IEEE.","DOI":"10.1109\/TII.2022.3164770"},{"key":"ref_10","doi-asserted-by":"crossref","first-page":"9","DOI":"10.1186\/s40537-016-0043-6","article-title":"A Survey of Transfer Learning","volume":"3","author":"Weiss","year":"2016","journal-title":"J. Big Data"},{"key":"ref_11","doi-asserted-by":"crossref","first-page":"1345","DOI":"10.1109\/TKDE.2009.191","article-title":"A Survey on Transfer Learning","volume":"22","author":"Pan","year":"2010","journal-title":"IEEE Trans. Knowl. Data Eng."},{"key":"ref_12","first-page":"1059","article-title":"Accelerating the Update of a DL-based IDS for IoT using Deep Transfer Learning","volume":"23","author":"Idrissi","year":"2021","journal-title":"Indones. J. Electr. Eng. Comput. Sci."},{"key":"ref_13","unstructured":"Fabioand, R., and Sergio, V. (2005). Learning Intrusion Detection: Supervised or Unsupervised?. Proceedings of the Image Analysis and Processing\u2014ICIAP 2005, Springer."},{"key":"ref_14","doi-asserted-by":"crossref","unstructured":"Alsoufi, M.A., Razak, S., Siraj, M.M., Nafea, I., Ghaleb, F.A., Saeed, F., and Nasser, M. (2021). Anomaly-Based Intrusion Detection Systems in IoT Using Deep Learning: A Systematic Literature Review. Appl. Sci., 11.","DOI":"10.3390\/app11188383"},{"key":"ref_15","unstructured":"Pascanu, R., Mikolov, T., and Bengio, Y. (2013). On the Difficulty of Training Recurrent Neural Networks. Proceedings of the the 30th International Conference on Machine Learning (ICML 2013), PMLR."},{"key":"ref_16","doi-asserted-by":"crossref","unstructured":"Alimi, K.O.A., Ouahada, K., Abu-Mahfouz, A.M., Rimer, S., and Alimi, O.A. (2022). Refined LSTM Based Intrusion Detection for Denial-of-Service Attack in Internet of Things. J. Sens. Actuator Netw., 11.","DOI":"10.3390\/jsan11030032"},{"key":"ref_17","doi-asserted-by":"crossref","unstructured":"Sun, X., Meng, W., Chiu, W.Y., and Lampe, B. (2022). TDL-IDS: Towards A Transfer Deep Learning based Intrusion Detection System. Proceedings of the IEEE Global Communications Conference, GLOBECOM, Rio de Janeiro, Brazil, 4\u20138 December 2022, IEEE.","DOI":"10.1109\/GLOBECOM48099.2022.10001267"},{"key":"ref_18","doi-asserted-by":"crossref","first-page":"1251","DOI":"10.1007\/s10207-023-00787-8","article-title":"TL-BILSTM IoT: Transfer Learning Model for Prediction of Intrusion Detection System in IoT environment","volume":"23","author":"Nandanwar","year":"2024","journal-title":"Int. J. Inf. Secur."},{"key":"ref_19","doi-asserted-by":"crossref","unstructured":"Rabhi, S., Abbes, T., and Zarai, F. (2023). Transfer Learning-based Mirai Botnet Detection in IoT Networks. Proceedings of the 17th International Conference on INnovations in Intelligent SysTems and Applications, INISTA 2023, Hammamet, Tunisia, 20\u201323 September 2023, IEEE.","DOI":"10.1109\/INISTA59065.2023.10310379"},{"key":"ref_20","doi-asserted-by":"crossref","unstructured":"Maz, Y.A., Anbar, M., Manickam, S., and Abualhaj, M.M. (2024). Transfer Learning Approach for Detecting Keylogging Attack on the Internet of Things. Proceedings of the 4th International Conference on Emerging Smart Technologies and Applications, eSmarTA 2024, Sana\u2019a, Yemen, 6\u20137 August 2024, IEEE.","DOI":"10.1109\/eSmarTA62850.2024.10638915"},{"key":"ref_21","unstructured":"Kolcun, R., Popescu, D.A., Safronov, V., Yadav, P., Mandalari, A.M., Xie, Y., Mortier, R., and Haddadi, H. (2020). The Case for Retraining of ML Models for IoT Device Identification at the Edge. arXiv."},{"key":"ref_22","doi-asserted-by":"crossref","first-page":"779","DOI":"10.1016\/j.future.2019.05.041","article-title":"Towards the Development of Realistic Botnet Dataset in the Internet of Things for Network Forensic Analytics: Bot-IoT Dataset","volume":"100","author":"Koroniotis","year":"2019","journal-title":"Future Gener. Comput. Syst."},{"key":"ref_23","doi-asserted-by":"crossref","unstructured":"Liu, L., Engelen, G., Lynar, T., Essam, D., and Joosen, W. (2022). Error Prevalence in NIDS datasets: A Case Study on CIC-IDS-2017 and CSE-CIC-IDS-2018. Proceedings of the 2022 IEEE Conference on Communications and Network Security, CNS 2022, Austin, TX, USA, 3\u20135 October 2022, IEEE.","DOI":"10.1109\/CNS56114.2022.9947235"},{"key":"ref_24","doi-asserted-by":"crossref","first-page":"e386","DOI":"10.1002\/spy2.386","article-title":"A lightweight Intrusion Detection for Internet of Things-based Smart Buildings","volume":"7","author":"Murthy","year":"2024","journal-title":"Secur. Priv."},{"key":"ref_25","first-page":"533","article-title":"IoT Data Feature Extraction and Intrusion Detection System for Smart Cities based on Deep Migration Learning","volume":"49","author":"Li","year":"2019","journal-title":"Int. J. Inf. Manag."},{"key":"ref_26","doi-asserted-by":"crossref","first-page":"107784","DOI":"10.1016\/j.comnet.2020.107784","article-title":"Towards a Deep Learning-Driven Intrusion Detection Approach for Internet of Things","volume":"186","author":"Ge","year":"2021","journal-title":"Comput. Netw."},{"key":"ref_27","first-page":"100082","article-title":"A Survey on Intrusion Detection System in IoT Networks","volume":"3","author":"Rahman","year":"2025","journal-title":"Comput. Stand. Interfaces"},{"key":"ref_28","doi-asserted-by":"crossref","unstructured":"Becerra-Suarez, F.L., Tuesta-Monteza, V.A., Mejia-Cabrera, H.I., and Arcila-Diaz, J. (2024). Performance Evaluation of Deep Learning Models for Classifying Cybersecurity Attacks in IoT Networks. Informatics, 11.","DOI":"10.3390\/informatics11020032"},{"key":"ref_29","doi-asserted-by":"crossref","first-page":"99","DOI":"10.1007\/s10922-025-09973-6","article-title":"Hyperparameter Optimization and Evaluation Metrics for Unsupervised Anomaly-Based Cyberattack Detection in Imbalanced Smart Home Datasets","volume":"33","year":"2025","journal-title":"J. Netw. Syst. Manag."},{"key":"ref_30","doi-asserted-by":"crossref","unstructured":"Adewole, K.S., Jacobsson, A., and Davidsson, P. (2025). Intrusion Detection Framework for Internet of Things with Rule Induction for Model Explanation. Sensors, 25.","DOI":"10.3390\/s25061845"},{"key":"ref_31","doi-asserted-by":"crossref","first-page":"1745","DOI":"10.1109\/TMC.2018.2866249","article-title":"Classifying IoT Devices in Smart Environments Using Network Traffic Characteristics","volume":"18","author":"Sivanathan","year":"2019","journal-title":"IEEE Trans. Mob. Comput."},{"key":"ref_32","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/2523813","article-title":"A Survey on Concept Drift Adaptation","volume":"46","author":"Gama","year":"2014","journal-title":"Acm Comput. Surv."},{"key":"ref_33","doi-asserted-by":"crossref","unstructured":"Greco, D., Sohail, M.S., and Marchese, M. (2025). Detection of C-V2X Spoofing Attacks using Physical Layer Features and Graph Neural Networks. Proceedings of the the 2025 IEEE International Conference on Cyber Security and Resilience, CSR 2025, Chania, Greece, 4\u20136 August 2025, IEEE.","DOI":"10.1109\/CSR64739.2025.11130047"},{"key":"ref_34","doi-asserted-by":"crossref","first-page":"913","DOI":"10.1109\/TSUSC.2024.3386667","article-title":"Addressing Concept Drift in IoT Anomaly Detection: Drift Detection, Interpretation, and Adaptation","volume":"9","author":"Xu","year":"2024","journal-title":"IEEE Trans. Sustain. Comput."},{"key":"ref_35","doi-asserted-by":"crossref","unstructured":"Khoei, T.T., and Kaabouch, N. (2023). A Comparative Analysis of Supervised and Unsupervised Models for Detecting Attacks on the Intrusion Detection Systems. Information, 14.","DOI":"10.3390\/info14020103"}],"container-title":["Future Internet"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1999-5903\/18\/3\/133\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,3,4]],"date-time":"2026-03-04T13:30:48Z","timestamp":1772631048000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1999-5903\/18\/3\/133"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,3,4]]},"references-count":35,"journal-issue":{"issue":"3","published-online":{"date-parts":[[2026,3]]}},"alternative-id":["fi18030133"],"URL":"https:\/\/doi.org\/10.3390\/fi18030133","relation":{},"ISSN":["1999-5903"],"issn-type":[{"value":"1999-5903","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,3,4]]}}}