Beyond Single-Stage IDS: A Drift-Aware RS²FS Pipeline with Confidence Gating and Mahalanobis Open-Set Defense

Beyond Single-Stage IDS: A Drift-Aware RS²FS Pipeline with Confidence Gating and Mahalanobis Open-Set Defense | Research Square window.SnipcartSettings = { analytics: { enabled: false } }; (function() { var accessVector = localStorage.getItem('access_vector') || ''; window.dataLayer = window.dataLayer || []; if (accessVector) { window.dataLayer.push({ user: { profile: { profileInfo: { snid: accessVector } } } }); } })(); (function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','GTM-K279D39R'); Browse Preprints In Review Journals COVID-19 Preprints AJE Video Bytes Research Tools Research Promotion AJE Professional Editing AJE Rubriq About Preprint Platform In Review Editorial Policies Our Team Advisory Board Help Center Sign In Submit a Preprint Cite Share Download PDF Article Beyond Single-Stage IDS: A Drift-Aware RS²FS Pipeline with Confidence Gating and Mahalanobis Open-Set Defense Gomathi Sakthivel, Anitha kumari kumarasamy This is a preprint; it has not been peer reviewed by a journal. https://doi.org/ 10.21203/rs.3.rs-7728033/v1 This work is licensed under a CC BY 4.0 License Status: Published Journal Publication published 10 Jan, 2026 Read the published version in Scientific Reports → Version 1 posted 12 You are reading this latest preprint version Abstract Real-time intrusion detection in heterogeneous Internet of Things (IoT) networks involves continuously monitoring diverse connected devices and communication protocols to promptly identify malicious activities or anomalies. Due to varied device capabilities, dynamic topologies, and resource constraints, these systems leverage lightweight AI-driven analytics, edge processing, and adaptive security models to ensure minimal latency. Effective detection enhances resilience, safeguards sensitive data, and maintains seamless IoT operations in mission-critical environments. We propose a stage-specific Recursive Sparse & Relevance-based Feature Selection (RS²FS) and a confidence-gated Support Vector Machine (SVM)→SVM→ANFIS cascade for real-time intrusion detection in heterogeneous IoT networks. RS²FS combines elastic-net screening, MI∩mRMR relevance, stability selection, and margin-aware recursive pruning to yield compact, non-redundant feature sets per cascade stage. The cascade accepts easy cases with calibrated SVMs and routes ambiguous, family-localized traffic to per-family ANFIS rules, providing interpretable subtype decisions. Evaluated on CICIoT2023 with scenario-held-out splits (5× grouped CV), our model attains Macro-F1 = 0.962, Macro-AUC = 0.991, Balanced Accuracy = 0.963, MCC = 0.952, Brier = 0.038, and ECE = 0.012 at 6.3 ms CPU latency per window with a 7.8 MB footprint. Class-wise F1 shows consistent gains: Benign 0.991, DDoS 0.984, DoS 0.958, Recon 0.961, Web 0.937, Brute Force 0.951, Data Exfiltration 0.921, Botnet 0.942. Cascade behavior explains the speed–accuracy trade-off: 68% of windows are resolved at Stage-1 (F1 0.985, 3.38 ms), 22% at Stage-2 (F1 0.962, 7.73 ms), and only 10% escalate to ANFIS (F1 0.936, 23 ms). Against strong baselines, we improve Macro-F1 by + 1.9 pp over SVM-only (0.943), + 1.7 pp over XGBoost (0.945), and + 1.1 pp over a small 1D-CNN (0.951); bootstrap tests show significance (p < 0.01). The open-set guard achieves AUROC 0.981 and TPR@1%FPR 0.912 with 4.6% reject rate. Robustness holds under + 5% timestamp jitter (0.957), ± 10% packet-size noise (0.955), and 10% missing features (0.949). Interpretable ANFIS rules highlight payload-entropy, MQTT topic-depth, and DWT-energy interactions. Overall, the framework delivers accurate, calibrated, interpretable, and fast IDS suitable for deployment in modern IoT environments. Physical sciences/Engineering Physical sciences/Mathematics and computing Recursive Sparse & Relevance-based Feature Selection Internet of Things Confidence-gated Support Vector Machine Adaptive Security Model CICIoT2023 Elastic-net screening Full Text Additional Declarations No competing interests reported. Cite Share Download PDF Status: Published Journal Publication published 10 Jan, 2026 Read the published version in Scientific Reports → Version 1 posted Editorial decision: Revision requested 11 Nov, 2025 Reviews received at journal 08 Nov, 2025 Reviews received at journal 25 Oct, 2025 Reviewers agreed at journal 20 Oct, 2025 Reviewers agreed at journal 17 Oct, 2025 Reviews received at journal 16 Oct, 2025 Reviewers agreed at journal 16 Oct, 2025 Reviewers agreed at journal 15 Oct, 2025 Reviewers invited by journal 15 Oct, 2025 Editor assigned by journal 14 Oct, 2025 Submission checks completed at journal 09 Oct, 2025 First submitted to journal 09 Oct, 2025 You are reading this latest preprint version Research Square lets you share your work early, gain feedback from the community, and start making changes to your manuscript prior to peer review in a journal. As a division of Research Square Company, we’re committed to making research communication faster, fairer, and more useful. We do this by developing innovative software and high quality services for the global research community. Our growing team is made up of researchers and industry professionals working together to solve the most critical problems facing scientific publishing. Also discoverable on Platform About Our Team In Review Editorial Policies Advisory Board Help Center Resources Author Services Accessibility API Access RSS feed Manage Cookie Preferences © Research Square 2026 | ISSN 2693-5015 (online) Privacy Policy Terms of Service Do Not Sell My Personal Information {"props":{"pageProps":{"initialData":{"identity":"rs-7728033","acceptedTermsAndConditions":true,"allowDirectSubmit":false,"archivedVersions":[],"articleType":"Article","associatedPublications":[],"authors":[{"id":534865909,"identity":"acf31153-ee5e-46eb-99c6-3f5d4463750e","order_by":0,"name":"Gomathi Sakthivel","email":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAZAAAAAyAQMAAABI0h/eAAAABlBMVEX///8AAABVwtN+AAAACXBIWXMAAA7EAAAOxAGVKw4bAAABAUlEQVRIie3PMWrDMBSAYQmBvIhmTQnUV1Ax9DJZJAKdrC5ZPLhBk72Uzh1KcoV08fyMQV4MpVuhi9LeobhQQmS6ZLGdsRD9kx68T0gI+Xz/OEFRXVqRuCMh+hTBBcXNgtumI/hEggjcXO6ybhghoQ7ePt/T37sLCmIq1/fzSe5ImxT91wNbRrHhS8pK4LKo1VOFNX5oPvoJYrezmHKZTUEIWRilHSE46yeh7sjekdBykM9GbcYIgsDMVOYIgmstdaq2Y4RXjETqMXKkWSBhQL04Ug79Jczz3Vf8fSU3uq5/2nSl1q9Vadtk4GGE8eOx+ntt/35XYI+n1fCyz+fznWUHUqlhY49CzxAAAAAASUVORK5CYII=","orcid":"","institution":"Dr.N.G.P Institute of Technology","correspondingAuthor":true,"prefix":"","firstName":"Gomathi","middleName":"","lastName":"Sakthivel","suffix":""},{"id":534865910,"identity":"c3790340-3ebc-4f94-af1e-33f5ea42fa3b","order_by":1,"name":"Anitha kumari kumarasamy","email":"","orcid":"","institution":"PSG College of Technology","correspondingAuthor":false,"prefix":"","firstName":"Anitha","middleName":"kumari","lastName":"kumarasamy","suffix":""}],"badges":[],"createdAt":"2025-09-27 11:23:11","currentVersionCode":1,"declarations":"","doi":"10.21203/rs.3.rs-7728033/v1","doiUrl":"https://doi.org/10.21203/rs.3.rs-7728033/v1","draftVersion":[],"editorialEvents":[{"content":"https://doi.org/10.1038/s41598-025-34124-x","type":"published","date":"2026-01-10T15:57:32+00:00"}],"editorialNote":"","failedWorkflow":false,"files":[{"id":94624450,"identity":"e8f00db3-e9bc-450d-b648-3397317b9f74","added_by":"auto","created_at":"2025-10-29 04:36:44","extension":"docx","order_by":0,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":1739777,"visible":true,"origin":"","legend":"","description":"","filename":"BeyondSingleStageIDSmanuscriptR1.docx","url":"https://assets-eu.researchsquare.com/files/rs-7728033/v1/476c6a3b1b8c71b654ad3bd6.docx"},{"id":94624447,"identity":"0fabb731-2e3f-4591-a65c-31ecdb8a9f84","added_by":"auto","created_at":"2025-10-29 04:36:44","extension":"json","order_by":1,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":5124,"visible":true,"origin":"","legend":"","description":"","filename":"c03b48d3d69946939f6df0a083cb5ffc.json","url":"https://assets-eu.researchsquare.com/files/rs-7728033/v1/16fe1ed63c1b22fb6bfbd7a9.json"},{"id":94624449,"identity":"904c9696-bd74-486e-a5df-7d536b2e35cd","added_by":"auto","created_at":"2025-10-29 04:36:44","extension":"xml","order_by":2,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":187946,"visible":true,"origin":"","legend":"","description":"","filename":"c03b48d3d69946939f6df0a083cb5ffc1enriched.xml","url":"https://assets-eu.researchsquare.com/files/rs-7728033/v1/9e74c48948e8baea9e9af351.xml"},{"id":94624453,"identity":"07f9317c-b89d-40fa-9877-afd078bc3a31","added_by":"auto","created_at":"2025-10-29 04:36:44","extension":"png","order_by":3,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":1655166,"visible":true,"origin":"","legend":"","description":"","filename":"floatimage1.png","url":"https://assets-eu.researchsquare.com/files/rs-7728033/v1/bc9fb1883790b8837f1cd5de.png"},{"id":94624448,"identity":"af8c257f-4061-4ddf-81a0-73780b1bc4d2","added_by":"auto","created_at":"2025-10-29 04:36:44","extension":"png","order_by":4,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":130909,"visible":true,"origin":"","legend":"","description":"","filename":"Onlinefloatimage1.png","url":"https://assets-eu.researchsquare.com/files/rs-7728033/v1/e172e3e6617774efc53597be.png"},{"id":94640633,"identity":"0c5ee143-2ee4-403e-9657-4f0914d6c27e","added_by":"auto","created_at":"2025-10-29 07:49:57","extension":"xml","order_by":5,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":187387,"visible":true,"origin":"","legend":"","description":"","filename":"c03b48d3d69946939f6df0a083cb5ffc1structuring.xml","url":"https://assets-eu.researchsquare.com/files/rs-7728033/v1/8f58ab83cf5f718a6ea777c4.xml"},{"id":94639958,"identity":"d8dccfbc-4ef8-46c6-9278-01c0f85f5cd7","added_by":"auto","created_at":"2025-10-29 07:47:02","extension":"html","order_by":6,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":204035,"visible":true,"origin":"","legend":"","description":"","filename":"earlyproof.html","url":"https://assets-eu.researchsquare.com/files/rs-7728033/v1/5e087a817a3d007e4d95b54d.html"},{"id":100069107,"identity":"acbbc09f-18c8-46a0-8880-c682918c3a0f","added_by":"auto","created_at":"2026-01-12 16:09:41","extension":"pdf","order_by":1,"title":"","display":"","copyAsset":false,"role":"manuscript-pdf","size":656032,"visible":true,"origin":"","legend":"","description":"","filename":"BeyondSingleStageIDSmanuscriptR1.pdf","url":"https://assets-eu.researchsquare.com/files/rs-7728033/v1_covered_0682a6e1-01b0-457b-958b-a5fed731c520.pdf"}],"financialInterests":"No competing interests reported.","formattedTitle":"Beyond Single-Stage IDS: A Drift-Aware RS²FS Pipeline with Confidence Gating and Mahalanobis Open-Set Defense","fulltext":[],"fulltextSource":"","fullText":"","funders":[],"hasAdminPriorityOnWorkflow":false,"hasManuscriptDocX":false,"hasOptedInToPreprint":true,"hasPassedJournalQc":"","hasAnyPriority":false,"hideJournal":false,"highlight":"","institution":"","isAcceptedByJournal":true,"isAuthorSuppliedPdf":true,"isDeskRejected":"","isHiddenFromSearch":false,"isInQc":false,"isInWorkflow":false,"isPdf":true,"isPdfUpToDate":true,"isWithdrawnOrRetracted":false,"journal":{"display":true,"email":"[email protected]","identity":"scientific-reports","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":false,"externalIdentity":"scirep","sideBox":"Learn more about [Scientific Reports](http://www.nature.com/srep/)","snPcode":"","submissionUrl":"","title":"Scientific Reports","twitterHandle":"","acdcEnabled":true,"dfaEnabled":true,"editorialSystem":"stoa","reportingPortfolio":"Scientific Reports","inReviewEnabled":true,"inReviewRevisionsEnabled":true},"keywords":"Recursive Sparse \u0026 Relevance-based Feature Selection, Internet of Things, Confidence-gated Support Vector Machine, Adaptive Security Model, CICIoT2023, Elastic-net screening","lastPublishedDoi":"10.21203/rs.3.rs-7728033/v1","lastPublishedDoiUrl":"https://doi.org/10.21203/rs.3.rs-7728033/v1","license":{"name":"CC BY 4.0","url":"https://creativecommons.org/licenses/by/4.0/"},"manuscriptAbstract":"\u003cp\u003eReal-time intrusion detection in heterogeneous Internet of Things (IoT) networks involves continuously monitoring diverse connected devices and communication protocols to promptly identify malicious activities or anomalies. Due to varied device capabilities, dynamic topologies, and resource constraints, these systems leverage lightweight AI-driven analytics, edge processing, and adaptive security models to ensure minimal latency. Effective detection enhances resilience, safeguards sensitive data, and maintains seamless IoT operations in mission-critical environments. We propose a stage-specific Recursive Sparse \u0026amp; Relevance-based Feature Selection (RS\u0026sup2;FS) and a confidence-gated Support Vector Machine (SVM)\u0026rarr;SVM\u0026rarr;ANFIS cascade for real-time intrusion detection in heterogeneous IoT networks. RS\u0026sup2;FS combines elastic-net screening, MI\u0026cap;mRMR relevance, stability selection, and margin-aware recursive pruning to yield compact, non-redundant feature sets per cascade stage. The cascade accepts easy cases with calibrated SVMs and routes ambiguous, family-localized traffic to per-family ANFIS rules, providing interpretable subtype decisions. Evaluated on CICIoT2023 with scenario-held-out splits (5\u0026times; grouped CV), our model attains Macro-F1\u0026thinsp;=\u0026thinsp;0.962, Macro-AUC\u0026thinsp;=\u0026thinsp;0.991, Balanced Accuracy\u0026thinsp;=\u0026thinsp;0.963, MCC\u0026thinsp;=\u0026thinsp;0.952, Brier\u0026thinsp;=\u0026thinsp;0.038, and ECE\u0026thinsp;=\u0026thinsp;0.012 at 6.3 ms CPU latency per window with a 7.8 MB footprint. Class-wise F1 shows consistent gains: Benign 0.991, DDoS 0.984, DoS 0.958, Recon 0.961, Web 0.937, Brute Force 0.951, Data Exfiltration 0.921, Botnet 0.942. Cascade behavior explains the speed\u0026ndash;accuracy trade-off: 68% of windows are resolved at Stage-1 (F1 0.985, 3.38 ms), 22% at Stage-2 (F1 0.962, 7.73 ms), and only 10% escalate to ANFIS (F1 0.936, 23 ms). Against strong baselines, we improve Macro-F1 by +\u0026thinsp;1.9 pp over SVM-only (0.943), +\u0026thinsp;1.7 pp over XGBoost (0.945), and +\u0026thinsp;1.1 pp over a small 1D-CNN (0.951); bootstrap tests show significance (p\u0026thinsp;\u0026lt;\u0026thinsp;0.01). The open-set guard achieves AUROC 0.981 and TPR@1%FPR 0.912 with 4.6% reject rate. Robustness holds under +\u0026thinsp;5% timestamp jitter (0.957), \u0026plusmn;\u0026thinsp;10% packet-size noise (0.955), and 10% missing features (0.949). Interpretable ANFIS rules highlight payload-entropy, MQTT topic-depth, and DWT-energy interactions. Overall, the framework delivers accurate, calibrated, interpretable, and fast IDS suitable for deployment in modern IoT environments.\u003c/p\u003e","manuscriptTitle":"Beyond Single-Stage IDS: A Drift-Aware RS²FS Pipeline with Confidence Gating and Mahalanobis Open-Set Defense","msid":"","msnumber":"","nonDraftVersions":[{"code":1,"date":"2025-10-29 04:36:39","doi":"10.21203/rs.3.rs-7728033/v1","editorialEvents":[{"type":"communityComments","content":0},{"type":"decision","content":"Revision requested","date":"2025-11-11T12:46:36+00:00","index":"","fulltext":""},{"type":"editorInvitedReview","content":"","date":"2025-11-08T23:47:31+00:00","index":"hide","fulltext":""},{"type":"editorInvitedReview","content":"","date":"2025-10-25T13:50:14+00:00","index":"hide","fulltext":""},{"type":"reviewerAgreed","content":"48327321312003587785195404291392250025","date":"2025-10-21T01:08:31+00:00","index":"hide","fulltext":""},{"type":"reviewerAgreed","content":"255089727770242688729135112201720432660","date":"2025-10-17T21:53:20+00:00","index":"hide","fulltext":""},{"type":"editorInvitedReview","content":"","date":"2025-10-16T10:07:45+00:00","index":"hide","fulltext":""},{"type":"reviewerAgreed","content":"157855313796995803429679653897216453915","date":"2025-10-16T09:40:46+00:00","index":"hide","fulltext":""},{"type":"reviewerAgreed","content":"206421478150558352972269818853825649335","date":"2025-10-15T23:47:24+00:00","index":"hide","fulltext":""},{"type":"reviewersInvited","content":"","date":"2025-10-15T13:48:26+00:00","index":"","fulltext":""},{"type":"editorAssigned","content":"","date":"2025-10-14T15:50:04+00:00","index":"","fulltext":""},{"type":"checksComplete","content":"","date":"2025-10-09T15:59:17+00:00","index":"","fulltext":""},{"type":"submitted","content":"Scientific Reports","date":"2025-10-09T14:39:34+00:00","index":"","fulltext":""}],"status":"published","journal":{"display":true,"email":"[email protected]","identity":"scientific-reports","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":false,"externalIdentity":"scirep","sideBox":"Learn more about [Scientific Reports](http://www.nature.com/srep/)","snPcode":"","submissionUrl":"","title":"Scientific Reports","twitterHandle":"","acdcEnabled":true,"dfaEnabled":true,"editorialSystem":"stoa","reportingPortfolio":"Scientific Reports","inReviewEnabled":true,"inReviewRevisionsEnabled":true}}],"origin":"","ownerIdentity":"d55b59d9-5b29-466e-a853-df8ce1ff2ccf","owner":[],"postedDate":"October 29th, 2025","published":true,"recentEditorialEvents":[],"rejectedJournal":[],"revision":"","amendment":"","status":"published-in-journal","subjectAreas":[{"id":56867444,"name":"Physical sciences/Engineering"},{"id":56867445,"name":"Physical sciences/Mathematics and computing"}],"tags":[],"updatedAt":"2026-01-12T16:01:22+00:00","versionOfRecord":{"articleIdentity":"rs-7728033","link":"https://doi.org/10.1038/s41598-025-34124-x","journal":{"identity":"scientific-reports","isVorOnly":false,"title":"Scientific Reports"},"publishedOn":"2026-01-10 15:57:32","publishedOnDateReadable":"January 10th, 2026"},"versionCreatedAt":"2025-10-29 04:36:39","video":"","vorDoi":"10.1038/s41598-025-34124-x","vorDoiUrl":"https://doi.org/10.1038/s41598-025-34124-x","workflowStages":[]},"version":"v1","identity":"rs-7728033","journalConfig":"researchsquare"},"__N_SSP":true},"page":"/article/[identity]/[[...version]]","query":{"redirect":"/article/rs-7728033","identity":"rs-7728033","version":["v1"]},"buildId":"8U1c8b4HqxoKbykW_rLl7","isFallback":false,"isExperimentalCompile":false,"dynamicIds":[84888],"gssp":true,"scriptLoader":[]}